Conversation
…nlarge stack buffers to 64 bytes and use safe fread bounds in FileIsX64ELF, FileIsX86ELF, FileIsX64X86ELF, FileIsShell, and FileIsPython. Prevents __fread_chk fortify aborts and stack smashing on ARM64 during execve.
|
Should fix #4382 |
|
I'm sorry, but I don't understand were is the fix? the fread change you do is ... strange. The form used in box64 is perfectly legal and correct, so please expand (and please, don't use AI to explain, it's your PR, not an AI one) |
| char head[64] = {0}; | ||
| size_t sz = fread(head, 1, 20, f); | ||
|
|
||
| char head[sizeof(x64lib)] = {0}; |
There was a problem hiding this comment.
what was wrong with the 64-bytes size of the array before, because I think that was the onyl fix there
There was a problem hiding this comment.
I thought it would be good to implement dynamic head buffer size
To reduce the number of magic numbers
|
I must apologize, at least for ai description and unnecessary changes. The issue persist on termux, because of patches that change system prefix, but they forgot to modify head size. I should have edited their patch, but I thought it would be good to implement dynamic head buffer size. |
|
That looks ok for now, but I still don't see any "Fix buffer overflow and stack smashing". Where is the buffer overflow in the original code? |
|
The description and title were generated by an AI, so they are incorrect and outdated. Initially, I simply increased the buffer size and saw that it fixed the issue. After further testing, I realized the bug was actually on Termux's side, as they were blindly replacing shebangs at the beginning of the file with patch in pkg repo. However, I still think that dynamically determining the buffer size at compile time is a good idea. I could close this and open a new pull request, but I can also just edit the current title and description instead. |
|
Well, I would appreciate some cleanup yes. Title and main description are really heavy and confusing. Either edit or create a new ticket is up to you. |
Change signature strings from
const char*toconst char[]insrc/utils/fileutils.cand derive buffer sizes usingsizeof().This removes hardcoded buffer sizes (
20,25) and allows stack buffers to automatically adapt at compile time if signature paths are patched for distros with non-standard prefixes (such as Termux or NixOS), preventing buffer overflows.