Linux XFBurn基于堆栈缓冲区溢出

JackBrown

类型:cwe - 121
供应商主页:http://goodies.xfce.org/projects/applications/xfburn
版本:0.5.4
测试:Ubuntu 17.04
在检查fopen（）的值之前使用nopen，fopen（）失败，返回NULL，然后传递NULL值作为流导致段错误
The kernel output | dmesg :
[ 2963.870884] xfburn[3739]: segfault at 0 ip 00007f1c9255f6f8 sp 00007ffd53ac2e70 error 4 in libc-2.23.so[7f1c924f1000+1bf000]
The GDB output:
Thread 1 "xfburn" received signal SIGSEGV, Segmentation fault.
__GI__IO_fwrite (buf=0x555555584510, size=1, count=40, fp=0x0) at iofwrite.c:37

hyxk

这个认识就高深了。