0004664: ping6 accesses invalid memory - BusyBox Bug and Patch Tracking

BusyBox Bug and Patch Tracking

Viewing Issue Simple Details [ Jump to Notes ]

[ View Advanced ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0004664

[BusyBox] Other

minor

always

08-19-08 13:19

08-20-08 14:56

Reporter

cristic

View Status

public

Assigned To

BusyBox

Priority

normal

Resolution

fixed

Status

closed

Product Version

svn

Summary

0004664: ping6 accesses invalid memory

Description

./ping6 -
accesses invalid memory

First, it calls ping6_main(argc=2, argv={"ping6", "-", 0}):

int ping6_main(int argc, char **argv)
{
argv[0] = (char*)"-6";
return ping_main(argc + 1, argv - 1);
}

ping_main then calls getopt32(argv, ...) which illegally dereferences
argv[0], that is, the old argv[-1], on line getopt32.c:347:

346: argc = 0;
347: while (argv[argc])
348: argc++;

Thanks,
Cristian

Additional Information

Attached Files

Relationships

Notes
(0010534) bernhardf 08-20-08 01:05	This was fixed by vda by not looking at argv[0] in getopt32, isn't it?

(0010564) vda 08-20-08 14:56	fixed in svn, thanks

Issue History
Date Modified	Username	Field	Change
08-19-08 13:19	cristic	New Issue
08-19-08 13:19	cristic	Status	new => assigned
08-19-08 13:19	cristic	Assigned To	=> BusyBox
08-20-08 01:05	bernhardf	Note Added: 0010534
08-20-08 14:56	vda	Status	assigned => closed
08-20-08 14:56	vda	Note Added: 0010564
08-20-08 14:56	vda	Resolution	open => fixed
08-20-08 14:56	vda	Fixed in Version	=> svn