From 2c933ecba3bb1d3041a5a7a53a7b4078a6003413 Mon Sep 17 00:00:00 2001
From: Craig Small <csmall@dropbear.xyz>
Date: Thu, 10 Aug 2023 21:18:38 +1000
Subject: [PATCH] ps: Fix possible buffer overflow in -C option

ps allocates memory using malloc(length of arg * len of struct).
In certain strange circumstances, the arg length could be very large
and the multiplecation will overflow, allocating a small amount of
memory.

Subsequent strncpy() will then write into unallocated memory.
The fix is to use calloc. It's slower but this is a one-time
allocation. Other malloc(x * y) calls have also been replaced
by calloc(x, y)

References:
 https://www.freelists.org/post/procps/ps-buffer-overflow-CVE-20234016
 https://nvd.nist.gov/vuln/detail/CVE-2023-4016
 https://gitlab.com/procps-ng/procps/-/issues/297
 https://bugs.debian.org/1042887

Signed-off-by: Craig Small <csmall@dropbear.xyz>
---
 ps/parser.c |   24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

--- ps/parser.c
+++ ps/parser.c	2023-08-15 12:19:13.375422122 +0000
@@ -183,8 +183,7 @@ static const char *parse_list(const char
   int need_item;
   const char *err;       /* error code that could or did happen */
   /*** prepare to operate ***/
-  node = malloc(sizeof(selection_node));
-  node->u = malloc(strlen(arg)*sizeof(sel_union)); /* waste is insignificant */
+  node = xmalloc(sizeof(selection_node));
   node->n = 0;
   buf = strdup(arg);
   /*** sanity check and count items ***/
@@ -205,6 +204,7 @@ static const char *parse_list(const char
   } while (*++walk);
   if(need_item) goto parse_error;
   node->n = items;
+  node->u = xcalloc(items*sizeof(sel_union));
   /*** actually parse the list ***/
   walk = buf;
   while(items--){
@@ -569,8 +569,8 @@ static const char *parse_bsd_option(void
       /* put our tty on a tiny list */
       {
         selection_node *node;
-        node = malloc(sizeof(selection_node));
-        node->u = malloc(sizeof(sel_union));
+        node = xmalloc(sizeof(selection_node));
+        node->u = xmalloc(sizeof(sel_union));
         node->u[0].tty = cached_tty;
         node->typecode = SEL_TTY;
         node->n = 1;
@@ -706,8 +706,8 @@ static const char *parse_bsd_option(void
       if(!arg){
         /* Wow, obsolete BSD syntax. Put our tty on a tiny list. */
         selection_node *node;
-        node = malloc(sizeof(selection_node));
-        node->u = malloc(sizeof(sel_union));
+        node = xmalloc(sizeof(selection_node));
+        node->u = xmalloc(sizeof(sel_union));
         node->u[0].tty = cached_tty;
         node->typecode = SEL_TTY;
         node->n = 1;
@@ -1030,16 +1030,16 @@ static const char *parse_trailing_pids(v
   argp = ps_argv + thisarg;
   thisarg = ps_argc - 1;   /* we must be at the end now */
 
-  pidnode = malloc(sizeof(selection_node));
-  pidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
+  pidnode = xmalloc(sizeof(selection_node));
+  pidnode->u = xcalloc(i*sizeof(sel_union)); /* waste is insignificant */
   pidnode->n = 0;
 
-  grpnode = malloc(sizeof(selection_node));
-  grpnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
+  grpnode = xmalloc(sizeof(selection_node));
+  grpnode->u = xcalloc(i*sizeof(sel_union)); /* waste is insignificant */
   grpnode->n = 0;
 
-  sidnode = malloc(sizeof(selection_node));
-  sidnode->u = malloc(i*sizeof(sel_union)); /* waste is insignificant */
+  sidnode = xmalloc(sizeof(selection_node));
+  sidnode->u = xcalloc(i*sizeof(sel_union)); /* waste is insignificant */
   sidnode->n = 0;
 
   while(i--){
--- proc/libprocps.sym
+++ proc/libprocps.sym	2023-08-15 12:43:18.905661726 +0000
@@ -67,6 +67,8 @@ global:
 	unix_print_signals;
 	uptime;
 	xalloc_err_handler;
+	xcalloc;
+	xmalloc;
 local:
 	*;
 };