On 06/14/2010 10:48 AM, Dmitri Pal wrote:
> Jakub Hrozek wrote:
>
>> On 06/14/2010 04:13 PM, Stephen Gallagher wrote:
>>
>>> On 06/14/2010 10:10 AM, Stephen Gallagher wrote:
>>>
>>>>
https://fedorahosted.org/sssd/ticket/540
>>>>
>>>> It was unlikely, but if the path to the socket file exceeded 108
>>>> characters, this strncpy would be unterminated and the results could be
>>>> unexpected. This was not an exploitable vulnerability.
>>>>
>>>>
>>> I forgot to mention, this patch should apply to both master and
>>>
>> sssd-1-2.
>>
>>
>> ACK
>>
> I am not sure... From man page:
>
> sun_family always contains AF_UNIX. sun_path contains the
> zero-terminated pathname of the
> socket in the file system. If sun_path starts with a null byte (’’ ’),
> then it refers to the
> abstract namespace maintained by the Unix protocol module. The socket’s
> address in this
> namespace is given by the rest of the bytes in sun_path. Note that names
> in the abstract
> namespace are not zero-terminated.
>
> So the right approach would probably be memcpy of the sizeof rather than
> strncpy.
> It really depends whether we trust the claim above that it is NULL
> terminated and we can guarantee that we are not going to ever get
> addresses in the abstract namespace.
>
>
I'm not sure where you're going with this. We're strncpy()ing FROM
rctx->sock_name (which we ourselves construct and can guarantee is
null-terminated) into addr.sun_path. What we're doing here is making
sure that if rctx->sock_name exceeds the size of addr.sun_path, then we
ensure that it is null-terminated.
We're guaranteed that the first byte of addr.sun_path will never be NULL
here, so there's no concern about the abstract namespace.
If we are do it ourselves. I guess it is Ok.
--
Thank you,
Dmitri Pal
Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?