bugGNU Wget - Bugs: bug #44884, wget crash with empty --header


bug #44884: wget crash with empty --header

Submitted by:  Elan Ruusamäe <glen>
Submitted on:  Mon 20 Apr 2015 06:02:49 PM UTC  
Category: NoneSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Closed
Release: 1.16.3Operating System: GNU/Linux
Reproducibility: Every TimeFixed Release: None
Planned Release: NoneRegression: None
Work Required: NonePatch Included: None

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Mon 20 Apr 2015 06:32:23 PM UTC, comment #3:

oh, it looks fixed already upstream. this patch seems fixed it:

+commit ac40b84ee138d45379046e21e31d237f6937a014
+Author: Hubert Tarasiuk <hubert.tarasiuk@gmail.com>
+Date: Fri Apr 10 11:52:34 2015 +0200
+ Fix error in free_vec.
+ * src/utils.c (free_vec): Increment pointer instead of its value.
+ Reported-by: Gisle Vanem <gvanem@yahoo.no>


with above patch applied:

$ wget --header 'Content-Type:text/plain;charset=UTF-8' --header '' https://google.com
--2015-04-20 21:31:48-- https://google.com/
Resolving google.com (google.com)... 2a00:1450:401b:800::200e,
Connecting to google.com (google.com)|2a00:1450:401b:800::200e|:443... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://www.google.com/ [following]
--2015-04-20 21:31:48-- https://www.google.com/
Resolving http://www.google.com (www.google.com)... 2a00:1450:401b:800::2004,
Connecting to http://www.google.com (www.google.com)|2a00:1450:401b:800::2004|:443... connected.
HTTP request sent, awaiting response... 200 OK

Elan Ruusamäe <glen>
Mon 20 Apr 2015 06:20:18 PM UTC, comment #2:

wget --version details (btw, Release: tag in bugreport i also specified the version):

GNU Wget 1.16.3 built on linux-gnu.

+digest +https +ipv6 +iri +large-file +nls +ntlm +opie +psl +ssl/openssl

/home/users/glen/.wgetrc (user)
/etc/wgetrc (system)
x86_64-pld-linux-gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/etc/wgetrc"
-DLOCALEDIR="/usr/share/locale" -I. -I../lib -I../lib
-I/usr/include/openssl -DHAVE_LIBSSL -DNDEBUG -O2 -fwrapv -pipe
-Wformat -Werror=format-security -gdwarf-4 -fno-debug-types-section
-fvar-tracking-assignments -g2 -Wp,-D_FORTIFY_SOURCE=2
-fstack-protector --param=ssp-buffer-size=4 -fPIC -march=x86-64
-gdwarf-4 -fno-debug-types-section -fvar-tracking-assignments -g2
x86_64-pld-linux-gcc -I/usr/include/openssl -DHAVE_LIBSSL -DNDEBUG
-O2 -fwrapv -pipe -Wformat -Werror=format-security -gdwarf-4
-fno-debug-types-section -fvar-tracking-assignments -g2
-Wp,-D_FORTIFY_SOURCE=2 -fstack-protector --param=ssp-buffer-size=4
-fPIC -march=x86-64 -gdwarf-4 -fno-debug-types-section
-fvar-tracking-assignments -g2 -Wl,--as-needed
-Wl,--no-copy-dt-needed-entries -Wl,-z,relro -Wl,-z,combreloc
-lpcre -luuid -lssl -lcrypto -lz -lpsl -lidn ftp-opie.o openssl.o
http-ntlm.o ../lib/libgnu.a

Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Originally written by Hrvoje Niksic <hniksic@xemacs.org>.
Please send bug reports and questions to <bug-wget@gnu.org>.

Elan Ruusamäe <glen>
Mon 20 Apr 2015 06:13:45 PM UTC, comment #1:

I am unable to reproduce this bug with Wget 1.16.3.

Running the commands provided, I can see that Wget successfully downloads the google.com home page.

However, I did notice that when the second header is empty, it has the side effect of deleting all custom headers from the request. That I would classify as a new bug.

Could you please provide more information about the environment you're running the commands in? The Operating System and locale being the most important. Also, kindly share the output of wget --version.

Darshit Shah <darnir>
Project Administrator
Mon 20 Apr 2015 06:02:49 PM UTC, original submission:

$ wget --header 'Content-Type:text/plain;charset=UTF-8' --header '' https://google.com
Segmentation fault

note, that this one does not crash:
$ wget --header '' https://google.com
--2015-04-20 20:51:11-- https://google.com/

so the first valid header is neccessary

looks like double-free, the trace is incomplete, but you'll get the idea:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff68ad874 in free () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff68ad874 in free () from /lib64/libc.so.6
#1 0x0000000000430719 in ?? ()
#2 0x0000000000421f98 in ?? ()
#3 0x0000000000422bff in ?? ()
#4 0x0000000000405f77 in ?? ()
#5 0x00007ffff68528a0 in __libc_start_main () from /lib64/libc.so.6
#6 0x00000000004072a9 in ?? ()

Elan Ruusamäe <glen>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -unavailable- added by rockdaboot (Updated the item)
  • -unavailable- added by darnir (Posted a comment)
  • -unavailable- added by glen (Submitted the item)

    Please enter the title of George Orwell's famous dystopian book (it's a date):



    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 20 Apr 2015 07:15:29 PM UTCrockdabootStatusNone=>Fixed

    Back to the top

    Powered by Savane 3.1-cleanup1