Bugzilla – Bug 311276
Possible buffer overflow in runtime io-layer/handles.c (occurs with FreeBSD 4.5)
Last modified: 2007-09-15 21:24:46 UTC
---- Reported by logic@phayze.com 2002-07-11 21:36:30 MST ---- NB: Bug report was not filed from the machine upon which the error occurred, so User-Agent fields (MSIE 6.0, .NET CLR v1.0.3705) do not contain accurate values. Description of Problem: mint crashes on at least one FreeBSD 4.5 system due to conflict between what the source code expects the size of the .sun_path field of sockaddr_un to be and what the actual size is. Source code has hardwired size of 108; FreeBSD 4.5's structure contains only 104 bytes. This causes a memcpy() at handles.c:109 to overwrite the caller's local variables. Steps to reproduce the problem: 1. Install mono on FreeBSD 4.5 2. Compine 3. Run mint on a valid executable Actual Results: mint coredumps Expected Results: mint runs the binary How often does this happen? always Additional Information: Line 109 of io-layer/handles.c: the size of the memcpy should be sizeof (shared_socket_address.sun_path) instead of hardcoded to 108. On my FreeBSD 4.5 system, the first arg's size is 104, and the memcpy overwrites local variables in the caller's context. I changed it to the sizeof() on my local copy and recompiled, and mint worked properly. ---- Additional Comments From miguel@ximian.com 2002-07-11 21:48:47 MST ---- Bug fixed on CVS Unknown bug field "cf_op_sys_details" encountered while moving bug <cf_op_sys_details>FreeBSD 4.5</cf_op_sys_details> Unknown bug field "cf_version_details" encountered while moving bug <cf_version_details>0.12.0 July 10 snapshot</cf_version_details> Unknown operating system other. Setting to default OS "Other". Skipping unknown keyword: portability.