Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

typo in command leads to bogus execution #3

Open
rofl0r opened this issue May 4, 2016 · 0 comments
Open

typo in command leads to bogus execution #3

rofl0r opened this issue May 4, 2016 · 0 comments

Comments

@rofl0r
Copy link
Owner

rofl0r commented May 4, 2016

note missing space between echo and {}

$ seq 1000 | jobflow -threads=100 -exec echo{}
posix_spawn: No such file or directory
posix_spawn: No such file or directory
posix_spawn: No such file or directory
posix_spawn: No such file or directory
...
rofl0r added a commit that referenced this issue Sep 21, 2018
@rofl0r
fix buffer overflow with huge number of subst args
39ecf3a 
thanks to ole tange for reporting the issue.

echo a | ./jobflow.out -exec echo {} {} {} {} {} {} {} {} {} {} {} {} {} {} {} {} {} {} {}
=================================================================
==5173==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffd67da6970 at pc 0x7fb7c72b3904 bp 0x7ffd67d96740 sp 0x7ffd67d95ee8
WRITE of size 1 at 0x7ffd67da6970 thread T0
    #0 0x7fb7c72b3903 in __asan_memcpy (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x8c903)
    #1 0x4070e1 in substitute_all /home/rofl/jobflow/jobflow.c:544
    #2 0x407b1b in dispatch_line /home/rofl/jobflow/jobflow.c:635
    #3 0x408704 in main /home/rofl/jobflow/jobflow.c:752
    #4 0x7fb7c617082f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #5 0x401f18 in _start (/home/rofl/jobflow/jobflow.out+0x401f18)

Address 0x7ffd67da6970 is located in stack of thread T0 at offset 65888 in frame
    #0 0x407658 in dispatch_line /home/rofl/jobflow/jobflow.c:588

  This frame has 6 object(s):
    [32, 48) 'line_b'
    [96, 112) 'source_storage'
    [160, 176) '<unknown>'
    [224, 240) 'tilLastDot'
    [288, 304) '<unknown>'
    [352, 65888) 'subst_buf' <== Memory access at offset 65888 overflows this variable
HINT: this may be a false positive if your program uses some custom stack unwind mechanism or swapcontext
      (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-buffer-overflow ??:0 __asan_memcpy
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@rofl0r