Bug 311276 (MONO27691) - Possible buffer overflow in runtime io-layer/handles.c (occurs with FreeBSD 4.5)
Summary: Possible buffer overflow in runtime io-layer/handles.c (occurs with FreeBSD 4.5)
Status: RESOLVED FIXED
Alias: MONO27691
Product: Mono: Runtime
Classification: Mono
Component: misc (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Mono Bugs
QA Contact: Mono Bugs
URL:
Whiteboard:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2002-07-12 04:36 UTC by Jonathan Gilbert
Modified: 2007-09-15 21:24 UTC (History)
0 users

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Thomas Wiest 2007-09-15 17:58:50 UTC


---- Reported by logic@phayze.com 2002-07-11 21:36:30 MST ----

NB: Bug report was not filed from the machine upon which the error 
occurred, so User-Agent fields (MSIE 6.0, .NET CLR v1.0.3705) do not 
contain accurate values.

Description of Problem:
mint crashes on at least one FreeBSD 4.5 system due to conflict between 
what the source code expects the size of the .sun_path field of 
sockaddr_un to be and what the actual size is. Source code has hardwired 
size of 108; FreeBSD 4.5's structure contains only 104 bytes. This causes 
a memcpy() at handles.c:109 to overwrite the caller's local variables.

Steps to reproduce the problem:
1. Install mono on FreeBSD 4.5
2. Compine
3. Run mint on a valid executable

Actual Results:
mint coredumps

Expected Results:
mint runs the binary

How often does this happen? 
always

Additional Information:

Line 109 of io-layer/handles.c: the size of the memcpy should be sizeof
(shared_socket_address.sun_path) instead of hardcoded to 108. On my 
FreeBSD 4.5 system, the first arg's size is 104, and the memcpy overwrites 
local variables in the caller's context. I changed it to the sizeof() on 
my local copy and recompiled, and mint worked properly.



---- Additional Comments From miguel@ximian.com 2002-07-11 21:48:47 MST ----

Bug fixed on CVS


Unknown bug field "cf_op_sys_details" encountered while moving bug
   <cf_op_sys_details>FreeBSD 4.5</cf_op_sys_details>
Unknown bug field "cf_version_details" encountered while moving bug
   <cf_version_details>0.12.0 July 10 snapshot</cf_version_details>
Unknown operating system other. Setting to default OS "Other".
Skipping unknown keyword: portability.