segmentation fault when execute_command and the stack overflow caused by parameters about triplecross HOT 5 CLOSED

Well, there are other security issues. There is no limit to the length of program parameters, which may cause overflow.

src/client/client.c

void main(int argc, char* argv[]){
...
    int opt;
    char dest_address[32];
    char path_arg[512];

    while ((opt = getopt(argc, argv, ":S:c:e:u:a:p:s:h")) != -1) {
        switch (opt) {
        case 'S':
...
            strcpy(dest_address, optarg);

from triplecross.

You're right. There is surely more instances like this one. Tagging this as a security bug to be fixed at some point. Thanks!

from triplecross.

Is this the reason I get

Illegal instruction (core dumped) - when I run ./simple_timer. and a
segmentation fault (core dumped) - when I run ./simple_open?

I have not been able to carry out a PoC due to the above errors.

from triplecross.

@Ifex370 I am moving your issue to a different thread (#44) since it is not related to this security-related issue

from triplecross.

https://nvd.nist.gov/vuln/detail/CVE-2022-35505
https://nvd.nist.gov/vuln/detail/CVE-2022-35506
Discoverer: Chao Yang@Li Auto

from triplecross.