Undefined behavior in decode_select

Fri May 23 00:11:54 UTC 2014

Hi,

strace will behave in an undefined way (crash under current glibc), if the
fd argument to FD_ISSET() macro is >= FD_SETSIZE.

I guess, the code needs to check (in decode_select) that nfd (first
select's arg) is < FD_SETSIZE.

 $ cat a.c
#include <sys/select.h>
int main(void) {
  fd_set set;
  select(1200, &set, 0, 0, 0);
  return 0;
}
$ make a
cc     a.c   -o a
$ gdb ./strace
(gdb) r ~/a
*** buffer overflow detected ***: /home/jagger/Downloads/strace-4.8/strace
terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x741cf)[0x7ffff7a881cf]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7ffff7b1fb2c]
/lib/x86_64-linux-gnu/libc.so.6(+0x10a9f0)[0x7ffff7b1e9f0]
/lib/x86_64-linux-gnu/libc.so.6(+0x10ba77)[0x7ffff7b1fa77]
/home/jagger/Downloads/strace-4.8/strace[0x403ad2]
/home/jagger/Downloads/strace-4.8/strace[0x415d68]
/home/jagger/Downloads/strace-4.8/strace[0x414170]
/home/jagger/Downloads/strace-4.8/strace[0x40235f]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7ffff7a35ec5]
/home/jagger/Downloads/strace-4.8/strace[0x402434]
======= Memory map: ========
00400000-00469000 r-xp 00000000 fc:00 1192039
 /home/jagger/Downloads/strace-4.8/strace
00668000-00669000 r--p 00068000 fc:00 1192039
 /home/jagger/Downloads/strace-4.8/strace
00669000-0066a000 rw-p 00069000 fc:00 1192039
 /home/jagger/Downloads/strace-4.8/strace
0066a000-0068c000 rw-p 00000000 00:00 0
 [heap]
7ffff77fe000-7ffff7814000 r-xp 00000000 fc:00 926244
/lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7814000-7ffff7a13000 ---p 00016000 fc:00 926244
/lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a13000-7ffff7a14000 rw-p 00015000 fc:00 926244
/lib/x86_64-linux-gnu/libgcc_s.so.1
7ffff7a14000-7ffff7bd0000 r-xp 00000000 fc:00 917872
/lib/x86_64-linux-gnu/libc-2.19.so
7ffff7bd0000-7ffff7dcf000 ---p 001bc000 fc:00 917872
/lib/x86_64-linux-gnu/libc-2.19.so
7ffff7dcf000-7ffff7dd3000 r--p 001bb000 fc:00 917872
/lib/x86_64-linux-gnu/libc-2.19.so
7ffff7dd3000-7ffff7dd5000 rw-p 001bf000 fc:00 917872
/lib/x86_64-linux-gnu/libc-2.19.so
7ffff7dd5000-7ffff7dda000 rw-p 00000000 00:00 0
7ffff7dda000-7ffff7dfd000 r-xp 00000000 fc:00 917871
/lib/x86_64-linux-gnu/ld-2.19.so
7ffff7fd3000-7ffff7fd6000 rw-p 00000000 00:00 0
7ffff7ff7000-7ffff7ffa000 rw-p 00000000 00:00 0
7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0
 [vdso]
7ffff7ffc000-7ffff7ffd000 r--p 00022000 fc:00 917871
/lib/x86_64-linux-gnu/ld-2.19.so
7ffff7ffd000-7ffff7ffe000 rw-p 00023000 fc:00 917871
/lib/x86_64-linux-gnu/ld-2.19.so
7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0
7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0
 [stack]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0
 [vsyscall]
select(1200, [1 2 3 5 9 10 11 14 16 18 19 20 21 25 26 28 29 30 31 65 67 69
72 73 86 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 195 196 199
205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223
224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 259 261 263 264
270 273 277 279 280 281 282 284 285 286 287 288 289 290 291 292 293 294 295
296 297 298 299 300 301 302 326 327 330 332 335 336 337 338 339 340 341 342
343 344 345 346 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362
363 364 365 366 387 390 391 392 397 398 399 400 401 402 403 404 405 406 407
408 409 410 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427
428 429 430 512 576 578 579 581 583 584 586 598 773 774 776 778 790 838 842
854 903 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925
926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942
Program received signal SIGABRT, Aborted.

(gdb) bt
#0  0x00007ffff7a4af79 in __GI_raise (sig=sig at entry=6) at
../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff7a4e388 in __GI_abort () at abort.c:89
#2  0x00007ffff7a881d4 in __libc_message (do_abort=do_abort at entry=2,
fmt=fmt at entry=0x7ffff7b94415 "*** %s ***: %s terminated\n") at
../sysdeps/posix/libc_fatal.c:175
#3  0x00007ffff7b1fb2c in __GI___fortify_fail (msg=<optimized out>,
msg at entry=0x7ffff7b943ac "buffer overflow detected") at fortify_fail.c:37
#4  0x00007ffff7b1e9f0 in __GI___chk_fail () at chk_fail.c:28
#5  0x00007ffff7b1fa77 in __fdelt_chk (d=d at entry=1024) at fdelt_chk.c:25
#6  0x0000000000403ac1 in decode_select (tcp=0x66b030, args=0x66b048,
bitness=BITNESS_CURRENT) at desc.c:519
#7  0x0000000000415d48 in trace_syscall_entering (tcp=0x66b030) at
syscall.c:2039
#8  trace_syscall (tcp=tcp at entry=0x66b030) at syscall.c:2712
#9  0x0000000000414150 in trace () at strace.c:2281
#10 0x000000000040235f in main (argc=<optimized out>, argv=<optimized out>)
at strace.c:2311

(gdb) up 6
#6  0x0000000000403ac1 in decode_select (tcp=0x66b030, args=0x66b048,
bitness=BITNESS_CURRENT) at desc.c:519
519 if (FD_ISSET(j, fds)) {

-- 
Robert Święcki
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.strace.io/pipermail/strace-devel/attachments/20140523/acbf062a/attachment.html>