InfoSect's Month of Pointless Bugs (#22)

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #22

In the freesweep game:

void* xmalloc(size_t num)
{
        void *vec = NULL;

        vec = (void*)malloc(sizeof(unsigned char) * num);

        if (vec == NULL)
        {
                SweepError("Out of Memory. Sorry");
                exit(EXIT_FAILURE);
        }

        return vec;
}

...

struct BestEntry* NewBestEntry(GameStats *Game)
{
        struct BestEntry *b = NULL;
        time_t now;
        char *buf = NULL, *p = NULL;

        b = (struct BestEntry*)xmalloc(sizeof(struct BestEntry) * 1);

        /* fill in some attributes */
        b->area = Game->Height * Game->Width;
        b->mines = Game->NumMines;
        b->time = Game->Time;

        /* do the username */
        buf = getenv("USER");
        if (buf == NULL)
        {
                SweepError("You do not have a username!");
                buf = "unknown";
        }
        strncpy(b->name, buf, sizeof(b->name)-1);

This may be a small bug, but b->name is not guaranteed to be NUL terminated. I included the xmalloc code because if calloc was used for memory allocation, then it would have been zeroed out. However, calloc was not used. Malloc does not zero memory.

Comments

Popular posts from this blog

NetBSD kernel wscons IOCTL vulnerable bug class

Linux Kernel Infoleaks

InfoSect's Month of Pointless Bugs (#1, #2)