[Bug 257368] ggate(d) misbehaving

In reply to: bugzilla-noreply_a_freebsd.org: "[Bug 257368] ggate(d) misbehaving"
Go to: [ bottom of page ] [ top of archives ] [ this month ]

From: <bugzilla-noreply_at_freebsd.org>
Date: Sat, 24 Jul 2021 02:06:11 UTC

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=257368

--- Comment #5 from johannes@jo-t.de ---
Truss for ggatec:

debug: Received hdr packet.
write(1,"debug: Received hdr packet.\n",28)      = 28 (0x1c)
recvfrom(4,0x7fffdffddf40,2147467264,MSG_WAITALL,0x0,0x0) ERR#14 'Bad address'
debug: Received data packet.
write(1,"debug: Received data packet.\n",29)     = 29 (0x1d)
error: Lost connection 4.


Notice the bad address!
It's supposed to point to a stack buffer of size 128kB.
But here we are trying to dump 2 GB into it. Oops. Stack buffer overflow.

See near
https://github.com/freebsd/freebsd-src/blob/stable/12/sbin/ggate/ggatec/ggatec.c#L223

-- 
You are receiving this mail because:
You are the assignee for the bug.