Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

This PECL module is dangerous and incorrect, read here for details #4

Open
sodabrew opened this issue Apr 30, 2013 · 0 comments
Open

Comments

@sodabrew
Copy link

Your approach here is flat out wrong and dangerous. Please read other people's code first to see how to approach this problem safely: https://www.google.com/search?q=setproctitle.c

By convention, the elements of char ** argv and char ** environ point at a contiguous block of memory that is divided up into C-style nul terminated strings. By definition, the pointer char ** environ can be reassigned and subsequent functions such as getenv() will respect the new location.

At program start, you can copy the memory block starting at enrivon[0] and ending at environ[num_envs-1] + strlen(environ[num_envs-1]) + 1 to a new location, and reassign the environ[...] pointers to locations in the new block. You could also strdup() each string.

To find out the number of environment variables:

size_t num_envs = 0;
while (environ[num_envs]) num_envs++;

Or strdup each string:

for (size_t i = 0; environ[i]; i++) {
  environ[i] = strdup(environ[i]);
}

Once you have copied away the contents of environ, you have the entire block of memory starting at argv[0] and ending at the original environ[num_envs-1] + strlen(environ[num_envs-1]) + 1. This is the safe memory space that you can overwrite, and have it picked up by ps, etc.

Finally, do not fill with spaces. Fill with nul bytes. You might have a solid 1K of argv + environ space, and you wouldn't want that many blank spaces in your ps output!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant