d92ac2d1b4
The function `startrpc()` stack allocates a local buffer of size 100:
```c
static Muxrpc*
startrpc(int type)
{
uchar buf[100];
^^^^^^^^
Wsysmsg w;
w.type = type;
convW2M(&w, buf, sizeof buf);
return muxrpcstart(display->mux, buf);
}
```
The function `convW2M()` is called passing `buf`. That function accesses
`buf` out-of-bounds:
```c
uint
convW2M(Wsysmsg *m, uchar *p, uint n)
{
...
case Tcursor2:
PUT(p+6, m->cursor.offset.x);
PUT(p+10, m->cursor.offset.y);
memmove(p+14, m->cursor.clr, sizeof m->cursor.clr);
memmove(p+46, m->cursor.set, sizeof m->cursor.set);
PUT(p+78, m->cursor2.offset.x);
PUT(p+82, m->cursor2.offset.y);
memmove(p+86, m->cursor2.clr, sizeof m->cursor2.clr);
memmove(p+214, m->cursor2.set, sizeof m->cursor2.set);
p[342] = m->arrowcursor;
^^^^^^
```
To fix the issue the size of local variable `buf` is increased from 100
to 512 to avoid out-of-bounds array access.
|
||
|---|---|---|
| acid | ||
| bin | ||
| dict | ||
| dist | ||
| face | ||
| font | ||
| include | ||
| lib | ||
| lp | ||
| mac | ||
| man | ||
| ndb | ||
| news | ||
| plumb | ||
| postscript | ||
| proto | ||
| sky | ||
| src | ||
| tmac | ||
| troff | ||
| unix | ||
| .gitignore | ||
| .travis.yml | ||
| CHANGES | ||
| configure | ||
| CONTRIBUTING.md | ||
| CONTRIBUTORS | ||
| INSTALL | ||
| install.txt | ||
| LICENSE | ||
| Makefile | ||
| rcmain | ||
| README.md | ||
This is a port of many Plan 9 libraries and programs to Unix.
Installation
To install, run ./INSTALL. It builds mk and then uses mk to run the rest of the installation.
For more details, see install(1), at install.txt in this directory and at https://9fans.github.io/plan9port/man/man1/install.html.
Documentation
See https://9fans.github.io/plan9port/man/ for more documentation. (Documentation is also in this tree, but you need to run a successful install first. After that, "9 man 1 intro".)
Intro(1) contains a list of man pages that describe new features or differences from Plan 9.
Helping out
If you'd like to help out, great!
If you port this code to other architectures, please share your changes so others can benefit.
Git
You can use Git to keep your local copy up-to-date as we make changes and fix bugs. See the git(1) man page here ("9 man git") for details on using Git.
Status
Contact
-
Mailing list: https://groups.google.com/group/plan9port-dev
-
Issue tracker: https://github.com/9fans/plan9port/issues
-
Submitting changes: https://github.com/9fans/plan9port/pulls
-
Russ Cox rsc@swtch.com