bugGNU Wget - Bugs: bug #36823, wget crashing from memory...

 
 

bug #36823: wget crashing from memory corruption in idn functions

Submitter:  None
Submitted:  Tue 10 Jul 2012 07:00:14 PM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  None
Privacy:  Public Assigned to:  None
Originator Name:  Jason Conti Originator Email:  -email is unavailable-
Open/Closed:  Open Release:  1.13.4
Operating System:  GNU/Linux Reproducibility:  Every Time
Fixed Release:  None Planned Release:  None
Regression:  Yes Work Required:  None
Patch Included:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 10 Jul 2012 07:00:14 PM UTC, original submission:  

Forwarding this bug upstream from:
https://bugs.launchpad.net/ubuntu/+source/wget/+bug/1022124

When mirroring a specific site (with wget -m), the user is experiencing a crash in wget 1.13.4 in malloc_consolidate(). wget 1.12 from a previous release does not exhibit the problem.

I have unfortunately not been able to reproduce the issue, but we've managed to track it down to a malformed script tag in all of the headers on the site:

<script src=”http://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js”></script>

Note the curly quotes instead of ". There is a gdb backtrace available at:
https://bugs.launchpad.net/ubuntu/+source/wget/+bug/1022124/comments/5

and a valgrind log at:
https://bugs.launchpad.net/ubuntu/+source/wget/+bug/1022124/comments/8

which seems to point to a change to src/iri.c from commit 2f6aa1d7417df1dfc58597777686fbd77179b9fd:

diff --git a/src/iri.c b/src/iri.c
index 08cfde4..9b16639 100644
--- a/src/iri.c
+++ b/src/iri.c
@@ -264,6 +264,21 @@ remote_to_utf8 (struct iri i, const char *str, const char *new)
   if (!i->uri_encoding)
     return false;
 
+  /* When `i->uri_encoding' == "UTF-8" there is nothing to convert.  But we must
+     test for non-ASCII symbols for correct hostname processing in `idn_encode'
+     function. */
+  if (!strcmp (i->uri_encoding, "UTF-8"))
+    {
+      int i, len = strlen (str);
+      for (i = 0; i < len; i++)
+        if ((unsigned char) str[i] >= (unsigned char) '\200')
+          {
+            *new = strdup (str);
+            return true;
+          }
+      return false;
+    }
+
   cd = iconv_open ("UTF-8", i->uri_encoding);
   if (cd == (iconv_t)(-1))
     return false;

We dropped the patch, rebuilt wget and haven't been able to reproduce the issue. I'm not really certain how best to fix the issue if this is indeed where the problem exists.

If any further information is required, I can request it on the launchpad bug (or information can be requested directly in the comments). Thanks for any help.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by None (Submitted the item)
  •  

    No changes have been made to this item

    Back to the top

    Powered by Savane 3.13-cf05.
    Corresponding source code