rt/snapraid
1
0
Fork 0
mirror of https://github.com/amadvance/snapraid.git synced 2026-10-26 10:51:54 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Sanitize addr2line binary path via strspn whitelist before system call

Browse source
This commit is contained in:
Andrea Mazzoleni 2026-07-06 17:57:27 +02:00
parent d6b51d61e7
commit effc3be9c2
1 changed files with 18 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

24
os/unix.c
View file

@ -1605,17 +1605,29 @@ void os_abort(void)
if (messages) {
int ret;
char addr2line[1024];
char path[1024];
size_t j = 0;
while (msg[j] != '(' && msg[j] != ' ' && msg[j] != 0)
++j;
snprintf(addr2line, sizeof(addr2line), "addr2line %p -e %.*s", stack[i], (unsigned)j, msg);
if (j >= sizeof(path))
j = sizeof(path) - 1;
memcpy(path, msg, j);
path[j] = 0;
ret = system(addr2line);
if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0)
printf("exit:%d\n", WEXITSTATUS(ret));
if (WIFSIGNALED(ret))
printf("signal:%d\n", WTERMSIG(ret));
/*
* Verify that the path consists only of safe characters (alphanumeric, slash, dot, dash, underscore).
* This prevents arbitrary command execution via crafted executable names or directories.
*/
if (j > 0 && strspn(path, "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789/.-_") == j) {
snprintf(addr2line, sizeof(addr2line), "addr2line %p -e %s", stack[i], path);
ret = system(addr2line);
if (WIFEXITED(ret) && WEXITSTATUS(ret) != 0)
printf("exit:%d\n", WEXITSTATUS(ret));
if (WIFSIGNALED(ret))
printf("signal:%d\n", WTERMSIG(ret));
}
}
}
#endif