Buffer overread in MD5 code

[Hanno Böck]

When compiling monit with address sanitizer (-fsanitize=address in CFLAGS+LDFLAGS) and connecting to the web interface with any password it will show a buffer overread in the MD5 code (function md5_process).

I tried tracking down the bug, but the code is relatively complicated. I’m attaching a full stack trace from asan.

[cgzones]

Commit https://bitbucket.org/cgzones/monit/commits/9090f6a440b0b88b85265eed21d41bb04cf4c87f?at=master (“Util_getToken: fix stack overflow”) from pr https://bitbucket.org/tildeslash/monit/pull-requests/77 should fix this

[Massimo Sala]

Hi Hanno

Why do you use also LDFLAGS ?

Is not sufficient to set CFLAGS ?

‌

[Hanno Böck]

You need ASAN in the linker flags, because it’s implemented as a library that has to be linked into the executable.

[Tildeslash]

fixed: https://bitbucket.org/tildeslash/monit/pull-requests/77/misc-fixes/diff

Thanks to Lutz Mader for patch