Bug 699813 - filenameforall calls bad iodev with insufficent scratch
Summary: filenameforall calls bad iodev with insufficent scratch
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: Security (public) (show other bugs)
Version: unspecified
Hardware: PC Linux
: P4 major
Assignee: Chris Liddell (chrisl)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2018-09-26 22:23 UTC by Tavis Ormandy
Modified: 2019-05-08 13:34 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Tavis Ormandy 2018-09-26 22:23:36 UTC
If you call filenameforall with insufficient scratch space, it tries to call functions in an uninitialized gx_io_device.

$ gdb -q --args ./gs -dSAFER -sDEVICE=ppmraw
Reading symbols from ./gs...done.
(gdb) r
Starting program: gs -dSAFER -sDEVICE=ppmraw
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
GPL Ghostscript GIT PRERELEASE 9.26 (2018-09-13)
Copyright (C) 2018 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
GS>(/proc/*) { == } 0 string filenameforall

Program received signal SIGSEGV, Segmentation fault.
0x0000555555c92d6f in file_cleanup (i_ctx_p=0x55555706bd00) at ./psi/zfile.c:461
461	    iodev->procs.enumerate_close(r_ptr(esp + 5, file_enum));
(gdb) p iodev->procs
$1 = {init = 0x100c5fae2124062, finit = 0x10560d, open_device = 0x42f6000055555703, open_file = 0x4008600060004254, gp_fopen = 0x1278600060006000, fclose = 0x8a7b000000010000, delete_file = 0x42ba000055555709, rename_file = 0x5e860006000e36b, file_status = 0x58c0000000035559, enumerate_files = 0x42f1000055555709, enumerate_next = 0x1278600060006000, enumerate_close = 0x8a72000000010000, get_params = 0x42ba000055555709, put_params = 0xb0060006000e36b}
(gdb) x/i iodev->procs.enumerate_close
   0x8a72000000010000:	Cannot access memory at address 0x8a72000000010000
(gdb) x/i iodev->procs.init
   0x100c5fae2124062:	Cannot access memory at address 0x100c5fae2124062
(gdb) 

etc, etc
Comment 1 Ken Sharp 2018-09-27 09:32:14 UTC
Fixed in commit 9565f4ca4aab712f411420fa4c8cae79a2cf88ed9565f4ca4aab712f411420fa4c8cae79a2cf88ed