{"action":"created","issue":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/16","labels_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/16/labels{/name}","comments_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/16/comments","events_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/16/events","html_url":"https://github.com/chrsmith/google-security-research/issues/16","id":58936185,"number":16,"title":"launchd heap corruption due to unchecked strcpy in init_session MIG ipc","user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/auto-migrated","name":"auto-migrated","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/CVE-2014-1356","name":"CVE-2014-1356","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Deadline-90","name":"Deadline-90","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Finder-ianbeer","name":"Finder-ianbeer","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Id-605057125","name":"Id-605057125","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Product-OSX","name":"Product-OSX","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Reported-2014-Apr-04","name":"Reported-2014-Apr-04","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Severity-High","name":"Severity-High","color":"ededed"},{"url":"https://api.github.com/repos/chrsmith/google-security-research/labels/Vendor-Apple","name":"Vendor-Apple","color":"ededed"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-02-25T17:12:58Z","updated_at":"2015-02-25T17:12:58Z","closed_at":"2015-02-25T17:12:58Z","body":"```\nMIG ipc routine:\n\nroutine\ninit_session(\n\t\t\t\tj\t\t\t: job_t;\n\t\t\t\tsession\t\t: name_t;\n\t\t\t\tasport\t\t: mach_port_t\n);\n\nImplementation:\n\ncore.c:\n\nkern_return_t\njob_mig_init_session(job_t j, name_t session_type, mach_port_t asport)\n{\n...\n\tif (j->mgr->session_initialized) {\n\t\tjob_log(j, LOG_ERR, \"Tried to initialize an already setup session!\");\n\t\tkr = BOOTSTRAP_NOT_PRIVILEGED;              <-- even if the session is already initialized there's no early return here, it will still hit the strcpy\n\t}\n...\n\n\tjobmgr_log(j->mgr, LOG_DEBUG, \"Initializing as %s\", session_type);\n\tstrcpy(j->mgr->name_init, session_type);           <-- unchecked strcpy\n\n\n\nThe buffer which is being copied into is allocated here:\n\njobmgr_t \njobmgr_new(jobmgr_t jm, mach_port_t requestorport, mach_port_t transfer_port, \nbool sflag, const char *name, bool skip_init, mach_port_t asport)\n{\n\tjob_t bootstrapper = NULL;\n\tjobmgr_t jmr;\n...\n\tjmr = calloc(1, sizeof(struct jobmgr_s) + (name ? (strlen(name) + 1) : NAME_MAX + 1)); <-- here\n\n\n\njobmgr_t is typedef'd as a pointer to a struct jobmgr_s, which has a zero-sized \narray at the end:\n\nstruct jobmgr_s {\n... \n\tunion {\n\t\tconst char name[0];\n\t\tchar name_init[0];\n\t};\n};\n\n\nIt's possible to force the allocation of a new jobmgr_t with a partially \ncontrolled name field using the subset MIG ipc - this will allocate only enough \nspace for this string in the jobmgr_s struct:\n\nkern_return_t\njob_mig_subset(job_t j, mach_port_t requestorport, mach_port_t *subsetportp)\n{\n\tint bsdepth = 0;\n\tjobmgr_t jmr;\n...\n\tjmr = j->mgr;\n...\n\tchar name[NAME_MAX];\n\tsnprintf(name, sizeof(name), \"%s[%i].subset.%i\", j->anonymous ? j->prog : j->label, j->p, MACH_PORT_INDEX(requestorport));\n\n\tif (!job_assumes(j, (jmr = jobmgr_new(j->mgr, requestorport, MACH_PORT_NULL, false, name, true, j->asport)) != NULL)) {\n\n\nThis subset bootstrap port can then be passed to init_session with a longer \nsession_type.\n```\n\n-----\nOriginal issue reported on code.google.com by `ianb...@google.com` on 4 Apr 2014 at 2:45"},"comment":{"url":"https://api.github.com/repos/chrsmith/google-security-research/issues/comments/76005401","html_url":"https://github.com/chrsmith/google-security-research/issues/16#issuecomment-76005401","issue_url":"https://api.github.com/repos/chrsmith/google-security-research/issues/16","id":76005401,"user":{"login":"GoogleCodeExporter","id":9614759,"avatar_url":"https://avatars.githubusercontent.com/u/9614759?v=3","gravatar_id":"","url":"https://api.github.com/users/GoogleCodeExporter","html_url":"https://github.com/GoogleCodeExporter","followers_url":"https://api.github.com/users/GoogleCodeExporter/followers","following_url":"https://api.github.com/users/GoogleCodeExporter/following{/other_user}","gists_url":"https://api.github.com/users/GoogleCodeExporter/gists{/gist_id}","starred_url":"https://api.github.com/users/GoogleCodeExporter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/GoogleCodeExporter/subscriptions","organizations_url":"https://api.github.com/users/GoogleCodeExporter/orgs","repos_url":"https://api.github.com/users/GoogleCodeExporter/repos","events_url":"https://api.github.com/users/GoogleCodeExporter/events{/privacy}","received_events_url":"https://api.github.com/users/GoogleCodeExporter/received_events","type":"User","site_admin":false},"created_at":"2015-02-25T17:12:58Z","updated_at":"2015-02-25T17:12:58Z","body":"```\nApple follow up id: 605057125\n```\n\n-----\nOriginal comment by `ianb...@google.com` on 4 Apr 2014 at 3:56\n* Added labels: **Deadline-90**, **Reported-2014-Apr-04**, **PublicOn-2014-Jul-04**, **Id-605057125**"}}