Bug 15949 - First. sending invalid pointer to 'struct tm' to strftime causes crash. Second, DoS because of stack exhaustion in glibc regcomp which occurs because of unverified pattern being sent.
Summary: First. sending invalid pointer to 'struct tm' to strftime causes crash. Seco...
Status: NEW
Alias: None
Product: Busybox
Classification: Unclassified
Component: Other (show other bugs)
Version: 1.36.x
Hardware: All Linux
: P5 normal
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-17 03:54 UTC by Asmita
Modified: 2024-02-17 03:57 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:

Attachments
contains crash patterns, and the screenshot of gdb output (42 bytes, application/octet-stream)
2024-02-17 03:56 UTC, Asmita 		Details
crash_pattern_strftime (42 bytes, application/octet-stream)
2024-02-17 03:56 UTC, Asmita 		Details
crash pattern regcomp (11.93 KB, application/octet-stream)
2024-02-17 03:57 UTC, Asmita 		Details
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Asmita 2024-02-17 03:54:03 UTC 
This was identified while testing awk applet of BusyBox v1.36.1.

1. There is no error handling when 'awk' applet receives a command with wrong pattern like 'BEGIN{strftime("", "3333333333333333333")}', where the 'struct tm' is NULL, and format specifier is not correct, and overall arg passed to strftime is not correct. It leads to segmentation fault. 

2. The pattern being passed to regcomp() is not being verified. As pattern like : '/1((((((..12208 times/1' in regcomp() causes denial of service (DoS) by stack exhaustion. Triggers deep recursion that causes stack exhaustion.

The crash pattern and corresponding segfault screenshot are attached.
Comment 1 Asmita 2024-02-17 03:56:11 UTC 
Created attachment 9706 [details]
contains crash patterns, and the screenshot of gdb output
Comment 2 Asmita 2024-02-17 03:56:36 UTC 
Created attachment 9709 [details]
crash_pattern_strftime
Comment 3 Asmita 2024-02-17 03:57:36 UTC 
Created attachment 9712 [details]
crash pattern regcomp