InfoSect's Month of Pointless Bugs (#22)
InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.
Bug #22
Bug #22
In the freesweep game:
void* xmalloc(size_t num)
{
void *vec = NULL;
vec = (void*)malloc(sizeof(unsigned char) * num);
if (vec == NULL)
{
SweepError("Out of Memory. Sorry");
exit(EXIT_FAILURE);
}
return vec;
}
...
struct BestEntry* NewBestEntry(GameStats *Game)
{
struct BestEntry *b = NULL;
time_t now;
char *buf = NULL, *p = NULL;
b = (struct BestEntry*)xmalloc(sizeof(struct BestEntry) * 1);
/* fill in some attributes */
b->area = Game->Height * Game->Width;
b->mines = Game->NumMines;
b->time = Game->Time;
/* do the username */
buf = getenv("USER");
if (buf == NULL)
{
SweepError("You do not have a username!");
buf = "unknown";
}
strncpy(b->name, buf, sizeof(b->name)-1);
This may be a small bug, but b->name is not guaranteed to be NUL terminated. I included the xmalloc code because if calloc was used for memory allocation, then it would have been zeroed out. However, calloc was not used. Malloc does not zero memory.