InfoSect's Month of Pointless Bugs (#4)

Dr Silvio Cesare

InfoSect, Canberra's hackerspace, regularly runs public group sessions to perform code review and vulnerability discovery. Over the next 30 days, I'll highlight the source code of 30 unknown vulnerabilities.

Bug #4

In the jazip package in src/scsi.c

   while ((mp=getmntent(mtab))) 
      if (!strncmp(mp->mnt_fsname,fs,8)) break;
        if( mp != NULL ){
                strcpy( mnt_fsname, mp->mnt_fsname );
                strcpy( mnt_dir, mp->mnt_dir );
                strcpy( mnt_type, mp->mnt_type );
                strcpy (mesg, "device is mounted");
        }
   endmntent(mtab);
   return (mp != NULL);

and in src/jazip.h

char mnt_dir[512], mnt_type[64], mnt_fsname[64];

But lets look at an example where path lengths are not so small (which is system and fs specific):

$ getconf -a |grep PATH_MAX

PATH_MAX                           4096

_POSIX_PATH_MAX                    4096
$ getconf -a|grep -w NAME_MAX
NAME_MAX                           255

Clearly the static buffers are much smaller than what can be created on the filesystem. Hence, there is a potential for buffer overflows.