Vulnerability Development mailing list archives

Re: Segfault in seejpeg 1.10


From: TripleDES <TripleDES () eSlack org>
Date: Sat, 10 Nov 2001 23:10:54 +0100

On Sat, 10 Nov 2001 21:35:38 +0100
Patryk Chmielewski <argv () jaskinia eu org> wrote:

I found bug in seejpeg 1.10 but i think it's not expolitable.  Let's see:
(my seejpeg don't have suid and i'm showing this bug running seejpeg at root)


My temporary dir is empty:
root@jaskinia:/tmp$ ls
root@jaskinia:/tmp$

Next we must create some empty files:
root@jaskinia:/tmp$ touch fuj
root@jaskinia:/tmp$ touch ble
root@jaskinia:/tmp$ touch chakiery_z_polzki
root@jaskinia:/tmp$

And main part:

root@jaskinia:/tmp# seejpeg *
[many '\n' :)]
Empty input file

svgalib: Signal 11: Segmentation fault received.
Segmentation fault (core dumped)
root@jaskinia:/tmp#

My OS:
argv@jaskinia:~$ uname -a
Linux jaskinia 2.2.20 #1 Sat Nov 3 22:18:56 CET 2001 i686 unknown
argv@jaskinia:~$
argv@jaskinia:~$ cat /etc/slackware-version
8.0.0 (åtta)
argv@jaskinia:~$

What do you think about this?
Can you reproduce this on your machines?

-- 
-=[  Patryk Chmielewski   -> :: <-   argv () jaskinia eu org  ]=-
-=[   ******      http://argv.jaskinia.eu.org     ******   ]=-
-=[ "If you lie to the compiler, it will get its revenge." ]=-



I try it, and crash too...

root@thor:~# cd /tmp/pepe/
root@thor:/tmp/pepe# ls
ble  chakiery_z_polzki  fuj
root@thor:/tmp/pepe# seejpeg *
Segmentation fault
root@thor:/tmp/pepe#     

But in tty8 I have:
Empty input file
ungetc() failed
Empty input file
Empty input file
svgalib: Signal 11: Segmentation fault received.


Current thread: