bugs.txt

#
# [file:#lines]
# desc
#

[zookd.c:1612]
description goes here. for example, the 'buf' variable can be
overwritten by the 'msg' variable because ...

    <paste offending line(s) of code here>

[http.c:1512]
another description.

    <paste offending line(s) of code here>

# many more come here
[http.c:165]
The 'envvar' variable can be overwritten by function 'sprintf' because
'sprintf' is unsafe. 'envvar' is only 512 bytes, but the 'buf' is 8192
bytes.
    static char buf[8192];      /* static variables are not on the stack */
    char envvar[512];
    ....
    ....
    sprintf(envvar, "HTTP_%s", buf);
See exploit code 'exploit-1a.py'.
[http.c:255]
The 'pn' variable can be overwritten by function 'strcat'('name' variable) because
'strcat' is unsafe. and 'pn' is only 1024 bytes, but 'name' variable
can be larger than 1024 bytes.(See 'zookfs:.c:40')

void http_serve(int fd, const char *name)
    ...
    char pn[1024];
    strcat(pn, name);
    ...

'zookfs.c:40'
http_serve(sockfd, getenv("REQUEST_URI"));

See exploit code 'exploit-2b.py'.
[http.c:317]
The 'dst' variable can be overwritten by function 'strcpy'('dirname'
variable) beacuse 'strcpy' is unsafe. In function
'http_serve_directory' will call 'dir_join', 'dst' variable is only
1024 bytes, but the 'dirname' can be larger.

void dir_join(char *dst, const char *dirname, const char *filename) {
    ...
    strcpy(dst, dirname);
    ...

'http.c:331,333'
void http_serve_directory(int fd, const char *pn) {
...
char name[1024];
dir_join(name, pn, indices[i]);
...
dir_join(name, getenv("SCRIPT_NAME"), indices[i]);
...

See exploit code 'exploit-1b.py'.
[http.c:320]
The 'dst' variable can be overwritten by function 'strcat'('filename'
variable) beacuse 'strcat' is unsafe. In function
'http_serve_directory' will call 'dir_join', 'dst' variable is only
1024 bytes, though 'filename' is  among {"index.html", "index.php",
"index.cgi", NULL}", but after 'strcpy(dst, dirname)' the 'dst' can be
close to 1024 bytes, and then 'dist' will be out of bound after
calling 'strcat(dst, filename)'.

void dir_join(char *dst, const char *dirname, const char *filename) {
    strcpy(dst, dirname);
        ...
    strcat(dst, filename);

'http.c:331,333'
void http_serve_directory(int fd, const char *pn) {
...
char name[1024];
dir_join(name, pn, indices[i]);
...
dir_join(name, getenv("SCRIPT_NAME"), indices[i]);
...
See exploit code 'exploit1c.py'.
[http.c:421]
In function 'url_decode', the 'dst' variable can be overwritten by
'src' variable because 'dst' can be smaller than 'src' when other
places call 'url_decode'. For example, 'reqpath' variable is only 2048 bytes,
and 'value' variable is only 512 bytes, both 'sp1' and 'sp' variable
can be larger than that.

void url_decode(char *dst, const char *src)
        ...
        *dst = strtol(&hexbuf[0], 0, 16);
        ...
        dst++;
        ...

const char *http_request_line(int fd, char *reqpath, char *env, size_t *env_len)
    ...
    url_decode(reqpath, sp1);
    ...

const char *http_request_headers(int fd)
    ...
    char value[512];
    ...
    url_decode(value, sp);
    ...

'zookd.c':
static void process_client(int fd)
    ...
    char reqpath[2048];
    ...
    if ((errmsg = http_request_line(fd, reqpath, env, &env_len)))
    ...

See exploit code 'exploit-2a.py'


Stack canaries, named for their analogy to a canary in a coal mine,
are used to detect a stack buffer overflow before execution of
malicious code can occur. This method works by placing a small
integer, the value of which is randomly chosen at program start, in
memory just before the stack return pointer.

This technique can greatly increase the difficulty of exploiting a
stack buffer overflow. But it still cannot prevent the vulnerability.

And if we only use buffer overflows to corrupt the local variable in
stack. According to the 'Stack canaries' definition(the 'canaries' is
placed in memory before the stack return address), it won't help.

In sum, stack canaries is not enough but can increase the difficulty.