On 06/14/2010 10:48 AM, Dmitri Pal wrote:
Jakub Hrozek wrote:
> On 06/14/2010 04:13 PM, Stephen Gallagher wrote:
>> On 06/14/2010 10:10 AM, Stephen Gallagher wrote:
>>>
https://fedorahosted.org/sssd/ticket/540
>>>
>>> It was unlikely, but if the path to the socket file exceeded 108
>>> characters, this strncpy would be unterminated and the results could be
>>> unexpected. This was not an exploitable vulnerability.
>>>
>> I forgot to mention, this patch should apply to both master and
> sssd-1-2.
>
>
> ACK
I am not sure... From man page:
sun_family always contains AF_UNIX. sun_path contains the
zero-terminated pathname of the
socket in the file system. If sun_path starts with a null byte (’’ ’),
then it refers to the
abstract namespace maintained by the Unix protocol module. The socket’s
address in this
namespace is given by the rest of the bytes in sun_path. Note that names
in the abstract
namespace are not zero-terminated.
So the right approach would probably be memcpy of the sizeof rather than
strncpy.
It really depends whether we trust the claim above that it is NULL
terminated and we can guarantee that we are not going to ever get
addresses in the abstract namespace.
I'm not sure where you're going with this. We're strncpy()ing FROM
rctx->sock_name (which we ourselves construct and can guarantee is
null-terminated) into addr.sun_path. What we're doing here is making
sure that if rctx->sock_name exceeds the size of addr.sun_path, then we
ensure that it is null-terminated.
We're guaranteed that the first byte of addr.sun_path will never be NULL
here, so there's no concern about the abstract namespace.
--
Stephen Gallagher
RHCE 804006346421761
Delivering value year after year.
Red Hat ranks #1 in value among software vendors.
http://www.redhat.com/promo/vendor/