Re: NULL Pointer Dereference in setcmd () at commands.c:1152

[Erik Auerswald]

Hi,

On Sat, Dec 25, 2021 at 12:19:28PM +0800, ZFeiXQ wrote:
> ## Description
> 
> A NULL Pointer Dereference was discovered in setcmd () at commands.c:1152. 
> The vulnerability causes a segmentation fault and application crash.

Thanks for fuzzing GNU inetutils!

> ## Proof of Concept
> [POC1](https://drive.google.com/file/d/1snLElamVgMu5SO1vkKvSQqOByBlX0zxb/view?usp=sharing)
> 
> **command:**
> 
> ```
> ./telnet < POC1
> ```
> 
> **Result**
> 
> ```
> ./telnet < POC1
> [1]    728662 segmentation fault  ./telnet < ./poc
> ```

This is the same kind of problem as with unsetcmd(), but now in setcmd().
Attempting to set " " to something unconditionally follows ct->charp, but
the relevant table "Setlist" contains several entries with name " ", but
neither a valid ct->handler nor a valid ct->charp (i.e., empty lines and
comment lines):

    $ telnet/telnet
    telnet> set \  whatever
    Segmentation fault (core dumped)

The attached patch "inetutils-telnet-set_null_deref_fix.patch" fixes this
by rejecting a set argument with neither ct->handler nor ct->charp.

Thanks,
Erik
-- 
In the beginning, there was static routing.
                        -- RFC 1118

inetutils-telnet-set_null_deref_fix.patch
Description: Text Data