InfoSect's Month of Pointless Bugs (#22)

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #22

In the freesweep game:

void* xmalloc(size_t num)

{

        void *vec = NULL;

        vec = (void*)malloc(sizeof(unsigned char) * num);

        if (vec == NULL)

        {

                SweepError("Out of Memory. Sorry");

                exit(EXIT_FAILURE);

        }

        return vec;

}

...

struct BestEntry* NewBestEntry(GameStats *Game)

{

        struct BestEntry *b = NULL;

        time_t now;

        char *buf = NULL, *p = NULL;

        b = (struct BestEntry*)xmalloc(sizeof(struct BestEntry) * 1);

        /* fill in some attributes */

        b->area = Game->Height * Game->Width;

        b->mines = Game->NumMines;

        b->time = Game->Time;

        /* do the username */

        buf = getenv("USER");

        if (buf == NULL)

        {

                SweepError("You do not have a username!");

                buf = "unknown";

        }

        strncpy(b->name, buf, sizeof(b->name)-1);

This may be a small bug, but b->name is not guaranteed to be NUL terminated. I included the xmalloc code because if calloc was used for memory allocation, then it would have been zeroed out. However, calloc was not used. Malloc does not zero memory.