Fixing a Buffer Overflow in Unix v4 Like It's 1973

1 day ago (sigma-star.at)

I had to use ed once in a very limited recovery situation. I don't remember the details but even vi was not an option. It's not terrible if you just need to change a few lines. Using it on a teletype to write code all day would get tedious quickly. Full-screen editors had to have been an amazing productivity boost.

  • I think ed is still a great editor for specific tasks. As a plan 9/9front user, when you get yourself into trouble, it's sometimes the only editor you've got left (like when graphics doesn't initialize, which I've not seen on 9front — ever?)

    It's really not bad, and you can use it for scripting like sed, but it's clunkier.

  • ed makes a lot more sense if you remember they were printing everything to paper rather than using a glass tty when it was first developed

  • I had to use it when I installed 9front on a computer that has no graphics card just a serial port (APU2C2). I had only a serial device at 9600bps and the other text editors (sam, acme) didn't worked. I wanted to turn it into a CPU server so I can use drawterm to access it remotely and that requires editing a few files.

  • The amount of code was relatively low.

    Not the million line codebases we have today. 50-100 lines was the usual program or script.

    • iirc they were initially using actual ttys(as in typewriters) and the input delay was hell which is the reason so many UNIX commands are two letters.

      So likely they would work on the printout:

         1,$n
      

      And then input the corrections into ed(1).

      1 reply →

What is up with fin? Is it really just writing an int 0 in the memory right after some variable present in libc or similar?

        extern fin;

        if(getpw(0, pwbuf))
                goto badpw;
        (&fin)[1] = 0;

  • I’m guessing v4 C didn’t have structs yet (v6 C does, but struct members are actually in the global namespace and are basically just sugar for offset and a type cast; member access even worked on literals. That’s why structs from early unix APIs have prefixed member names, like st_mode.

    • > I’m guessing v4 C didn’t have structs yet

      There may have been a early C without structs (B had none,) but according to Ken Thompson, the addition of structs to C was an important change, and a reason why his third attempt rewrite UNIX from assembly to a portable language finally succeeded. Certainly by the time the recently recovered v4 tape was made, C had structs:

          ~/unix_v4$ cat usr/sys/proc.h
          struct proc {
                  char    p_stat;
                  char    p_flag;
                  char    p_pri;
                  char    p_sig;
                  char    p_null;
                  char    p_time;
                  int     p_ttyp;
                  int     p_pid;
                  int     p_ppid;
                  int     p_addr;
                  int     p_size;
                  int     p_wchan;
                  int     *p_textp;
          } proc[NPROC];
      
          /* stat codes */
          #define SSLEEP  1
          #define SWAIT   2
          #define SRUN    3
          #define SIDL    4
          #define SZOMB   5
      
          /* flag codes */
          #define SLOAD   01
          #define SSYS    02
          #define SLOCK   04
          #define SSWAP   010

  • According to the chatbot, the first word of `fin` is the file descriptor, the second its state. "Reset stdin’s flags to a clean state".

A bit of a code review (some details from the patch removed for clarity):

   +       register int i;
           q = password;
   -       while((*q = getchar()) != '\n')
   +       i = 0;
   +       while((*q = getchar()) != '\n') {
   +               if (++i >= sizeof(password))
   +                       goto error;

You don't actually need i here. i is the same as (q - password). It would be idiomatic C to simply rewrite the loop condition as: while (q < password+sizeof(password) && (*q = getchar()) != '\n'). To preserve your "goto error;" part, maybe you could do the overflow check when null terminating outside the loop.

  • Isn't sizeof only standardised in C89? Wouldn't shock me if this form needs to be an rvalue.

    The author did try pointer arithmetic:

    > I initially attempted a fix using pointer arithmetic, but the 1973 C compiler didn’t like it, while it didn’t refuse the syntax, the code had no effect.

    • This surprised me too. The snippet I was quoting from was already using sizeof, though.

      I missed the blurb about pointer arithmetic. Would be interesting to go into detail about what "had no effect" means.

Back in the 80s, when I was writing a C compiler, C compilers typically had a maximum size for string literals. The behavior was to detect overflow, issue an error message, and fail compilation.

I took a different tack. The buffer was allocated with malloc. When a string was larger, it was realloced to a larger size. This worked until memory was exhausted, and then the program quit.

It was actually less code to implement than having a fixed size buffer.

Ditto for the other compilation limits, such as length of a line. The only limit was running out of memory.

so, is there already somebody that wrote the exploit for it? are there any special things to consider exploiting such architecture back in the day or do the same basic principles apply?

The password and pwbuf arrays are declared one right after the other. Will they appear consecutive in memory, i.e. will you overwrite pwbuf when writing past password?

If so, could you type the same password that’s exactly 100 bytes twice and then hit enter to gain root? With only clobbering one additional byte, of ttybuf?

Edit: no, silly, password is overwritten with its hash before the comparison.

  • > will you overwrite pwbuf when writing past password?

    Right.

    > If so, could you type the same password that’s exactly 100 bytes twice and then hit enter to gain root? With only clobbering one additional byte, of ttybuf?

    Almost. You need to type crypt(password) in the part that overflows to pwbuf.

The source has

ttybuf[2] =& ~010;

Which is another bug.

  • What's the bug? If you're referring to the =& syntax, then that's just how &= used to be written in older versions of C.