Subject: [clisp-list] buffer overflow weakness in avcall/ffcall (was: execl, et al.)

From: "Hoehle, Joerg-Cyril" <[email-masked]>
Date: Mon Dec 16 09:26:04 2002

Hi,

Pascal's post about a def-lib-call being generated at run-time for execl made me remember the inner workings of the avcall package.

avcall.h uses a fixed array internally: 
/* Max # words in argument-list and temporary structure storage. 
 */ 
#define __AV_ALIST_WORDS 256 

Without argument checking, there will be core dumps when given too many arguments. Neither avcall itself nor its caller (src/foreign.d) check this. As a result, you can blow the Lisp application.

[Typical vulnerability hunting with C: go search for places with arbitrary limits and see whether they are checked.]

BTW, while a typical UNIX shell may expand many *, there's a limit on the length.

That's where xargs comes in handy.

>fgrep mumbojumbo `find ~/sspace/src/clisp-2.28/ -type f -print`
-- Too many words from ``
>find ~/sspace/src/clisp-2.28/ -type f -print | xargs fgrep mumbojumbo
-- works

BTW, IMHO libraries should export the values (via API) with which they were compiled, as part of a well-design API:
size_t get_avcall_limit() {return __AV_ALIST_WORDS;}
Because the visible #define doesn't say anything about the value at the time they were compiled: that' the only one which counts.

I filed bug-report #654718
It's never been a problem in practive so far - apparently.

Regards,
	Jörg Höhle.

---

From: Sam Steingold <[email-masked]>
Date: Mon Dec 16 10:13:03 2002

> * In message <[email-masked]>
> * On the subject of "[clisp-list] buffer overflow weakness in avcall/ffcall (was: execl, et al.)"
> * Sent on Mon, 16 Dec 2002 18:25:15 +0100
> * Honorable "Hoehle, Joerg-Cyril" <[email-masked]> writes:
>
> 

Could you please _fix_ the bug?

-- 
Sam Steingold (http://www.podval.org/~sds) running RedHat8 GNU/Linux
<http://www.camera.org> <http://www.iris.org.il> <http://www.memri.org/>
<http://www.mideasttruth.com/> <http://www.palestine-central.com/links.html>
will write code that writes code that writes code for food