Subject: Re: exploit with memcpy()
To: None <tech-userlevel@netbsd.org>
From: None <xs@kittenz.org>
List: tech-userlevel
Date: 07/02/2002 20:13:43
--6TrnltStXW4iwmi0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
on Tue, Jul 02, 2002 at 03:24:47PM +0000, Christos Zoulas wrote:
> And we should strive to eliminate functions in libc that write errors
> and warnings to stderr...
The only thing that springs to mind that does this is malloc(3). I'm sure
there are more. What do you think of this?
--6TrnltStXW4iwmi0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: attachment; filename="malloc.warn"
Index: malloc.c
===================================================================
RCS file: /cvsroot/basesrc/lib/libc/stdlib/malloc.c,v
retrieving revision 1.38
diff -u -r1.38 malloc.c
--- malloc.c 2001/05/06 04:48:41 1.38
+++ malloc.c 2002/07/02 19:09:56
@@ -232,6 +232,9 @@
/* junk fill ? */
static int malloc_junk;
+/* display warnings/errors on stderr? */
+static int malloc_warn;
+
#ifdef HAS_UTRACE
/* utrace ? */
@@ -279,10 +282,12 @@
{
const char *progname = getprogname();
char *q = " error: ";
- write(STDERR_FILENO, progname, strlen(progname));
- write(STDERR_FILENO, malloc_func, strlen(malloc_func));
- write(STDERR_FILENO, q, strlen(q));
- write(STDERR_FILENO, p, strlen(p));
+ if (malloc_warn) {
+ write(STDERR_FILENO, progname, strlen(progname));
+ write(STDERR_FILENO, malloc_func, strlen(malloc_func));
+ write(STDERR_FILENO, q, strlen(q));
+ write(STDERR_FILENO, p, strlen(p));
+ }
suicide = 1;
abort();
}
@@ -294,6 +299,9 @@
char *q = " warning: ";
if (malloc_abort)
wrterror(p);
+ else if (!malloc_warn)
+ return;
+
write(STDERR_FILENO, progname, strlen(progname));
write(STDERR_FILENO, malloc_func, strlen(malloc_func));
write(STDERR_FILENO, q, strlen(q));
@@ -441,6 +449,8 @@
b[j] = '\0';
p = b;
} else if (i == 1) {
+ if (issetugid())
+ continue;
p = getenv("MALLOC_OPTIONS");
} else {
p = malloc_options;
@@ -463,6 +473,8 @@
#endif
case 'v': malloc_sysv = 0; break;
case 'V': malloc_sysv = 1; break;
+ case 'w': malloc_warn = 0; break;
+ case 'W': malloc_warn = 1; break;
case 'x': malloc_xmalloc = 0; break;
case 'X': malloc_xmalloc = 1; break;
case 'z': malloc_zero = 0; break;
--6TrnltStXW4iwmi0--