Opened 15 years ago

Closed 14 years ago

Last modified 12 months ago

#1908 closed defect (fixed)

BASE: buffer overflow causes crash from env-var HOME

Reported by: SF/toreanderson Owned by: fingolfin
Priority: low Component: Port: Linux
Keywords: Cc:
Game:

Description

This is from Ulf Härnhammar in
<http://bugs.debian.org/292263/>. I guess ScummVM is
never installed as a setuid binary? It isn't on Debian
anyway, so priority set as low.

....

Hello,

if I start scummvm with a long value for the
environment variable HOME, the
program crashes.

metaur@metaur:~$ HOME=`perl -e 'print "U" x 1030;'`
/usr/games/scummvm
WARNING: Unable to open configuration file:
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU
UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU/.scummvmr
c!
Segmentation fault
metaur@metaur:~$

Ticket imported from: #1109687. Ticket imported from: bugs/1908.

Change History (16)

comment:1 by SF/toreanderson, 15 years ago

Priority: normallow

comment:2 by sev-, 15 years ago

Fixed in CVS. And no, ScummVM does not require root privilidges.

comment:3 by sev-, 15 years ago

Owner: set to sev-
Resolution: fixed
Status: newclosed

comment:4 by SF/ender, 15 years ago

As a note, you'd have to be crazy to install scummvm setuid. I
couldn't count the number of places a exploited savegame
could break out :)

comment:5 by SF/toreanderson, 15 years ago

I hope you don't believe I seriously doubted the correctness
of installing ScummVM non-setuid on a unix/linux-lookalike
such as Debian! :-)

Was thinking more of these funny architectures I have no
idea how works, such as iPac, Dreamcast, Microsoft, Morphos,
and so on.

Thanks for fixing it so rapidly!

Tore

comment:6 by SF/toreanderson, 14 years ago

Status: closednew

comment:7 by SF/toreanderson, 14 years ago

Hi,

It seems to me this bug is still present in 0.8.0. At least
I can reproduce it using the method suggested by the
submitter. Hence, I'm reopening this bug.

Tore

comment:8 by fingolfin, 14 years ago

Indeed, only main.cpp was fixed, but not config-manager.cpp.
I fixed that one, too. Furthermore, SCUMMVM_SAVEPATH is also
read from env. While an overflow there should be harmless, I
still added a check there, too... Will be included in the
next release.

comment:9 by fingolfin, 14 years ago

Owner: changed from sev- to fingolfin

comment:10 by fingolfin, 14 years ago

Status: newclosed

comment:11 by SF/weine, 14 years ago

I can still make scummvm segfault this way, even with a
checkout from svn made today. The limit seem to be 512
characters, FVIW; anything higher than that causes scummvm
to segfault.

comment:12 by fingolfin, 14 years ago

Argh, stupid bug, in fopenNoCase. I'll look into it.

comment:13 by fingolfin, 14 years ago

Status: closednew
Summary: buffer overflow causes crash from env-var HOMEBASE: buffer overflow causes crash from env-var HOME

comment:14 by fingolfin, 14 years ago

Status: newclosed

comment:15 by fingolfin, 14 years ago

The bug in fopenNoCase should be fixed now, at least I really can't reproduce
the issue anymore :)

comment:16 by digitall, 12 months ago

Component: Port: Linux
Note: See TracTickets for help on using tickets.