FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

mnGoSearch buffer overflow in UdmDocToTextBuf()

Affected packages
3.2.* <= mnogosearch < 3.2.15


VuXML ID 87cc48fd-5fdd-11d8-80e3-0020ed76ef5a
Discovery 2004-02-15
Entry 2004-02-15

Jedi/Sector One <> reported the following on the full-disclosure list:

Every document is stored in multiple parts according to its sections (description, body, etc) in databases. And when the content has to be sent to the client, UdmDocToTextBuf() concatenates those parts together and skips metadata.

Unfortunately, that function lacks bounds checking and a buffer overflow can be triggered by indexing a large enough document.

'len' is fixed to 10K [in UdmDocToTextBuf] in searchd.c . S->val length depends on the length of the original document and on the indexer settings (the sample configuration file has low limits that work around the bug, though).

Exploitation should be easy, moreover textbuf points to the stack.