BusyBox Bug and Patch Tracking
BusyBox
  

Viewing Issue Simple Details Jump to Notes ] View Advanced ] Issue History ] Print ]
ID Category Severity Reproducibility Date Submitted Last Update
0004664 [BusyBox] Other minor always 08-19-08 13:19 08-20-08 14:56
Reporter cristic View Status public  
Assigned To BusyBox
Priority normal Resolution fixed  
Status closed   Product Version svn
Summary 0004664: ping6 accesses invalid memory
Description ./ping6 -
accesses invalid memory

First, it calls ping6_main(argc=2, argv={"ping6", "-", 0}):

int ping6_main(int argc, char **argv)
{
    argv[0] = (char*)"-6";
    return ping_main(argc + 1, argv - 1);
}

ping_main then calls getopt32(argv, ...) which illegally dereferences
argv[0], that is, the old argv[-1], on line getopt32.c:347:

346: argc = 0;
347: while (argv[argc])
348: argc++;

Thanks,
Cristian
Additional Information
Attached Files

- Relationships

- Notes
(0010534)
bernhardf
08-20-08 01:05

This was fixed by vda by not looking at argv[0] in getopt32, isn't it?
 
(0010564)
vda
08-20-08 14:56

fixed in svn, thanks
 

- Issue History
Date Modified Username Field Change
08-19-08 13:19 cristic New Issue
08-19-08 13:19 cristic Status new => assigned
08-19-08 13:19 cristic Assigned To  => BusyBox
08-20-08 01:05 bernhardf Note Added: 0010534
08-20-08 14:56 vda Status assigned => closed
08-20-08 14:56 vda Note Added: 0010564
08-20-08 14:56 vda Resolution open => fixed
08-20-08 14:56 vda Fixed in Version  => svn


Copyright © 2000 - 2006 Mantis Group
Powered by Mantis Bugtracker