bugAVR In-System Programmer - Bugs: bug #1551, Buffer overflow causes crash in...

 
 

bug #1551: Buffer overflow causes crash in uisp on some s19 files

Submitted by:  None
Submitted on:  Tue 29 Oct 2002 10:38:37 PM UTC  
 
Category: NoneSeverity: 6 - Security
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Theodore A. Roth <troth>
Originator Email: -unavailable-Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 30 Oct 2002 11:24:33 PM UTC, comment #2:

Here's the ChangeLog entry which includes the fix:

2002-10-30 Theodore A. Roth <troth@openavr.org>
(Thanks to Seth LaForge <sethml@ofb.net> for pointing out the buffer overflow
problems.)

* configure.in (AM_INIT_AUTOMAKE): Bump version.
* src/Main.C: Add comment about dropping setuid privies.
* src/AvrAtmel.C: Remove unused variables.
* src/Makefile.am: Add -Wall and -Werror compile flags.
* src/MotIntl.C (Htoi): Make sure hex digit is valid.
(UploadMotorola): Increase size of seg_name[] to avoid buffer overflow.
(UploadMotorola): Check for possible read past end of line_buf.
(UploadMotorola): Add case for "S3" records.
(UploadIntel): Check for possible read past end of line_buf.

Theodore A. Roth <troth>In charge of this item.
Wed 30 Oct 2002 05:33:01 AM UTC, comment #1:

This is particularly nasty since uisp may be run SUID root if the user wishes to use direct parallel port access.

Could I get a file which causes this behaviour for testing?

Theodore A. Roth <troth>In charge of this item.
Tue 29 Oct 2002 10:38:37 PM UTC, original submission:

From: <sethml@ofb.net>

When using --upload or --verify with some .s19 files, uisp segfaults. It turns out that the segment name contained in these .s19 files is 40 characters long, and uisp uses a 32-character buffer to store them. This is a security hole - somebody could give you an .s19 file, and when you attempt to install it on an atmel, your machine could execute arbitrary code!

Attached is a patch to increase the segment name buffer to 260 characters, hopefully avoiding this problem. However, my patch does not fix the security hole - the file reading portion of the uisp code would need a complete rewrite to get rid of all of the security holes.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #124:  uisp-buffer-overflow.patch added by None (424B - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 4 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Wed 30 Oct 2002 11:24:33 PM UTCtrothOpen/ClosedOpen=>(Error - Not Found)
Wed 30 Oct 2002 11:24:32 PM UTCtrothStatusNone=>(Error - Not Found)
Wed 30 Oct 2002 05:33:01 AM UTCtrothSeverity3 - Normal=>(Error - Not Found)
  Assigned toNone=>NA

Back to the top


Powered by Savane 3.1-cleanup1