bugGNUstep - Bugs: bug #37596, NSXMLParser.m randomly crashes on...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #37596: NSXMLParser.m randomly crashes on parsing strings

Submitted by:  Sebastian Reitenbach <buzzdee>
Submitted on:  Thu 18 Oct 2012 04:47:29 PM UTC  
 
Category: Base/FoundationSeverity: 4 - Important
Item Group: BugStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Fri 19 Oct 2012 07:11:55 AM UTC, comment #3:

I coded a fix before I noticed your patch, but looking at it they seem very similar (the functional difference being that I tried to check that we don't read past the end of the buffer ... rarely a problem, but can could a crash). There's a chance I made a fencepost error in the length of data to copy, so some testing that things still work, and a second pair of eyes on the code would be good.

Richard Frith-Macdonald <CaS>
Project Member
Fri 19 Oct 2012 07:04:53 AM UTC, comment #2:

I've seen it happen only once. Trying to reproduce it, may be tricky, since I don't have direct control of the garbage of the stack ;)

Anyways, I'll try it, and will see. At least from looking at the code it looks fine to me, just a different solution to the problem.

thanks,
Sebastian

Sebastian Reitenbach <buzzdee>
Project Member
Thu 18 Oct 2012 09:47:18 PM UTC, comment #1:

I attempted a fix, but I don't have any test code ... please could you try it and see if I messed up.

Richard Frith-Macdonald <CaS>
Project Member
Thu 18 Oct 2012 04:47:29 PM UTC, original submission:

-[NSXMLParser _parseEntity:] gives a not NULL terminated string to sscanf which may crash, depending on the garbage on the stack, due to the fact that the string is not NULL terminated. At least seen on OpenBSD.

Its the similar problem we've seen with simplewebkits NSXMLParser. Attached patch uses the same solution Nikolaus proposed for simplewebkits NSXMLParser.

Here is a backtrace from MPDCon:

(gdb) bt
#0 0x0aba5c33 in strlen (
str=0x8376568f "039;t notice\nDon&#039;t even sound I&#039;m coming\nSoon you&#039;ll have a .. Everyw[...]</lyrics>\n\t<url>http://lyrics.w0</page_namespac"...) at /usr/src/lib/libc/string/strlen.c:43
#1 0x0ab332c1 in sscanf (
str=0x8376568f "039;t notice\nDon&#039;t even sound I&#039;m coming\nSoon you&#039;ll have a .. Everyw[...]</lyrics>\n\t<url>http://lyrics.w0</page_namespac"..., fmt=0x203e0481 "x%x;") at /usr/src/lib/libc/stdio/sscanf.c:59
#2 0x005796a6 in -[NSXMLParser _parseEntity:] (self=0x8224e8a4, _cmd=0x20464f38, result=0xcfbcc768) at NSXMLParser.m:1388
#3 0x0057aa24 in -[NSXMLParser parse] (self=0x8224e8a4, _cmd=0x3c011bb8) at NSXMLParser.m:1679
#4 0x1c012d90 in -[LyricsInspector updateLyrics] (self=0x87e7b984, _cmd=0x3c011b30) at LyricsInspector.m:240
#5 0x1c012878 in -[LyricsInspector songChanged:] (self=0x87e7b984, _cmd=0x3c011b20, aNotif=0x857b3504) at LyricsInspector.m:210
#6 0x004af9ee in -[NSNotificationCenter _postAndRelease:] (self=0x81febaa4, _cmd=0x2042a828, notification=0x857b3504) at NSNotificationCenter.m
#7 0x004aefeb in -[NSNotificationCenter postNotification:] (self=0x81febaa4, _cmd=0x3c003128, notification=0x857b3504) at NSNotificationCenter.
#8 0x1c003f8a in -[AppController(Private) _updateView:] (self=0x8a143484, _cmd=0x3c003078, sender=0x87e88d04) at AppController.m:585
#9 0x004c33a8 in -[NSObject performSelector:withObject:] (self=0x8a143484, _cmd=0x2044d648, aSelector=0x3c003078, anObject=0x87e88d04) at NSObj
#10 0x00538786 in -[NSTimer fire] (self=0x87e88d04, _cmd=0x20440bf8) at NSTimer.m:258
#11 0x00507d69 in -[NSRunLoop limitDateForMode:] (self=0x84592da4, _cmd=0x20440c58, mode=0x20440cb0) at NSRunLoop.m:1016
#12 0x0050427e in -[NSRunLoop runMode:beforeDate:] (self=0x84592da4, _cmd=0x200f1720, mode=0x20440cb0, date=0x86793224) at NSRunLoop.m:1255
#13 0x0029d341 in -[GSDisplayServer(EventOps) getEventMatchingMask:beforeDate:inMode:dequeue:] (self=0x8bb17c04, _cmd=0x2a9b21d8, mask=429496729
at GSDisplayServer.m:999
#14 0x0a9d084e in __objc_xgcontextevent_linking () from /usr/local/lib/GNUstep/Bundles/libgnustep-back-022.bundle/./libgnustep-back-022
#15 0x000e7dcf in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (self=0x86687084, _cmd=0x2003e0e8, mask=4294967295, expiratio
at NSApplication.m:2173
#16 0x000e5afb in -[NSApplication run] (self=0x86687084, _cmd=0x20033ee8) at NSApplication.m:1559
#17 0x000c4733 in NSApplicationMain (argc=1, argv=0xcfbccffc) at Functions.m:95
#18 0x1c013cf4 in gnustep_base_user_main (argc=1, argv=0xcfbccffc) at main.m:30
#19 0x004f341e in main (argc=1, argv=Cannot access memory at address 0x4
) at NSProcessInfo.m:984
#20 0x1c003037 in ___start (argc=1, argv=0xcfbccffc, envp=0xcfbcd004, cleanup=0, obj=0x0, ps_strings=0xcfbfdff0) at /usr/src/lib/csu/i386/crt0.c
#21 0x1c002fb2 in _start () at /usr/src/lib/csu/i386/crt0.c:77
(gdb) frame 2
#2 0x005796a6 in -[NSXMLParser _parseEntity:] (self=0x8224e8a4, _cmd=0x20464f38, result=0xcfbcc768) at NSXMLParser.m:1388
1388 if (sscanf((char *)ep+1, "x%x;", &val))
Current language: auto; currently minimal

Sebastian Reitenbach <buzzdee>
Project Member

 

Attached Files
file #26787:  patch-Source_NSXMLParser_m added by buzzdee (918B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rmottola (Updated the item)
  • -unavailable- added by CaS (Posted a comment)
  • -unavailable- added by buzzdee (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 15 Jan 2013 10:22:32 PM UTCrmottolaOpen/ClosedIn Test=>Closed
    Thu 18 Oct 2012 09:47:18 PM UTCCaSStatusNone=>Fixed
      Open/ClosedOpen=>In Test
    Thu 18 Oct 2012 04:47:29 PM UTCbuzzdeeAttached File-=>Added patch-Source_NSXMLParser_m, #26787

    Back to the top


    Powered by Savane 3.1-cleanup