buffer overflow vulnerability

[Bernhard Kuemel]

Hi bug-gnu-chess!

gnuchess contains a buffer overflow vulnerability that may lead to
arbitrary command execution if an attacker is permitted to send
commands to gnuchess remotely via the internet.

----------------------------------------------------
address@hidden:/usr/src/gnuchess$ gdb ./gnuchess
(gdb) run
Starting program: /usr/src/gnuchess/./gnuchess 
GNU Chess v5.02

Transposition table:  Entries=1024K Size=32768K
Pawn hash table: Entries=384K Size=18432K
White (1) : AAAAAAAAAAAAAAA1234567890

Program received signal SIGSEGV, Segmentation fault.
0x35343332 in ?? ()
-----------------------------------------------------

In file cmd.c:

    65  void InputCmd ()
    66 
/*************************************************************************
    67   *
    68   *  This is the main user command interface driver.
    69   *
    70  
***********************************************************************
   477     /* everything else must be a move */
or e.g. malicious input
   478     else
   479     {
   480        ptr = ValidateMove (cmd);

In file move.c:

   500  leaf * ValidateMove (char *s)
   501 
/*************************************************************************
   502   *
   503   *  This routine takes a string and check to see if it is a
legal move.
   504   *  Note.  At the moment, we accept 2 types of moves notation.
   505   *  1.  e2e4 format.   2. SAN format. (e4)
   506   *
   507  
***********************************************************************
   508  {
   509     short f, t, side, rank, file, fileto;
   510     short piece, kount;

This is the reason for the overflow:
   511     char mvstr[10], *p;
                      ^^
   512     BitBoard b;
   513     leaf *n1, *n2;
   514  

   524     p = mvstr;
   525     do
   526     {
   527        if (*s != 'x' && *s != '+' && *s != '=')

The overflow happens here:
   528           *p++ = *s; 
                 ^^^^^^^^^^
   529     } while (*s++ != '\0');

You may eliminate the vulnerability by defining

   511     char mvstr[64], *p;

since you limit the input to 64 bytes in cmd.c:

   120          if (fgets (inputstr, 64, stdin) && inputstr[0])
   121              inputstr[strlen(inputstr)-1] = '\000';

Please tell me when you will release a fixed version so I can announce
the vulnerability in the bugtraq mailinglist. Please respond within
reasonable time or I will publish the vulnerablity before you release
a fixed version.

Bernhard