Skip to content
This repository has been archived by the owner on Dec 29, 2020. It is now read-only.

Fix malloc off-by-one seg fault due to not accounting for the null terminator #47

Merged
merged 1 commit into from
Jul 26, 2018

Conversation

jvm3487
Copy link
Contributor

@jvm3487 jvm3487 commented Jul 25, 2018

We experienced a crash when running the latest master with a simplified decoded backtrace of:

free (cursorname) on line 72 of fw1-cursor.c
open_fw1_cursorfile()
main()

Raw:
*** glibc detected *** /usr/local/bin/fw1-loggrabber: free(): invalid next size (fast): 0x08494768 ***
======= Backtrace: =========
/lib/libc.so.6(+0x70bb1)[0xf742abb1]
/lib/libc.so.6(+0x73611)[0xf742d611]
/usr/local/bin/fw1-loggrabber[0x804e098]
/usr/local/bin/fw1-loggrabber[0x804f432]
/lib/libc.so.6(__libc_start_main+0xe6)[0xf73d0d26]
/usr/local/bin/fw1-loggrabber[0x804d361]

From a review of how cursorname is constructed in get_fw1_cursorname(), it appears that the malloc is one byte too small since ".cursor" is 7 bytes and the NULL terminator is 1 byte. Therefore, it should be:

char *cursorname =
(char *) malloc (strlen (LogfileName) + 8);

instead of:

char *cursorname =
(char *) malloc (strlen (LogfileName) + 7);

The fix provided attempts to do the +8 in a more maintainable way by preventing needing to actually count the bytes in ".cursor".

@jvm3487 jvm3487 mentioned this pull request Jul 25, 2018
@adepasquale
Copy link
Contributor

Probably introduced by commit e843a0f in #37.

Your prq should fix the issue, thanks!

@ManofWax ManofWax merged commit b038a4d into certego:master Jul 26, 2018
@ManofWax
Copy link
Contributor

Thanks for the bug fix!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants