Repository navigation
Conversation
Platform_getProcessEnv() reads /proc/PID/environ in a loop that adds each fread() result to size as it goes. After the loop it added the last result once more, so whenever the environment ended partway through the buffer, the block it returned was too long by that many bytes. EnvScreen then parsed the uninitialised heap memory past the real data as more variables, which shows up as junk entries, often rendered as U+FFFD, on the environment screen. The loop already counts every byte it reads, so the extra addition is simply removed. Found while fuzzing htop's UI with Bombadil.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Priority: ➖ Normal Change: Bug fix Merge Risk: ⚪ Minimal · up to
|
BenBE
added
bug 🐛
|
Superseeded by cb613e6. Thank you for reporting the bug. While looking at the PR I noticed a few other things about this function that I wanted to address while touching this code anyway. |
2 participants
Platform_getProcessEnv() reads /proc/PID/environ in a loop that adds each fread() result to size as it goes. After the loop it added the last result once more, so whenever the environment ended partway through the buffer, the block it returned was too long by that many bytes.
EnvScreen then parsed the uninitialised heap memory past the real data as more variables, which shows up as junk entries, often rendered as U+FFFD, on the environment screen.
The loop already counts every byte it reads, so the extra addition is simply removed.
Found while fuzzing htop's UI with https://github.com/antithesishq/bombadil.