ariadne
/
pkgconf
3
6
Fork 4
Code Issues 6 Pull Requests 2 Projects Releases 2 Wiki Activity

libpkgconf: personality: fix out of boundary access #193

Closed
stoeckmann wants to merge 1 commits from personality into master
pull from: personality
merge into: ariadne:master
Conversation 3 Commits 1 Files Changed 1

1 Commits (master)

Author SHA1 Message Date
Tobias Stoeckmann 891cc370a6 libpkgconf: personality: fix out of boundary access 
It is possible to set the instruction pointer to undefined values by
using an operator larger than ':' in ASCII.

Since the personality function array does not have 256 entries, an
invalid operator can overflow the array.

Proof of concept:

$ echo "a _ b" > poc
$ ln -s $(which pkgconf) poc-pkgconf
$ ./poc-pkgconf
 2020-05-24 23:13:19 +02:00