tightvncpasswd crashes
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
tightvnc (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
$ lsb_release -rd
Description: Ubuntu 16.04 LTS
Release: 16.04
$ tightvncpasswd
Using password file /home/pa/
Password:
Verify:
Would you like to enter a view-only password (y/n)? n
*** buffer overflow detected ***: tightvncpasswd terminated
======= Backtrace: =========
/lib/i386-
/lib/i386-
/lib/i386-
tightvncpasswd[
/lib/i386-
tightvncpasswd[
======= Memory map: ========
08048000-0804b000 r-xp 00000000 08:01 11283419 /usr/bin/
0804b000-0804c000 r--p 00002000 08:01 11283419 /usr/bin/
0804c000-0804d000 rw-p 00003000 08:01 11283419 /usr/bin/
Of course when we store the password, we have a
buffer overflow - how else. :)
I installed the dbgsym package and run under valgrind:
Using password file /home/pa/
Password:
Verify:
Would you like to enter a view-only password (y/n)? n
==7157== Conditional jump or move depends on uninitialised value(s)
==7157== at 0x403037B: strlen (in /usr/lib/
==7157== by 0x8048C9D: main (vncpasswd.c:139)
==7157== Uninitialised value was created by a stack allocation
==7157== at 0x8048A21: main (vncpasswd.c:46)