From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001 From: Craig Small Date: Thu, 10 Aug 2023 21:18:38 +1000 Subject: [PATCH] ps: Fix possible buffer overflow in -C option ps allocates memory using malloc(length of arg * len of struct). In certain strange circumstances, the arg length could be very large and the multiplecation will overflow, allocating a small amount of memory. Subsequent strncpy() will then write into unallocated memory. The fix is to use calloc. It's slower but this is a one-time allocation. Other malloc(x * y) calls have also been replaced by calloc(x, y) References: https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016 https://nvd.nist.gov/vuln/detail/CVE-2023-4016 https://gitlab.com/procps-ng/procps/-/issues/297 https://bugs.debian.org/1042887 Signed-off-by: Craig Small CVE: CVE-2023-4016 Upstream-Status: Backport [https://gitlab.com/procps-ng/procps/-/commit/2c933ecba3bb1d3041a5a7a53a7b4078a6003413] Signed-off-by: Peter Marko --- NEWS | 1 + ps/parser.c | 8 ++++---- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/NEWS b/NEWS index b9509734..64fa3da8 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,5 @@ + * ps: Fix buffer overflow in -C option CVE-2023-4016 Debian #1042887, issue #297 + procps-ng-3.3.16 ---------------- * library: Increment to 8:2:0 diff --git a/ps/parser.c b/ps/parser.c index 248aa741..15873dfa 100644 --- a/ps/parser.c +++ b/ps/parser.c @@ -184,7 +184,6 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s const char *err; /* error code that could or did happen */ /*** prepare to operate ***/ node = malloc(sizeof(selection_node)); - node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */ node->n = 0; buf = strdup(arg); /*** sanity check and count items ***/ @@ -205,6 +204,7 @@ static const char *parse_list(const char *arg, const char *(*parse_fn)(char *, s } while (*++walk); if(need_item) goto parse_error; node->n = items; + node->u = calloc(items, sizeof(sel_union)); /*** actually parse the list ***/ walk = buf; while(items--){ @@ -1031,15 +1031,15 @@ static const char *parse_trailing_pids(void){ thisarg = ps_argc - 1; /* we must be at the end now */ pidnode = malloc(sizeof(selection_node)); - pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ + pidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ pidnode->n = 0; grpnode = malloc(sizeof(selection_node)); - grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ + grpnode->u = calloc(i,sizeof(sel_union)); /* waste is insignificant */ grpnode->n = 0; sidnode = malloc(sizeof(selection_node)); - sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */ + sidnode->u = calloc(i, sizeof(sel_union)); /* waste is insignificant */ sidnode->n = 0; while(i--){ -- GitLab