policyd.h defines:
char buf[MAXFDS][MAXLINE];
policyd.c calls:
rres = w_read(sockfd,buf[sockfd]);
in sockets.c, w_read begins with:
ssize_t
w_read(unsigned int fd, char *ptr)
{
ssize_t n;
size_t data_read = 0; /* for
debug only */
/* receive data. disable signals are do not wait */
while ((n = recv(fd, (void *) ptr + buf_counter[fd], 1, MSG_DONTWAIT |
MSG_NOSIGNAL)) == 1)
...
unfortunately the while() loop can go further than the allocated size of
*ptr. (by entering overly long SMTP commands, >1024 bytes).
This loop needs to be changed like this, for example:
ssize_t w_read(unsigned int fd, char *ptr, unsigned int w_size)
while(( n = (....)) && buf_counter[fd] < w_size ){...}
you also may want to properly set buf[sockfd][MAXSIZE-1] = '\n'; , that
can't hurt.
with a lot of connections, buf_counter[MAXFDS-1][] will be overflowed
and the next variables that reside in .bss will be overwritten. This can
potentialy be used to overwrite random stuff in the heap, and maybe
terminate the daemon or remotely execute arbitrary code.
