bugGNU cpio - Bugs: bug #28954, Segfault when passed a...

 
 

bug #28954: Segfault when passed a non-existant file to -E

Submitted by:  None
Submitted on:  Sun 21 Feb 2010 05:39:57 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Discussion locked!

 

Wed 01 Sep 2010 04:09:10 PM UTC, comment #4:

Actually, Ondrej's idea is better. Best not to close down cpio on this... his patch is best! Didn't notice it when I just posted.

Still, it was a fun exercise.

Chris Sherlock <tbsdy>
Wed 01 Sep 2010 04:04:15 PM UTC, comment #3:

The problem is that read_pattern_file(...) is calling on open_error(...). It should be calling on open_fatal(...).

(file #21371)

Chris Sherlock <tbsdy>
Mon 22 Feb 2010 03:25:53 PM UTC, comment #2:

For reference, here's a suggested patch from the Fedora maintainer, Ondrej Vasik: https://bugzilla.redhat.com/attachment.cgi?id=395458 .

Conrad Meyer <cemeyer>
Sun 21 Feb 2010 05:45:14 AM UTC, comment #1:

Oh, I should add: I'm Conrad Meyer <konrad@tylerc.org>, and I've reported this on the Redhat bug tracker as well: https://bugzilla.redhat.com/show_bug.cgi?id=567022 .

Anonymous
Sun 21 Feb 2010 05:39:57 AM UTC, original submission:

Problem:
When one invokes cpio like: "cpio -i -E doesnt_exist < some_cpio_archive", it segfaults.

Version:
cpio-2.9.90-6.fc11.x86_64

Looking at the patches Fedora makes to cpio, I don't think any of them affect this area of code.

Also, looking at the latest version of cpio on the downloads page, 2.10, it looks like this problem is still present.

Backtrace:
(gdb) bt
#0 _IO_getc (fp=0x0) at getc.c:40
#1 0x0000000000407971 in ds_fgetstr (f=0x0, s=0x7fffffffdcc0, eos=10 '\n') at dstring.c:74
#2 0x0000000000403f48 in read_pattern_file () at copyin.c:947
#3 process_copy_in () at copyin.c:1370
#4 0x0000000000408971 in main (argc=4, argv=0x7fffffffde18) at main.c:797

Conclusion:
It looks like this is a bug in either open_error() or read_pattern_file(). This occurs because fopen() returns NULL, and we pass this NULL on to fgetc().

Solution:
Either:
- open_error() should call call_arg_fatal() instead of call_arg_error(), or
- read_pattern_file() should exit in addition to reporting the error. E.g., replace:

if (pattern_fp == NULL)
open_error (pattern_file_name);

With:

if (pattern_fp == NULL)
{
open_error (pattern_file_name);
exit (...); // or similar
}

Thanks!

Anonymous

 

Attached Files
file #21371:  fix.patch added by tbsdy (676B - application/octet-stream - Proposed fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gray (Updated the item)
  • -unavailable- added by tbsdy (Updated the item)
  • -unavailable- added by cemeyer (Posted a comment)
  • -unavailable- added by cemeyer ((CCing bug reporter))
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 04 Feb 2014 12:24:02 PM UTCgrayStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Discussion LockUnlocked=>Locked
    Wed 01 Sep 2010 04:04:15 PM UTCtbsdyAttached File-=>Added fix.patch, #21371
    Mon 22 Feb 2010 12:24:09 AM UTCcemeyerCarbon-Copy-=>Added cemeyer

    Back to the top


    Powered by Savane 3.1-cleanup