Re: FluxBox crash vulnerability

[Tim <tim-security () sentinelchicken org>]

> Fluxbox always crashes totally while executing XMAN with long value of 
> '-title' parameter. Simple usage example:
>
> $ xman -title `perl -e 'print "X" x 10000 '`
>
> It was tested on 0.9.10 version and some older ones. Probably all are affected.

Please see tests below:

-----snip-----
~> fluxbox -version
Fluxbox 0.9.9 : (c) 2001-2004 Henrik Kinnunen 
~> uname -o -r
2.6.8 GNU/Linux
~> cat /etc/debian_version
3.1
~> xman -title `perl -e 'print "X" x 8936 '`
X connection to :0.0 broken (explicit kill or server shutdown).
----/snip-----

So, the gist of it is, on the version I am running I could never get
fluxbox to crash.  However, large titles did cause problems.  with
anything above, say, 5000 characters, the window comes up, but is very
unresponsive.  Resizing the window causes display refresh problems for
that window, and the whole window manager is generally slow.  

However, as soon as I close the window, everything returns to normal.
In addition, using any number of characters above 8936 does not cause
this behavior at all, because for 8937 and above, the title bar displays
nothing and everything is peachy.  Large titles just under that amount
cause issues, and it appears the X's in the title wrap around an
overwrite themselves in the display.  When there were problems with the
window, sometimes (maybe 1 in 4) I get the error message you see above.

I get these same symptoms when using large titles on other programs as
well.

tim

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html