bugGNU Wget - Bugs: bug #44884, wget crash with empty --header

 
 

bug #44884: wget crash with empty --header

Submitted by:  Elan Ruusamäe <glen>
Submitted on:  Mon 20 Apr 2015 06:02:49 PM UTC  
 
Category:  None Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  1.16.3 Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 20 Apr 2015 06:32:23 PM UTC, comment #3:

oh, it looks fixed already upstream. this patch seems fixed it:

+commit ac40b84ee138d45379046e21e31d237f6937a014
+Author: Hubert Tarasiuk <hubert.tarasiuk@gmail.com>
+Date: Fri Apr 10 11:52:34 2015 +0200
+
+ Fix error in free_vec.
+
+ * src/utils.c (free_vec): Increment pointer instead of its value.
+
+ Reported-by: Gisle Vanem <gvanem@yahoo.no>

http://git.pld-linux.org/?p=packages/wget.git;a=commitdiff;h=f813fc4fd0d14eb559ab6467b2e8a4a4ef9ea519

with above patch applied:

$ wget --header 'Content-Type:text/plain;charset=UTF-8' --header '' https://google.com
--2015-04-20 21:31:48-- https://google.com/
Resolving google.com (google.com)... 2a00:1450:401b:800::200e, 216.58.209.78
Connecting to google.com (google.com)|2a00:1450:401b:800::200e|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://www.google.com/ [following]
--2015-04-20 21:31:48-- https://www.google.com/
Resolving http://www.google.com (www.google.com)... 2a00:1450:401b:800::2004, 216.58.209.36
Connecting to http://www.google.com (www.google.com)|2a00:1450:401b:800::2004|:443... connected.
HTTP request sent, awaiting response... 200 OK

Elan Ruusamäe <glen>
Mon 20 Apr 2015 06:20:18 PM UTC, comment #2:

wget --version details (btw, Release: tag in bugreport i also specified the version):

GNU Wget 1.16.3 built on linux-gnu.

+digest +https +ipv6 +iri +large-file +nls +ntlm +opie +psl +ssl/openssl

Wgetrc:
/home/users/glen/.wgetrc (user)
/etc/wgetrc (system)
Locale:
/usr/share/locale
Compile:
x86_64-pld-linux-gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc"
-DLOCALEDIR="/usr/share/locale" -I. -I../lib -I../lib
-I/usr/include/openssl -DHAVE_LIBSSL -DNDEBUG -O2 -fwrapv -pipe
-Wformat -Werror=format-security -gdwarf-4 -fno-debug-types-section
-fvar-tracking-assignments -g2 -Wp,-D_FORTIFY_SOURCE=2
-fstack-protector --param=ssp-buffer-size=4 -fPIC -march=x86-64
-gdwarf-4 -fno-debug-types-section -fvar-tracking-assignments -g2
Link:
x86_64-pld-linux-gcc -I/usr/include/openssl -DHAVE_LIBSSL -DNDEBUG
-O2 -fwrapv -pipe -Wformat -Werror=format-security -gdwarf-4
-fno-debug-types-section -fvar-tracking-assignments -g2
-Wp,-D_FORTIFY_SOURCE=2 -fstack-protector --param=ssp-buffer-size=4
-fPIC -march=x86-64 -gdwarf-4 -fno-debug-types-section
-fvar-tracking-assignments -g2 -Wl,--as-needed
-Wl,--no-copy-dt-needed-entries -Wl,-z,relro -Wl,-z,combreloc
-lpcre -luuid -lssl -lcrypto -lz -lpsl -lidn ftp-opie.o openssl.o
http-ntlm.o ../lib/libgnu.a

Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://www.gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Originally written by Hrvoje Niksic <hniksic@xemacs.org>.
Please send bug reports and questions to <bug-wget@gnu.org>.

Elan Ruusamäe <glen>
Mon 20 Apr 2015 06:13:45 PM UTC, comment #1:

I am unable to reproduce this bug with Wget 1.16.3.

Running the commands provided, I can see that Wget successfully downloads the google.com home page.

However, I did notice that when the second header is empty, it has the side effect of deleting all custom headers from the request. That I would classify as a new bug.

Could you please provide more information about the environment you're running the commands in? The Operating System and locale being the most important. Also, kindly share the output of wget --version.

Darshit Shah <darnir>
Project Administrator
Mon 20 Apr 2015 06:02:49 PM UTC, original submission:

$ wget --header 'Content-Type:text/plain;charset=UTF-8' --header '' https://google.com
Segmentation fault

note, that this one does not crash:
$ wget --header '' https://google.com
--2015-04-20 20:51:11-- https://google.com/

so the first valid header is neccessary

looks like double-free, the trace is incomplete, but you'll get the idea:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff68ad874 in free () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff68ad874 in free () from /lib64/libc.so.6
#1 0x0000000000430719 in ?? ()
#2 0x0000000000421f98 in ?? ()
#3 0x0000000000422bff in ?? ()
#4 0x0000000000405f77 in ?? ()
#5 0x00007ffff68528a0 in __libc_start_main () from /lib64/libc.so.6
#6 0x00000000004072a9 in ?? ()
(gdb)

Elan Ruusamäe <glen>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rockdaboot (Updated the item)
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by glen (Submitted the item)
  •  

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-04-20 rockdaboot StatusNone => Fixed
        Open/ClosedOpen => Closed

    Back to the top


    Powered by Savane 3.3