HeapCrash / Challenges / Ping diagnostic on a Linux gateway

Ping diagnostic on a Linux gateway

A Linux gateway's local web UI has a 'ping a device' diagnostic. The handler builds a shell command from the form field and returns the output. A security audit got a root shell through it in five minutes, and a long hostname crashes the web server.

The code

Embedded Linux C. It compiles. There are 3 real bugs in it: the kind that pass a bench test and fail in the field.

int diag_ping(const char *host, char *out, size_t cap)
{
    char cmd[64];
    sprintf(cmd, "ping -c 1 -W 1 %s", host);
    FILE *f = popen(cmd, "r");
    size_t n = fread(out, 1, cap, f);
    out[n] = '\0';
    pclose(f);
    return 0;
}

What an interviewer expects

The bugs, reference fixes and the follow-up question are in the practice app, after you've tried it.

Companies that test this

Matched on the skills each company's embedded roles emphasise.

Related challenges

Flag the lines, say what breaks, then fix it and build it with clang in your browser.

Find the bugs