Subject: SIGVEC popen()

From: Alain Magloire <[email-masked]>
Date: Tue, 27 May 1997 14:23:41 -0400 (EDT)

This is an old bug
  about popen.c(ftpd_popen() once again). It was reported before
but I did not see any patch for it. I don't know if it's exploitable
on the non-beta releases of wu-ftpd or other ftp servers. To see
if you are affected just telnet and to ftpd and try a LIST command
with more then 100 arguments

telnet localhost ftp
Trying 127.0.0.1 ...
Connected to localhost.
Escape character is '^]'.
220-
220-  Welcome, archive user.
....
user ftp
331 Guest login ..
pass me@
230 Guest login ok, ..
LIST a a a a a a a a a ..... about a hundred

A trace showed:
read(0, "LIST a a a a a a a a a a a a a a"..., 4096) = 257
..
gettimeofday({864752992, 39532}, NULL)  = 0
getdtablesize()                         = 256
pipe([8, 9])                            = 8
--- SIGSEGV (Segmentation fault) ---
gettimeofday({864752992, 52091}, NULL)  = 0
....

Since, I no longer follow this list regularly, please CC me if any followups
thanks (mail cc to academ).

The for() loop expression doesn't sufficiently check the end of the array

for (gargc = argc = 1; argv[argc]; argc++) 
                      ^^^^^^^^^^^^

argv is local array and may not be null terminated if the number of arguments
goes over MAX_ARGV. Result will be SIGVEC.

cd wu-ftpd/wu-ftpd-2.4.2-beta-13/src; patch < file
*** ./popen.c.orig      Tue May 27 13:12:05 1997
--- ./popen.c   Tue May 27 13:43:42 1997
***************
*** 124,131 ****
      if (pipe(pdes) < 0)
          return (NULL);
  
      /* break up string into pieces */
!     for (argc = 0, cp = program;argc < MAX_ARGV ; cp = NULL)
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;
  
--- 124,133 ----
      if (pipe(pdes) < 0)
          return (NULL);
  
+     /* empty the array */
+     memset((char *)argv, '\0', sizeof(argv));
      /* break up string into pieces */
!     for (argc = 0, cp = program;argc < MAX_ARGV - 1 ; cp = NULL)
          if (!(argv[argc++] = strtok(cp, " \t\n")))
              break;

-- 
au revoir, alain
----
Aussi haut que l'on soit assis, on est toujours assis que sur son cul !!!

---

From: Peter Greis <[email-masked]>
Date: Tue, 27 May 1997 16:18:01 -0400 (EDT)

OK, I have patched popen, and I no long see SIGVEC; I have moved the
executables to a directory beneath /bin (although the faq references
compress and friends in bin...).

Still no luck; is there any great advantage to using the academ version
versus the regular release?

curious,

-peter

===================================================================
Peter Greis           [email-masked]       [email-masked]
Toolsmyth
The MathWorks, Inc.                   <NeXT & MIME mail accepted>
N1YDE                                 Registered Be Developer
                 "Hakuna Matata" - The Lion King
===================================================================

---

From: Alain Magloire <[email-masked]>
Date: Tue, 27 May 1997 17:09:51 -0400 (EDT)

Bonjour Peter,

> OK, I have patched popen, and I no long see SIGVEC;

glad it was usefull

> versus the regular release?

academ version fixes a lot of bug and security holes, so I would
recommand to use it.

> I have moved the

Huh !
Sorry, I don't read the list and did not see your previous posts

Sound, you having problem with tarring anc compressing on the fly ?

the first step: see if it works under regular login .i.e non 
anonymous. if yes, it's maybe something du to the chroot() or the
path.

check the ftpconversion file, maybe the syntax is wrong.

send the ftpconversion file to the list, maybe someone could help
(you can CC to me, I have some hours to spare)

> curious,

good luck