21 October 2010

cramfs segfault bug

Found in cramfsck.c of project http://cramfs.sourceforge.net/
At version 1.1

Line 355 of cramfsck.c is:

die(FSCK_UNCORRECTED, 0, "decompression error %p(%d): %s",
zError(err), src, len);

Must be:

die(FSCK_UNCORRECTED, 0, "decompression error %p(%d): %s",
src, len, zError(err))

Arbitrary memory dump :)

Update: seems linux kernel not affected by this implementation:

printk("ZLIB Error %d while decompressing!\n", err);
    printk("%p(%d)->%p(%d)\n", src, srclen, dst, dstle

Posted at BinaryCell

No comments:

Post a Comment

Disclaimer: In no event shall the blog owner, be liable for any damages, including without limitation, special, indirect or consequential damages, or any damages, whatsoever resulting from access or use, or inability to access or use this Website or arising out of any materials, information, qualifications or recommendations on this Website.