poniedziałek, 16 stycznia 2017

Bug in ab from Apache 2.2.22

Some time ago I found that ab from Apache can be crashed by malformed CLI arguments. Below few notes about it.

VM with Debian7 and Apache 2.2.22 installed. Let's try ab:

Ok. From manual we will get that:

So now we know what we're looking for. Checking version(s):


Ok, good. We will use it for future tests.

Fortunately I found source code (from 2.4):

Great. Looking deeper:



And next:

So again, restart:


Now we will set a breakpoint:


And we're here:

Let's go back to the source:

Ok, good. Because I was looking for other functions used in the source, I found also this file:

So now we see a declaration of the function:

Here you will see that mentioned function used in the source:

Ok, next (still in apr_snprintf.c file):

What is doing this convert-function?

And this is our conv_10():

...as described:

So we're here:




I think I found another bug, this time related to "allocations". Check it out:

But when we'll increase the value for "C":

And here:

And this is how I found:

This page and this one :)

Maybe you will find it useful. :)


Brak komentarzy:

Prześlij komentarz