Out-of-bounds access in alias command

Out-of-bounds access in alias command

[Harald van Dijk]

Hi,

Consider

   alias ""

In aliascmd(), we have

     while ((n = *++argv) != NULL) {
       if ((v = strchr(n+1, '=')) == NULL) { /* n+1: funny ksh stuff */

When *n == '\0', the strchr(n+1, '=') searches past the end of the string.

I have not yet been able to construct a test case where this causes 
problems, because my attempts have resulted in the memory following this 
empty string not containing any = before another null byte appears.

Cheers,
Harald van Dijk

Re: Out-of-bounds access in alias command

[Harald van Dijk]

On 09/01/2023 00:02, Harald van Dijk wrote:
> Hi,
> 
> Consider
> 
>    alias ""
> 
> In aliascmd(), we have
> 
>      while ((n = *++argv) != NULL) {
>        if ((v = strchr(n+1, '=')) == NULL) { /* n+1: funny ksh stuff */

I had trusted that this "n+1: funny ksh stuff" logic which allows an 
alias to start with = was because ksh allows this, but I tested this 
now, it does not and I can find no evidence that it ever did. Maybe it 
would be good to just remove this exception, or if dash wants to keep 
it, document it as an ash extension rather than claim it as a ksh thing?

Cheers,
Harald van Dijk

[PATCH] alias: Fix out-of-bound access

[Herbert Xu]

Harald van Dijk <harald@gigawatt.nl> wrote:
>
> I had trusted that this "n+1: funny ksh stuff" logic which allows an 
> alias to start with = was because ksh allows this, but I tested this 
> now, it does not and I can find no evidence that it ever did. Maybe it 
> would be good to just remove this exception, or if dash wants to keep 
> it, document it as an ash extension rather than claim it as a ksh thing?

Thanks.  This patch should fix the overrun.

---8<---
Check for empty string before searching for equal sign starting at
n+1 in aliascmd.

Reported-by: Harald van Dijk <harald@gigawatt.nl>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/src/alias.c b/src/alias.c
index fcad43b..cee07e9 100644
--- a/src/alias.c
+++ b/src/alias.c
@@ -143,7 +143,8 @@ aliascmd(int argc, char **argv)
 		return (0);
 	}
 	while ((n = *++argv) != NULL) {
-		if ((v = strchr(n+1, '=')) == NULL) { /* n+1: funny ksh stuff */
+		/* n + 1: funny ksh stuff (from 44lite) */
+		if (!*n || !(v = strchr(n + 1, '='))) {
 			if ((ap = *__lookupalias(n)) == NULL) {
 				outfmt(out2, "%s: %s not found\n", "alias", n);
 				ret = 1;
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt