search

Spivoxity / obc-3

Oxford Oberon-2 compiler
38 stars 7 forks source link

Various buffer overruns #50

Open Spivoxity opened 4 months ago

Spivoxity commented 4 months ago

An anonymous "security researcher" reports various potential buffer overruns, none of them drastic.

  1. In runtime/loader.c, there is no check on the segment sizes read from the file trailer (which could even be negative!).
  2. In runtime/loader.c, the function read_string (used to read symbol names) has a fixed-size buffer that could overflow.
  3. In runtime/xmain.c, there is a fixed-size buffer for components of the PATH environment variable that could overflow.
  4. In runtime/linker.c, there is a fixed-size buffer used to form symbols for the LINE directive that could overflow.

No doubt there are other security problems, some of them more potentially serious than these.