2.1 KiB
| id | status | status_updated | status_note | component | severity | timestamp | last_seen | occurrences | files | tags | related | fix_commits | legacy | gitea_issue | gitea_synced_status | gitea_synced_hash | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| bug-1702 | fixed | 2026-09-28 | controller | unknown | 2026-08-26T09:32:18Z | 2026-09-19T09:00:00Z | 1 |
|
|
|
|
true | 299 | fixed | d7784ec4cb29 |
bug-1702: cmd_jobrun's -m <host>:<ntasks> parsing copies the host-name substring into a fixed 256-byte…
Description
cmd_jobrun's -m <host>:<ntasks> parsing copies the host-name substring into a fixed 256-byte stack buffer with an unbounded strncpy (length = bytes before ':' in the user-supplied argument, never clamped to sizeof(buf)). A -m argument with a hostname longer than 256 bytes before the ':' overflows the stack buffer.
Environment
Not recorded (migrated from buglog.json).
Reproduction
Not recorded (migrated from buglog.json).
Root cause
strncpy(buf, optarg, (int)(p - optarg)) uses the attacker/user-controlled substring length directly with no MIN(..., sizeof(buf)-1) clamp, unlike sibling code elsewhere in the file that does bound similar copies.
Fix
jobrun's -m now goes through cmdutil_split_host_tasks() (src/harness/cmdutil.c), which refuses a host segment that does not fit the 256-byte buffer (-ENAMETOOLONG → "host name in -m ... is longer than 255 characters") and an ntasks that is not an integer >= 1.
Verification
- Test: test_jobrun_overlong_host_rejected_without_overflow in src/harness/testsuite/test_test_cli.c: RED before the fix (ASAN stack-buffer-overflow, WRITE of size 300, xce_test died), GREEN after; plus the split_host_tasks cases in src/harness/testsuite/test_cmdutil.c (a canary after the host buffer stays intact)
- Suites: harness 6/6 (asan): harness_unit_test 141/0, cmdutil 14/0, resval_typeresolve 7/0, joblist_display 22/0, join_worker_args 7/0, listrow_json 12/0
- Live: n/a; xce_test is a client tool and every case above runs without a controller
References
- Related: bug-1703