]> git.ipfire.org Git - thirdparty/util-linux.git/commit
lib/path: fix possible out of boundary access
authorTobias Stoeckmann <tobias@stoeckmann.org>
Sun, 8 Oct 2023 18:41:29 +0000 (20:41 +0200)
committerKarel Zak <kzak@redhat.com>
Fri, 24 Nov 2023 10:03:21 +0000 (11:03 +0100)
commit5ec30a362a5dd91c018c04a64fd1a481029dc4c6
tree7325f0024567500fb0f00f2caefe8daba83c44a2
parentedc723cd3341ff3d3e660051525dca40a2af6b3b
lib/path: fix possible out of boundary access

If fgets reads from a file starting with a NUL byte in ul_path_cpuparse,
then the check for newline leads to an out of boundary access.

Proof of Concept (compile with --enable-asan):

1. Prepare /tmp/poc with required files
```
$ install -d /tmp/poc/sys/devices/system/cpu
$ dd if=/dev/zero of=/tmp/poc/sys/devices/system/cpu/possible bs=1 count=1
$ install -D /dev/null /tmp/poc/proc/cpuinfo
```

2. Run lscpu with sysroot option
```
$ lscpu --sysroot /tmp/poc
=================================================================
==78238==ERROR: AddressSanitizer: heap-buffer-overflow
```

Signed-off-by: Tobias Stoeckmann <tobias@stoeckmann.org>
lib/path.c