The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
N/A
Threat Mapped score: 0.0
Industry: Finiancial
Threat priority: Unclassified
CVE: CVE-2001-1349
unsafe calls to library functions from signal handler
CVE: CVE-2004-2259
SIGCHLD signal to FTP server can cause crash under heavy load while executing non-reentrant functions like malloc/free.
N/A
| Phase | Note |
|---|---|
| Implementation | N/A |
Intro: In this example, a signal handler uses syslog() to log a message:
char *message; void sh(int dummy) { syslog(LOG_NOTICE,"%s\n",message); sleep(10); exit(0); } int main(int argc,char* argv[]) { ... signal(SIGHUP,sh); signal(SIGTERM,sh); sleep(10); exit(0); } If the execution of the first call to the signal handler is suspended after invoking syslog(), and the signal handler is called a second time, the memory allocated by syslog() enters an undefined, and possibly, exploitable state.Intro: The following code relies on getlogin() to determine whether or not a user is trusted. It is easily subverted.
pwd = getpwnam(getlogin()); if (isTrustedGroup(pwd->pw_gid)) { allow(); } else { deny(); }