1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
|
From 079877486d9bbe170de2fbc3cba37713d11ab224 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Wed, 23 Jul 2025 17:33:04 +0200
Subject: [PATCH 1/2] Avoid unnecessary copy of argv[0]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The programme is copying the contents of *argv[0] into a fixed‐size
buffer of 512 bytes using strcpy(). This might result in a buffer
overflow and is unnecessary as the contents are never modified.
---
prctl.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/prctl.c b/prctl.c
index 38cbcd1..b8cb85b 100644
--- a/prctl.c
+++ b/prctl.c
@@ -51,13 +51,13 @@ struct option longopts[] = {
int verbose=0;
void
-print_version(char *progname)
+print_version(char const *progname)
{
printf("%s version %s\n", progname, VERSION);
}
void
-usage(char *progname)
+usage(char const *progname)
{
print_version(progname);
printf("Usage: %s [-v] [-h|--help] [--version]\n", progname);
@@ -273,8 +273,7 @@ int
main(int argc, char **argv)
{
int opt, cmd_start;
- char *progname;
- char fullpath[512];
+ char const *progname;
char shellname[128];
int unaligned_val = -99;
int fpemu_val = -99;
@@ -284,11 +283,10 @@ main(int argc, char **argv)
int display_all = 0;
int umask;
- strcpy(fullpath, argv[0]);
- if ((progname = strrchr(fullpath, '/')) != NULL) {
+ if ((progname = strrchr(argv[0], '/')) != NULL) {
progname++;
} else {
- progname = fullpath;
+ progname = argv[0];
}
/*
From c233d083cec389e10dc9e85b3a835cf81246c275 Mon Sep 17 00:00:00 2001
From: Mikael Voss <mvs@nyantec.com>
Date: Wed, 23 Jul 2025 17:57:59 +0200
Subject: [PATCH 2/2] Avoid unnecessary copy of shell path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
The programme tries getenv("SHELL") and getpwuid(getuid())->pw_shell to
determine the preferred shell, falling back to DEFAULT_SHELL, and
copies the contents pointed to into a fixed‐sized buffer of 128 bytes
using strcpy().
This could result in a buffer overflow and is not necessary: While both
getenv() and getpwuid() return pointers to locations which might get
modified by subsequent calls to their respective function families,
they are only called once, so that these pointers can be aliased safely.
In addition, getenv("SHELL") would return a null pointer if the variable
is unset in the environment, resulting in a null pointer dereference in
the enclosing strcpy() call.
---
prctl.c | 22 +++++++++-------------
1 file changed, 9 insertions(+), 13 deletions(-)
diff --git a/prctl.c b/prctl.c
index b8cb85b..342419c 100644
--- a/prctl.c
+++ b/prctl.c
@@ -274,7 +274,7 @@ main(int argc, char **argv)
{
int opt, cmd_start;
char const *progname;
- char shellname[128];
+ char const *shellname;
int unaligned_val = -99;
int fpemu_val = -99;
int mcekill_val = -99;
@@ -443,31 +443,27 @@ main(int argc, char **argv)
}
printf("Starting a shell\n");
- strcpy(shellname, getenv("SHELL"));
-
+ shellname = getenv("SHELL");
+
/*
* Make sure SHELL environment variable is not unset. If it
- * is, start bash.
+ * is, start user login shell or bash.
*/
- if (shellname[0] == 0) {
+ if (shellname == NULL) {
struct passwd *pwd_entry;
pwd_entry = getpwuid(getuid());
- if (pwd_entry == NULL) {
- strcpy(shellname, DEFAULT_SHELL);
+ if (pwd_entry != NULL && pwd_entry->pw_shell != NULL) {
+ shellname = pwd_entry->pw_shell;
} else {
- if (pwd_entry->pw_shell != NULL) {
- strcpy(shellname, pwd_entry->pw_shell);
- } else {
- strcpy(shellname, DEFAULT_SHELL);
- }
+ shellname = DEFAULT_SHELL;
}
}
/*
* Now exec the shell
*/
- if (execlp(shellname, (char *)shellname, (char *) 0) == -1) {
+ if (execlp(shellname, shellname, (char *) 0) == -1) {
fprintf(stderr, "Failed to exec the shell: %s\n",
strerror(errno));
exit(1);
|
