Ticket History #8661: ksu segfaults when argc == 0

Programs are generally started with argc >= 1,
but it is possible to start a program with an
empty argv (i.e. argc == 0).

Current behaviour:
ksu segfaults when started with argc == 0.

Expected behaviour:
I would expect ksu to just exit with an error
instead.

Here is a demonstration of the segmentation fault:

user@laptop:/tmp$ cat /etc/issue
Ubuntu 17.10 \n \l

user@laptop:/tmp$ cat main.cc
#include <unistd.h>
int main() {
char* arr[] = {nullptr};
execv("/usr/bin/ksu", arr);
}
user@laptop:/tmp$ g++ -std=c++11 -o /tmp/start main.cc
user@laptop:/tmp$ /tmp/start
Segmentation fault (core dumped)
user@laptop:/tmp$

Best regards,
Erik Sjölund

I think just about all of the programs in the krb5 source tree will seg
fault when argc is 0, and I'm generally not concerned about that. It
might make sense for ksu to be careful because it's setuid, although I
don't think getting a setuid program to perform a null dereference
constitutes a vulnerability (I don't think operating systems allow
setuid programs to dump core, for instance).

A comment regarding the git commit:

https://github.com/krb5/krb5/commit/c5b0a998d6349f8c90821a347db5666aed0e50eb

The check for argc == 0 happens after the first use of argv[0].
Why not place the if statement right in the start of main()?

On Tue, Apr 24, 2018 at 10:10 PM, Greg Hudson via RT
<rt-comment@krbdev.mit.edu> wrote:

You're right; I thought I checked for prior uses but I guess I missed
them. Those uses of argv[0] are conditional and shouldn't actually
cause null dereferences if argv[0] is NULL, but given that they are
there, the check should be moved upwards.

Thanks!
That makes it easier to read the code.


On Thu, Apr 26, 2018 at 5:22 PM, Greg Hudson via RT
<rt-comment@krbdev.mit.edu> wrote: