TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Heap Overflow in Floating Point Parsing (CVE-2013-4164)

59 pointsby willlllover 11 years ago

5 comments

comexover 11 years ago
In case you&#x27;re curious about exploitability for code execution... the bug is that this array (Kmax = 16):<p><pre><code> static Bigint *freelist[Kmax+1]; </code></pre> which is indexed by the log2 of the size of the bigint, is not checked:<p><pre><code> static Bigint * Balloc(int k) { [...] if ((rv = freelist[k]) != 0) { freelist[k] = rv-&gt;next; } </code></pre> If it&#x27;s 0, then the allocation is done safely.<p>Where does Balloc get called? First with an estimate of the size required for the whole thing, from two locations, then with steadily increasing values starting from 1, from the mult function. With the first allocation we can theoretically perform a complicated operation (a good thing when ASLR is involved) to any location in ruby&#x27;s bss section after freelist, but every increase requires doubling the size of the input string, and 16 already requires a 300k string, so going more than a few notches forward is impractical. With the second, I think k=16 is guaranteed to get a hit, because the next variable after freelist in the code is:<p><pre><code> static Bigint *p5s; </code></pre> On my system, and probably on all, this duly shows up immediately afterwards in the binary, and p5s is set before the allocation, so it&#x27;s not null. The code ends up &quot;allocating&quot; p5s and copying 64k of arbitrary data into p5s-&gt;x, which comes from the &#x27;private_mem&#x27; static array, also in the bss section. Although this is certainly dangerous, on the 3 systems I tried (OS X, 64-bit Linux, 32-bit Linux), there was much less than 64k of memory in the segment after the array and something read-only immediately followed, so it was guaranteed to crash before anything interesting could happen. It could be possible to exploit anyway if another C thread were accessing the data (not sure if mri ever does this), but the timing would be extremely difficult.<p>So I suspect that on most systems, this is purely a DOS, even though it involves an overwrite of arbitrary data. However, I could definitely be missing something, as the code is fairly complicated.
c3over 11 years ago
It seems to be a fairly simple patch for 1.8 series, too:<p><pre><code> https:&#x2F;&#x2F;bugs.ruby-lang.org&#x2F;projects&#x2F;ruby-193&#x2F;repository&#x2F;revisions&#x2F;43776 </code></pre> just a few lines truncating input in util.c.<p>Break your ruby here:<p><pre><code> JSON.parse(&quot;[1.&quot;+&quot;1&quot;*300000+&quot;]&quot;)</code></pre>
评论 #6779822 未加载
asdfaoeuover 11 years ago
Strikes me as a bit silly not to patch this in 1.8 considering it&#x27;s still fairly widely used and even the default for Ubuntu 12.04 LTS.
评论 #6779658 未加载
评论 #6784018 未加载
Someoneover 11 years ago
So, why does ruby has its own version of strtod? From the comment in <a href="https://bugs.ruby-lang.org/projects/ruby-193/repository/revisions/43776/entry/util.c" rel="nofollow">https:&#x2F;&#x2F;bugs.ruby-lang.org&#x2F;projects&#x2F;ruby-193&#x2F;repository&#x2F;revi...</a> (<i>&quot;strtod for IEEE-, VAX-, and IBM-arithmetic machines.&quot;</i>) it does not appear to be for machines that don&#x27;t have it in their C library.<p>Is it because of the incompatibility between C90 and C99 described in <a href="http://www.lehman.cuny.edu/cgi-bin/man-cgi?strtod+3" rel="nofollow">http:&#x2F;&#x2F;www.lehman.cuny.edu&#x2F;cgi-bin&#x2F;man-cgi?strtod+3</a>, or don&#x27;t they trust strtod to return the same results on each system? If so, where does not trusting one&#x27;s environment end?
ssaunier_over 11 years ago
If you want to check your Heroku apps:<p><a href="https://gist.github.com/ssaunier/7612827/" rel="nofollow">https:&#x2F;&#x2F;gist.github.com&#x2F;ssaunier&#x2F;7612827&#x2F;</a>