Project

General

Profile

Bug #6565

pargs crashes on growing env

Added by Simon Klinkert over 4 years ago. Updated about 4 years ago.

Status:
Closed
Priority:
Normal
Assignee:
-
Category:
cmd - userland programs
Start date:
2016-01-18
Due date:
% Done:

100%

Estimated time:
Difficulty:
Medium
Tags:
needs-triage
Gerrit CR:

Description

I've seen some strange pargs core dumps. Sometimes pargs dies when the target process adds environment variables. The problem is in get_env() and build_env(). We iterate two times over the environment strings. The first time to check the number of elements in order to determine the buffer size. Then we allocate the buffer and iterate again to fill this buffer. Meanwhile the target process has added some strings to the environment and the second iteration would fill too many strings into the buffer. There is no overflow protection.

I've attached a little reproducer.


Files

env_changer.pl (261 Bytes) env_changer.pl Simon Klinkert, 2016-01-19 09:35 AM

Related issues

Related to illumos gate - Bug #7931: pargs(1) still crashes on growing envClosed2017-03-03

Actions

History

#1

Updated by Electric Monk about 4 years ago

  • Status changed from New to Closed
  • % Done changed from 0 to 100

git commit 23a268cfbc75530b746495f3e157b9bc71069420

commit  23a268cfbc75530b746495f3e157b9bc71069420
Author: Simon Klinkert <simon.klinkert@gmail.com>
Date:   2016-04-28T18:16:52.000Z

    6565 pargs crashes on growing env
    Reviewed by: Robert Mustacchi <rm@joyent.com>
    Reviewed by: Toomas Soome <tsoome@me.com>
    Approved by: Dan McDonald <danmcd@omniti.com>

#2

Updated by Marcel Telka about 3 years ago

  • Related to Bug #7931: pargs(1) still crashes on growing env added

Also available in: Atom PDF