You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@subversion.apache.org by David James <ja...@gmail.com> on 2005/07/02 20:32:24 UTC
[PATCH] Subversion Command-Line Client crashes with long lists of options
Right now, if you pass in a really long list of valid arguments into
the command-line client, you can overflow its buffer of command-line
options and execute arbitrary code. The impact of this bug is
mitigated by the fact that users who have access to the command-line
client can usually already execute arbitrary code.
To see this bug in action, type the following command:
yes --old | head -n 300 | xargs svn
Before the patch:
james@syntax% yes --old | head -n 300 | xargs svn
xargs: svn: terminated by signal 11
After the patch:
james@syntax% yes --old | head -n 300 | xargs subversion/clients/cmdline/svn
svn: Too many options
clients/cmdline/main.c
(main): Prevent buffer overflow when list of command-line options is very long
Cheers,
David
Re: [PATCH] Subversion Command-Line Client crashes with long lists of options
Posted by kf...@collab.net.
kfogel@collab.net writes:
> Nice catch! I see that Max committed r15251 to fix.
>
> Hint for next time: please mail security{+ AT +}subversion.tigris.org first
> if you suspect something might be a security hole. That way it can be
> evaluated privately before the public becomes aware of it.
Hey everybody, I made a mistake in the above post:
I accidentally posted the security list's address with the "@" sign
intact (in the quote above I've changed it, but in the original post
it had "@" instead of "{+ AT +}").
The security list is unmoderated, because it needs to be quickly
responsive. Since it gets less spam protection than other lists, we
make an effort not to post its address unprotected. This is all
explained on http://subversion.tigris.org/security.html.
Anyway, I goofed and posted it unprotected. I've already filed an
internal issue to get that post removed from the archives; I just
wanted to follow up here and point out the mistake, so others can
avoid it.
Best,
-Karl
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: [PATCH] Subversion Command-Line Client crashes with long lists of options
Posted by kf...@collab.net.
David James <ja...@gmail.com> writes:
> Right now, if you pass in a really long list of valid arguments into
> the command-line client, you can overflow its buffer of command-line
> options and execute arbitrary code. The impact of this bug is
> mitigated by the fact that users who have access to the command-line
> client can usually already execute arbitrary code.
>
> To see this bug in action, type the following command:
> yes --old | head -n 300 | xargs svn
>
> Before the patch:
> james@syntax% yes --old | head -n 300 | xargs svn
> xargs: svn: terminated by signal 11
>
> After the patch:
> james@syntax% yes --old | head -n 300 | xargs subversion/clients/cmdline/svn
> svn: Too many options
>
> clients/cmdline/main.c
Nice catch! I see that Max committed r15251 to fix.
Hint for next time: please mail security@subversion.tigris.org first
if you suspect something might be a security hole. That way it can be
evaluated privately before the public becomes aware of it.
Thanks,
-Karl
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: [PATCH] Subversion Command-Line Client crashes with long lists of options
Posted by Max Bowsher <ma...@ukf.net>.
David James wrote:
>> Right now, if you pass in a really long list of valid arguments into
>> the command-line client, you can overflow its buffer of command-line
>> options and execute arbitrary code. The impact of this bug is
>> mitigated by the fact that users who have access to the command-line
>> client can usually already execute arbitrary code.
>>
>> To see this bug in action, type the following command:
>> yes --old | head -n 300 | xargs svn
>>
>> Before the patch:
>> james@syntax% yes --old | head -n 300 | xargs svn
>> xargs: svn: terminated by signal 11
>>
>> After the patch:
>> james@syntax% yes --old | head -n 300 | xargs
>> subversion/clients/cmdline/svn svn: Too many options
>>
>> clients/cmdline/main.c
>> (main): Prevent buffer overflow when list of command-line options is very
>> long
Thanks for the report.
Branko Čibej wrote:
> Actually, the use of a statically-sized array to hold options is wrong
> in the first place. I'd prefer a fix that changes the type of
> received_opts.
Yes, an apr array should handle this just fine.
Fixed in r15251, and proposed for backport.
Max.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org
Re: [PATCH] Subversion Command-Line Client crashes with long lists
of options
Posted by Branko Čibej <br...@xbc.nu>.
David James wrote:
>Right now, if you pass in a really long list of valid arguments into
>the command-line client, you can overflow its buffer of command-line
>options and execute arbitrary code. The impact of this bug is
>mitigated by the fact that users who have access to the command-line
>client can usually already execute arbitrary code.
>
>To see this bug in action, type the following command:
> yes --old | head -n 300 | xargs svn
>
>Before the patch:
> james@syntax% yes --old | head -n 300 | xargs svn
> xargs: svn: terminated by signal 11
>
>After the patch:
> james@syntax% yes --old | head -n 300 | xargs subversion/clients/cmdline/svn
> svn: Too many options
>
>clients/cmdline/main.c
>(main): Prevent buffer overflow when list of command-line options is very long
>
>Cheers,
>
>David
>
>
>------------------------------------------------------------------------
>
>Index: subversion/clients/cmdline/main.c
>===================================================================
>--- subversion/clients/cmdline/main.c (revision 15136)
>+++ subversion/clients/cmdline/main.c (working copy)
>@@ -879,6 +879,12 @@
> svn_pool_destroy (pool);
> return EXIT_FAILURE;
> }
>+ else if (num_opts >= SVN_OPT_MAX_OPTIONS)
>+ {
>+ err = svn_error_create (SVN_ERR_CL_ARG_PARSING_ERROR, NULL,
>+ _("Too many options"));
>+ return error_exit (err, stderr, FALSE, pool);
>+ }
>
> /* Stash the option code in an array before parsing it. */
> received_opts[num_opts] = opt_id;
>
>
Actually, the use of a statically-sized array to hold options is wrong
in the first place. I'd prefer a fix that changes the type of received_opts.
-- Brane
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org