Re: glibc glob_filename() recurse call stack overflow (Re[2]: Bash Blues)

From: Roland Postle (mail@blazde.co.uk)
Date: 02/16/03

  • Next message: Ali Saifullah Khan: "Re: glibc glob_filename() recurse call stack overflow (Re[2]: Bash Blues )" 
    From: "Roland Postle" <mail@blazde.co.uk>
To: "vuln-dev@securityfocus.com" <vuln-dev@securityfocus.com>
Date: Sun, 16 Feb 2003 01:54:06 +0000

    I don't think this is a glibc issue. glibc does indeed have a
    glob_filename, but when I checked the other day it had a 'depth'
    parameter that was incremented with each recursion, presumably to
    prevent stack overflows. The one I was reffering to is in
    bash-2.05b\lib\glob\glob.c in the bash source tree which begins:

    /* glob.c -- file-name wildcard pattern matching for Bash.

    [Copyright notice]

    /* To whomever it may concern: I have never seen the code which most
       Unix programs use to perform this function. I wrote this from
    scratch
       based on specifications for the pattern matching. --RMS. */

    Sounds to me like it's unrelated to the glibc one.

    Regarding why it doesn't crash on some BSD systems, maybe they just
    have a bigger stack, or better exception handling.

    I think the reason it sometimes crashes in bcopy / alloca is just
    because it runs out of stack there instead of in the main body of
    glob_filename(). If you look at the call stack it'll be 99%
    glob_filename() calls. For example....

    >eval `perl -e 'print ":;" x 97500'`

    This one is a stack overflow too.

    (gdb) backtrace
    #0 0x080c1d3e in xmbsrtowcs ()
    #1 0x080c21b5 in xmbsrtowcs ()
    #2 0x080c2807 in sh_malloc ()
    #3 0x08094a08 in sh_xmalloc ()
    #4 0x080677ae in new_fd_bitmap ()
    #5 0x080678ff in execute_command ()
    #6 0x08069027 in execute_command_internal ()
    #7 0x08068059 in execute_command_internal ()
    #8 0x08067944 in execute_command ()
    #9 0x08069027 in execute_command_internal ()
    #10 0x08068059 in execute_command_internal ()
    #11 0x08067944 in execute_command ()
    #12 0x08069027 in execute_command_internal ()
    #13 0x08068059 in execute_command_internal ()
    #14 0x08067944 in execute_command ()
    #15 0x08069027 in execute_command_internal ()
    #16 0x08068059 in execute_command_internal ()

    etc....

    Anyway, on the subject of exploiting stack overflows, I'm really only
    familiar with Windows (where they're only exploitable under some
    unlikely extreme conditions). I've been told Linux 2.4 isn't
    exploitable, but 2.2 might be, can anyone confirm or deny? The basic
    strategy is probably to run of the end of the stack into some heap
    memory, and create fake heap control blocks, as you would in a heap
    overflow.

    - Blazde

    Relevant Pages

    • Re: How does managed code work?
      ... Does it work the same way as the native stack with a frame pointer that is the head of a linked list of stack frames where each time we enter a function we create a new stack frame in which new variables are pushed and each time we exit a function the entire stack frame is popped? ... Can someone point me to a discussion of the managed heap? ... How does it prevent memory leaks that occur in COM when two objects reference each other and keep the others reference count nonzero? ... Because objects don't go out of scope, ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: Groovy (war Re: [PROST]Re: CDC Plugin fuer Eclipse)
      ... Warum müsste man continuations erlauben Stackvariablen in den Heap zu verschieben? ... Ein activation record speichert die Parameter und lokalen Variablen der Funktion und eine Information, ... Da diese activation records klassischerweise auf einem Stack verwaltet werden, kann man hier Stackspace sparen - Endrekursion ist damit genauso effizient wie eine klassische Iteration mit einem Sprung. ...
      (de.comp.lang.java)
    • Re: Please Explain where will the struct be stored if it is declared inside the Class
      ... forget about structs for a second. ... can be stored either on the stack, or on the heap. ... First, think about the stack. ... A struct would act exactly the same as any of these decimals and ints. ...
      (microsoft.public.dotnet.languages.csharp)
    • Re: Is MSDN wrong? or I made a mistake? about static member function
      ... the heap" or some such reference. ... shouldn't we have a uniform notation? ... You can tell a heap object from a stack object by ... the result of trying to build a compiler on a tiny computer by someone who wasn't a very ...
      (microsoft.public.vc.mfc)
    • Re: Stack, Heap, Mfc
      ... >> is put on the heap. ... >> decendant does this not mean that all memory will be on the heap because ... > stack or the heap. ... You first try to limit the recursion to an acceptable ...
      (microsoft.public.vc.mfc)