Re: glibc glob_filename() recurse call stack overflow (Re[2]: Bash Blues)

From: Vladamir Shmirnov <red_vigil(at)yahoo.com>
Date: Sat Feb 15 2003 - 16:30:04 EST

  I came to the same deliberations, that it is in fact a bug in glibc. In the bash source file lib/glob/glob.c, in functiong glob_filename(), the call to bcopy(3) with an extraordinarily long length of source string causes the crash. However, I may note that although I haven't researched this it seems that it could possibly be a bug caused indirectly by the preceding call to alloca(3).

  If it is a problem with glibc then other programs are vulnerable, including SUID root, correct? Also, if it is a problem with glibc, it is not exploitable from user space, or is it?? Does glibc share the stack with the user process?

• Josh
  • 3APA3A <3APA3A@SECURITY.NNOV.RU> wrote:
    > Dear Roland Postle,
    

    ---

Do you Yahoo!?
Yahoo! Shopping - Send Flowers for Valentine's Day http://shopping.yahoo.com Received on Sat Feb 15 17:20:19 2003