Iljas Blag

FiSH is a plugin for most popular irc clients that implements encryption. I looked at it a few years ago, and it was horrible. Stacksmashes _everywhere_. I briefly looked at it again yesterday, only to discover that all the bugs are still there ! somewhat shocking. I wonder how many people have been owned because of those bugs.
I looked at the xchat plugin code (but I believe most of the code is shared and only the entry point code is (obviously) different) and it basicly registers 4 functions that handle incomming data:

xchat_hook_server(ph, “PRIVMSG”, XCHAT_PRI_NORM, decrypt_incoming, 0);
xchat_hook_server(ph, “NOTICE”, XCHAT_PRI_NORM, notice_received, 0);
xchat_hook_server(ph, “TOPIC”, XCHAT_PRI_NORM, decrypt_incoming, 0);
xchat_hook_server(ph, “NICK”, XCHAT_PRI_NORM, nick_changed, 0);
xchat_hook_server(ph, “332″, XCHAT_PRI_NORM, decrypt_topic_332, 0);

so let’s look at all of those.

int decrypt_incoming(char *word[], char *word_eol[], void *userdata)
{
unsigned char *msg_ptr, contactName[100]=”", from_nick[50], msg_event[100]=”",

psyNetwork[12];
…
if(word[1][0] == ‘:’) ExtractRnick(from_nick, word[1]);
…
}

here’s what ExtractRnick() does:

int ExtractRnick(char *Rnick, char *incoming_msg)
{
int k=0;

if(*incoming_msg == ‘:’) incoming_msg++;

while(*incoming_msg!=’!’ && *incoming_msg!=0) {
Rnick[k]=*incoming_msg;
incoming_msg++;
k++;
}
Rnick[k]=0;

if (*Rnick < ‘0′) return FALSE;
else return TRUE;
}

you can clearly see the stacksmash here (word[1] comes from the network !). the other 3 functions are just as horrible:

int notice_received(char *word[], char *word_eol[], void *userdata)
{
unsigned int i;
unsigned char hisPubKey[300], contactName[25]=”", from_nick[25]=”";
…
if(ExtractRnick(from_nick, word[1])==0) return XCHAT_EAT_NONE;
…
}

int nick_changed(char *word[], char *word_eol[], void *userdata)
{
unsigned char contactName[100]=”", theKey[500]=”", ini_nicktracker[10];
…
if( *ini_nicktracker==’0′ || *ini_nicktracker==’N’ || *ini_nicktracker==’n’ ||
(ExtractRnick(contactName, word[1])==0) ||
(stricmp(contactName, word[3]+1)==0))
return XCHAT_EAT_NONE;
…
}

int decrypt_topic_332(char *word[], char *word_eol[], void *userdata)
{
unsigned char contactName[100]=”";
…
strcpy(contactName, word[4]);
…
}

yes, that last one is an actual strcpy() stacksmash. The 90’s called, they want their bugs back :-p

Tags: ilja

This entry was posted on Thursday, March 8th, 2007 at 5:30 and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.