bugGNU cpio - Bugs: bug #28954, Segfault when passed a...

 
 

bug #28954: Segfault when passed a non-existant file to -E

Submitted by:  None
Submitted on:  Sun Feb 21 05:39:57 2010  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Discussion locked!

 

Wed Sep 1 16:09:10 2010, comment #4:

Actually, Ondrej's idea is better. Best not to close down cpio on this... his patch is best! Didn't notice it when I just posted.

Still, it was a fun exercise.

Chris Sherlock <tbsdy>
Wed Sep 1 16:04:15 2010, comment #3:

The problem is that read_pattern_file(...) is calling on open_error(...). It should be calling on open_fatal(...).

(file #21371)

Chris Sherlock <tbsdy>
Mon Feb 22 15:25:53 2010, comment #2:

For reference, here's a suggested patch from the Fedora maintainer, Ondrej Vasik: https://bugzilla.redhat.com/attachment.cgi?id=395458 .

Conrad Meyer <cemeyer>
Sun Feb 21 05:45:14 2010, comment #1:

Oh, I should add: I'm Conrad Meyer <konrad@tylerc.org>, and I've reported this on the Redhat bug tracker as well: https://bugzilla.redhat.com/show_bug.cgi?id=567022 .

Anonymous
Sun Feb 21 05:39:57 2010, original submission:

Problem:
When one invokes cpio like: "cpio -i -E doesnt_exist < some_cpio_archive", it segfaults.

Version:
cpio-2.9.90-6.fc11.x86_64

Looking at the patches Fedora makes to cpio, I don't think any of them affect this area of code.

Also, looking at the latest version of cpio on the downloads page, 2.10, it looks like this problem is still present.

Backtrace:
(gdb) bt
#0 _IO_getc (fp=0x0) at getc.c:40
#1 0x0000000000407971 in ds_fgetstr (f=0x0, s=0x7fffffffdcc0, eos=10 '\n') at dstring.c:74
#2 0x0000000000403f48 in read_pattern_file () at copyin.c:947
#3 process_copy_in () at copyin.c:1370
#4 0x0000000000408971 in main (argc=4, argv=0x7fffffffde18) at main.c:797

Conclusion:
It looks like this is a bug in either open_error() or read_pattern_file(). This occurs because fopen() returns NULL, and we pass this NULL on to fgetc().

Solution:
Either:
- open_error() should call call_arg_fatal() instead of call_arg_error(), or
- read_pattern_file() should exit in addition to reporting the error. E.g., replace:

if (pattern_fp == NULL)
open_error (pattern_file_name);

With:

if (pattern_fp == NULL)
{
open_error (pattern_file_name);
exit (...); // or similar
}

Thanks!

Anonymous

 

Attached Files
file #21371:  fix.patch added by tbsdy (676B - application/octet-stream - Proposed fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gray (Updated the item)
  • -unavailable- added by tbsdy (Updated the item)
  • -unavailable- added by cemeyer (Posted a comment)
  • -unavailable- added by cemeyer ((CCing bug reporter))
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue Feb 4 12:24:02 2014grayStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Discussion LockUnlocked=>Locked
    Wed Sep 1 16:04:15 2010tbsdyAttached File-=>Added fix.patch, #21371
    Mon Feb 22 00:24:09 2010cemeyerCarbon-Copy-=>Added cemeyer

    Back to the top


    Powered by Savane 3.1-cleanup