CVE-2009-1956: Buffer Overflow

A single NULL byte buffer overflow flaw was found in apr-util's aprbrigadevprintf() function.

First let's assume the worst case and an attacker can control exactly what is being sent to aprbrigadevprintf and can trigger this issue by filling the buckets just right so you end up with one that is perfectly full as per the explanation at http://www.mail-archive.com/dev@apr.apache.org/msg21592.html

632 APUDECLARE(aprstatust) aprbrigadevprintf(aprbucketbrigade b, ... 638 struct brigadevprintfdatat vd; 639 char buf[APRBUCKETBUFFSIZE]; 640 aprsizet written; ... 656 (vd.vbuff.curpos) = '\0'; ... 659 return aprbrigadewrite(b, flush, ctx, buf, vd.vbuff.curpos - buf);

If we get to line 656 with vd.vbuff.curpos pointing to one past the end of buf we write a single NULL to the next thing on the stack after buf. And on the Linux x86 and x8664 builds we looked at this is actually the first byte of the vd structure, which is in fact the LSB of vd.vbuff.curpos itself.

So the only use of this after the overwrite is on line 659 where vd.vbuff.curpos gets used to calculate how much to write. Before the overwrite vd.vbuff.curpos was buf+APRBUCKETBUFFSIZE (8000), but now it could be between 0 and 255 bytes less. So aprbrigadewrite will end up writing out between 0 and 255 bytes less than it ought to, causing the truncation seen in the original bug report.

So for little endian systems it doesn't seem to have any security consequence. Of course for a big endian system aprbrigadewrite could end up dumping large amounts of memory (so an info disclosure leak or crash).