Monday, 19 February 2018

InfoSect's Month of Pointless Bugs (#22)

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #22

In the freesweep game:

void* xmalloc(size_t num)
{
        void *vec = NULL;

        vec = (void*)malloc(sizeof(unsigned char) * num);

        if (vec == NULL)
        {
                SweepError("Out of Memory. Sorry");
                exit(EXIT_FAILURE);
        }

        return vec;
}

...

struct BestEntry* NewBestEntry(GameStats *Game)
{
        struct BestEntry *b = NULL;
        time_t now;
        char *buf = NULL, *p = NULL;

        b = (struct BestEntry*)xmalloc(sizeof(struct BestEntry) * 1);

        /* fill in some attributes */
        b->area = Game->Height * Game->Width;
        b->mines = Game->NumMines;
        b->time = Game->Time;

        /* do the username */
        buf = getenv("USER");
        if (buf == NULL)
        {
                SweepError("You do not have a username!");
                buf = "unknown";
        }
        strncpy(b->name, buf, sizeof(b->name)-1);

This may be a small bug, but b->name is not guaranteed to be NUL terminated. I included the xmalloc code because if calloc was used for memory allocation, then it would have been zeroed out. However, calloc was not used. Malloc does not zero memory.

Exploiting the Lorex 2K Indoor Wifi at Pwn2Own Ireland

Introduction In October InfoSect participated in Pwn2Own Ireland 2024 and successfully exploited the Sonos Era 300 smart speaker and Lor...