rm with deep directories - segfaults when stack full

[Ketil Froyn]

Hi.

The script rmbug (attached) will demonstrate how "rm -rf" segfaults with
deep directories. I believe this is because it runs out of stack when the
recursive routines are called enough times. With the default (on my
system, anyway) of 8192k stack, about 13500 levels deep is necessary to
make rm segfault. On some filesystems, like reiserfs, it takes only a few
seconds to create a hierarchy this deep.

This could be abused maliciously, for instance to make /tmp run full when
scripts to delete old files don't work, which in turn could cause all
sorts of weird behaviour. I guess this might qualify as a local DoS. The
solution is to rewrite the code to delete the directories using a
while-loop instead of recursion, something like the perl script rm-rf
(attached). Use with care, it has not been tested much.

regards,
Ketil Froyn

rmbug
Description: Text document

rm-rf
Description: Text document