| Summary: | net-analyzer/cryptcat-20031202 is stable on amd64 | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | postmodern <brodigan> |
| Component: | [OLD] Unspecified | Assignee: | AMD64 Project <amd64> |
| Status: | RESOLVED LATER | ||
| Severity: | enhancement | ||
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | AMD64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
|
Description
postmodern
2006-08-14 10:02:28 UTC
The pointer warnings scare me, and I don't have time to test out the function that's causing them. I'd rather wait for a newer version to be in portage for a while that has been tested more. Since this package is based off of netcat, the newer versions feel a bit more stable. Those pointer warnings are worrisome but I see the logic behind them. They ARE bad programming practices though.
cryptcat-20031202/netcat.c:
192 /* holler :
193 fake varargs -- need to do this way because we wind up calling through
194 more levels of indirection than vanilla varargs can handle, and not all
195 machines have vfprintf/vsyslog/whatever! 6 params oughta be enough. */
196 void holler (str, p1, p2, p3, p4, p5, p6)
197 char * str;
198 char * p1, * p2, * p3, * p4, * p5, * p6;
199 {
200 if (o_verbose) {
201 fprintf (stderr, str, p1, p2, p3, p4, p5, p6);
202 #ifdef HAVE_BIND
203 if (h_errno) { /* if host-lookup variety of error ... */
204 if (h_errno > 4) /* oh no you don't, either */
205 fprintf (stderr, "preposterous h_errno: %d", h_errno);
206 else
207 fprintf (stderr, h_errs[h_errno]); /* handle it here */
208 h_errno = 0; /* and reset for next call */
209 }
210 #endif
211 if (errno) { /* this gives funny-looking messages, but */
212 perror (" "); /* it's more portable than sys_errlist[]... */
213 } else /* xxx: do something better? */
fprintf (stderr, "\n");
215 fflush (stderr);
216 }
217 } /* holler */
218
219 /* bail :
220 error-exit handler, callable from anywhere */
221 void bail (str, p1, p2, p3, p4, p5, p6)
222 char * str;
223 char * p1, * p2, * p3, * p4, * p5, * p6;
224 {
225 o_verbose = 1;
226 holler (str, p1, p2, p3, p4, p5, p6);
227 close (netfd);
228 sleep (1);
229 exit (1);
230 } /* bail */
...
269 /* Hmalloc :
270 malloc up what I want, rounded up to *4, and pre-zeroed. Either succeeds
271 or bails out on its own, so that callers don't have to worry about it. */
272 char * Hmalloc (size)
273 unsigned int size;
274 {
275 unsigned int s = (size + 4) & 0xfffffffc; /* 4GB?! */
276 char * p = malloc (s);
277 if (p != NULL)
278 memset (p, 0, s);
279 else
280 bail ("Hmalloc %d failed", s);
281 return (p);
282 } /* Hmalloc */
That looks like the beginnings of a format-string vuln. Luckily most of the time bail/holler are passed constant format strings, but let's grep to make sure.
$ egrep -Hn "(bail|holler)[[:space:]]*\([^\"\)]" *.c
netcat.c:196:void holler (str, p1, p2, p3, p4, p5, p6)
netcat.c:221:void bail (str, p1, p2, p3, p4, p5, p6)
netcat.c:226: holler (str, p1, p2, p3, p4, p5, p6);
netcat.c:238: bail (wrote_txt, wrote_net, wrote_out);
netcat.c:827: holler (bigbuf_net, z);
netcat.c:1568: holler (wrote_txt, wrote_net, wrote_out);
netcat.c:1655: holler (wrote_txt, wrote_net, wrote_out);
$ grep -Hn wrote_txt *.c
netcat.c:149:static char wrote_txt[] = " sent %d, rcvd %d";
netcat.c:238: bail (wrote_txt, wrote_net, wrote_out);
netcat.c:1568: holler (wrote_txt, wrote_net, wrote_out);
netcat.c:1655: holler (wrote_txt, wrote_net, wrote_out);
These cases are easily fixed as wrote_txt is meant to be a constant string but not declared const (that should be patched imho).
$ grep -Hn bigbuf_net *.c
netcat.c:160:char * bigbuf_net;
netcat.c:806:/* Various things that follow temporarily trash bigbuf_net, which might contain
netcat.c:820: strcpy (bigbuf_net, "listening on ["); /* buffer reuse... */
netcat.c:822: strcat (bigbuf_net, inet_ntoa (lclend->sin_addr));
netcat.c:824: strcat (bigbuf_net, "any");
netcat.c:825: strcat (bigbuf_net, "] %d ...");
netcat.c:827: holler (bigbuf_net, z);
netcat.c:840: (nnetfd, bigbuf_net, BIGSIZ, MSG_PEEK, (SA *) remend, &x);
netcat.c:841:Debug (("dolisten/recvfrom ding, rr = %d, netbuf %s ", rr, bigbuf_net))
netcat.c:891: char * p = bigbuf_net; /* local variables, yuk! */
netcat.c:892: char * pp = &bigbuf_net[128]; /* get random space farther out... */
netcat.c:893: memset (bigbuf_net, 0, 256); /* clear it all first */
netcat.c:900: holler ("IP options: %s", bigbuf_net);
netcat.c:909: memset (bigbuf_net, 0, 64);
netcat.c:910: cp = &bigbuf_net[32];
netcat.c:927: strcpy (bigbuf_net, inet_ntoa (remend->sin_addr));
netcat.c:928: whozis = gethostpoop (bigbuf_net, o_nflag);
netcat.c:1205: /*rr = read (fd, bigbuf_net, BIGSIZ);*/
netcat.c:1206: rr = farm9crypt_read (fd, bigbuf_net, BIGSIZ);
netcat.c:1212: np = bigbuf_net;
netcat.c:1350: bigbuf_net = Hmalloc (BIGSIZ);
bigbuf_net is a little more involved, but if you check the code the only time variable data is copied into it is on line 1206, after that i don't see it being passed back to bail/holler without being reset. In conclusion I'd say those warnings are the legacy of netcat's horribly messy code-base. People should move onto other network clients, such as ncat or *shameless self promotion* my own upcoming incat, but if they must netcat is still usable.
|
