[mapserver-dev] Buffer overflow in msOWSParseRequestMetadata
thomas.bonfort at gmail.com
Tue Jul 17 03:50:46 PDT 2012
PS: can you open an issue for this ?
On Tue, Jul 17, 2012 at 12:49 PM, thomas bonfort
<thomas.bonfort at gmail.com> wrote:
> On Tue, Jul 17, 2012 at 12:29 PM, Fabian Schindler
> <fabian.schindler at eox.at> wrote:
>> Hey folks,
>> While setting up our software (EOxServer) in the OSGeoLive virtual machine
>> we stumbled into a bug that only seems to show on 32 bit environments (such
>> as the OSGeoLive VM). We spotted the bug in the version 6.0.3 but also
>> version 6.0.1 and 6.2.0-beta1 seem to be affected.
>> The result is a stack smashing/buffer overflow as shown in this backtrace
>> The minimal mapfile used to reproduce the bug can be found here .
>> The problem is a buffer overflow occurring in `msOWSParseRequestMetadata'
>> when it is called with arguments that obviously don't fit into the `char
>> requestBuffer;' (i.e: are larger than 32 bytes). This is the case when
>> the layer setting "wms_enable_request" is set to
>> Extending the `requestBuffer' to 64 or 128 bytes (as done in the path
>> contained in the attachment) solves this particular issue, but seems a bit
>> clumsy as it is still possible to run into the said bug. Maybe someone more
>> into the issue may have a look at this?
>> I think that this is a rather urgent issue, also for us, as we want to be
>> part of the next OSGeoLive distribution.
>> I'd like to know if this the bugfix will be enough for a 6.0.4 release and
>> whenthis release will be available?
> Augmenting the buffer size isn't an appropriate fix imho. We can have
> two different fixes:
> - char requestBuffer = msSmallMalloc(strlen(metadata)+1); instead of
> char requestBuffer; This has the inconvenience of calling a
> - The code there seems quite complicated, and if I understand
> correctly what it's trying to do can be replaced with some calls to
> strcasestr. As Alan is absent this week, I'd be willing to implement
> and apply a patch provided you can help validate it doesn't have
> side-effects I did not foresee?
> As for 6.0.4 there are no immediate plans I think. Can you package
> 6.0.3 + a patch for the liveDVD?
>>  http://pastebin.com/Xp15Pkwd
>>  http://pastebin.com/pTvyS4q6
>> mapserver-dev mailing list
>> mapserver-dev at lists.osgeo.org
More information about the mapserver-dev