cloudflare / keyless

Cloudflare's Keyless SSL Server Reference Implementation
Other
276 stars 78 forks source link

Crash with unrecognized long option #19

Closed mrvacbob closed 10 years ago

mrvacbob commented 10 years ago

kssl_server crashes in libc when passed --help, which turns out to not be a recognized option.

The issue is that long_options[] doesn't have a blank entry at the end, so getopt runs past the end of it.

# gdb762 --args ./o/kssl_server --help
(gdb) run
Starting program: /usr/local/src/keyless/keyserver/./o/kssl_server --help
[New LWP 101292]
[New Thread 801c07400 (LWP 101292)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 801c07400 (LWP 101292)]
strncmp (s1=0x7fffffffdd0b "help", 
    s2=0x79656b2e2a2f <Address 0x79656b2e2a2f out of bounds>, n=4)
    at /usr/src/lib/libc/string/strncmp.c:45
45          if (*s1 != *s2++)
(gdb) up
(gdb) up
#3  0x0000000000403670 in main (argc=2, argv=0x7fffffffda68)
    at kssl_server.c:380
380     int c = getopt_long(argc, argv, "", long_options, 0);
(gdb) print long_options
$1 = {{name = 0x40695a "port", has_arg = 1, flag = 0x0, val = 0}, {
    name = 0x40695f "server-cert", has_arg = 1, flag = 0x0, val = 1}, {
    name = 0x40696b "server-key", has_arg = 1, flag = 0x0, val = 2}, {
    name = 0x406976 "private-key-directory", has_arg = 1, flag = 0x0, 
    val = 3}, {name = 0x40698c "cipher-list", has_arg = 1, flag = 0x0, 
    val = 4}, {name = 0x406998 "ca-file", has_arg = 1, flag = 0x0, val = 5}, {
    name = 0x4069a0 "silent", has_arg = 0, flag = 0x0, val = 6}, {
    name = 0x4069a7 "verbose", has_arg = 0, flag = 0x0, val = 7}, {
    name = 0x4069af "pid-file", has_arg = 1, flag = 0x0, val = 8}, {
    name = 0x4069b8 "num-workers", has_arg = 2, flag = 0x0, val = 9}}
(gdb)
jgrahamc commented 10 years ago

I have fixed this in pull request: https://github.com/cloudflare/keyless/pull/20