Summary

process-execute segfaults with huge amount of arguments

Metadata

Description

I've noticed this while using a script with the autocompile egg. Minimal reproduction example by sjamaan:

 (process-execute "/bin/echo" (map ->string (iota 4000)))

Changes and comments

[2016-07-23 16:47:18 UTC] sjamaan changed milestone from someday to 4.12.0

[2016-07-23 16:47:18 UTC] sjamaan wrote:

Putting it on 4.12 for the time being, under the assumption that it's likely something simple.

[2016-08-11 10:45:47 UTC] LemonBoy wrote:

Luckily it is quite simple this time :) posixunix.scm, the same applies for the windows variant The `setarg`/`setenv` functions will blindly set the `i`-th element of the given array without checking if the index is within the array boundaries; what happens here is a silly buffer overflow of the `C_exec_args`/`C_exec_env` buffers.

PS: It's probably worth to add a NULL guard for the `malloc` in `C_set_arg_string`.

[2016-08-11 11:45:15 UTC] sjamaan wrote:

There's already a patch proposed by C-Keen, and then an improved larger-scale refactoring + patch based on that, which is awaiting review on [[[http://lists.nongnu.org/archive/html/chicken-hackers/2016-07/msg00049.html|chicken-hackers]|]]

[2016-08-25 20:50:17 UTC] sjamaan changed status from new to closed

[2016-08-25 20:50:17 UTC] sjamaan removed difficulty

[2016-08-25 20:50:17 UTC] sjamaan set resolution to fixed

[2016-08-25 20:50:17 UTC] sjamaan wrote:

Fixed in 0d20426 / adcec28