buffer overflow parsing if_inet6

[Claudio Bley]

Hi.

The contents of /proc/net/if_inet6:

fe80000000000000022590fffe1a48e5 05 40 20 80 eth3
fe80000000000000fc9b86fffe01d5d7 86 40 20 80 veth4pXXGI
fe80000000000000fc163efffe629ca3 155 40 20 80 vnet3
fe80000000000000fc163efffefc3b5f 158 40 20 80 vnet6
fe80000000000000fc163efffe49ac43 154 40 20 80 vnet2
fe80000000000000fc163efffe8fb8ba 157 40 20 80 vnet5
fe80000000000000fc163efffeaeaa2a 152 40 20 80 vnet0
fe80000000000000fc163efffe53e706 156 40 20 80 vnet4
fe80000000000000fc163efffed50b59 153 40 20 80 vnet1
fe80000000000000022590fffe1a48e6 02 40 20 80 eth0
00000000000000000000000000000001 01 80 10 80 lo

Starting my application results in:

*** buffer overflow detected ***: /home/user/build/openjdk-7-7~b147-2.0/build/openjdk.build/bin/java terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7ffff79284f7]
/lib/x86_64-linux-gnu/libc.so.6(+0xf9410)[0x7ffff7927410]
/home/user/build/openjdk-7-7~b147-2.0/build/openjdk.build/lib/amd64/libnet.so(+0x578d)[0x7fffe7dee78d]
/home/user/build/openjdk-7-7~b147-2.0/build/openjdk.build/lib/amd64/libnet.so(+0x5ff5)[0x7fffe7deeff5]
/home/user/build/openjdk-7-7~b147-2.0/build/openjdk.build/lib/amd64/libnet.so(Java_java_net_NetworkInterface_getAll+0x1c)[0x7fffe7def77c]

Backtrace:

#0 0x00007ffff78643a5 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00007ffff7867b0b in __GI_abort () at abort.c:92
#2 0x00007ffff789dd63 in __libc_message (do_abort=2, fmt=0x7ffff798d39e "*** %s ***: %s terminated\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00007ffff79284f7 in __GI___fortify_fail (msg=0x7ffff798d335 "buffer overflow detected") at fortify_fail.c:32
#4 0x00007ffff7927410 in __GI___chk_fail () at chk_fail.c:29
#5 0x00007fffe7dee78d in strcpy (__src=<optimized out>, __dest=0x7fffe4cbc060 "fc163efffefa2220") at /usr/include/x86_64-linux-gnu/bits/string3.h:105
#6 addif (env=0xb329d0, sock=57, if_name=<optimized out>, ifs=0x8f24a0, ifr_addrP=<optimized out>, family=10, prefix=0)
    at ../../../src/solaris/native/java/net/NetworkInterface.c:841
#7 0x00007fffe7deeff5 in enumIPv6Interfaces (ifs=0x8f24a0, sock=57, env=0xb329d0) at ../../../src/solaris/native/java/net/NetworkInterface.c:1125

These are the values of devname the while loop at NetworkInterface.c:1108 sees (compare to the device names above!):

dev: eth3
dev: veth4pXXGI
dev: 80
dev: 158
dev: 3efffe49ac43
dev: fc163efffefa2220
dev: fc163efffe8fb8ba
dev: fc163efffeaeaa2a
dev: fc163efffe53e706
dev: fc163efffed50b59
dev: 022590fffe1a48e6
dev: 000000000001
dev: 000000000001

The parsing is too restrictive. Who said the netlink device number is only ever 2 hex digits wide? Same goes probably for the other hex values, I don't know. Should be safe making no assumption about their maximum width.

Furthermore, the parsing is error prone, it doesn't stop if a line couldn't be read completely, i.e. it cannot detect whether a line has been read completely.

The attached patch fixes the apparent problem.

Btw, I got the same error with openjdk-6.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "NetworkInterface_if_inet6.diff" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]