bugGNU Wget - Bugs: bug #46620, NULL Point Dereference casing...

 
 

bug #46620: NULL Point Dereference casing SegFault in hsts_hash_func in 1.17

Submitter:  Claudio Guarnieri <nex>
Submitted:  Sun 06 Dec 2015 10:54:20 PM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Originator Name:  Open/Closed:  Closed
Release:  1.17 Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  trunk
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  No
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 07 Dec 2015 08:33:08 AM UTC, comment #3: 

This issue has been fixed on 18th Nov in commit 99aa7b4f5e13a30e04d4410e98bbb81780e74f09.

The only work-around I know of is disabling HSTS (--no-hsts).

Thanks for reporting anyway.

Tim Ruehsen <rockdaboot>
Group administrator
Sun 06 Dec 2015 11:01:31 PM UTC, comment #2: 

Here, hope it helps.
Apologies for the typos in the original message.

$ gdb --args ./wget https://godzilla.seedboxes.cc
(gdb) r
Starting program: /tmp/wget-1.17/src/wget https://godzilla.seedboxes.cc
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
--2015-12-06 23:59:22--  https://godzilla.seedboxes.cc/
Resolving godzilla.seedboxes.cc... 188.122.93.226, 2a00:1630:44:803::1
Connecting to godzilla.seedboxes.cc|188.122.93.226|:443... connected.
HTTP request sent, awaiting response... 200 OK

Program received signal SIGSEGV, Segmentation fault.
0x0000000000418541 in hsts_hash_func (key=0xb98720) at hsts.c:95
95   for (h = k->host; *h; h++)

Claudio Guarnieri <nex>
Sun 06 Dec 2015 10:57:37 PM UTC, comment #1: 

If you're seeing repeated and reproduceable issue, would you please provide an example command line that shows the issue?

Such examples are often very useful in identifying the use case and program path.

Darshit Shah <darnir>
Group administrator
Sun 06 Dec 2015 10:54:20 PM UTC, original submission:  

While making some requests to a site with SSL/TLS transport enabled, I'm experiencing repeated segmentation faults with version 1.17, both compiled manually as well as packaged in Debian testing.

I am able to reproduce it at every execution, and others experienced the same issue with compiled 1.17 on Ubuntu.

[code]#0  0x0000000000418541 in hsts_hash_func (key=0xb989b0) at hsts.c:95
#1  0x000000000041695c in find_cell (ht=0x69f470, key=0xb989b0) at hash.c:321
#2  0x0000000000416d4e in hash_table_remove (ht=0x69f470, key=0xb989b0) at hash.c:454
#3  0x00000000004189dc in hsts_remove_entry (store=0x682970, kh=0xb989b0) at hsts.c:239
#4  0x0000000000418f6a in hsts_store_entry (store=0x682970, scheme=SCHEME_HTTPS,
    host=0x682e50 "[REDACTED]", port=0, max_age=0, include_subdomains=true) at hsts.c:425
#5  0x00000000004223aa in gethttp (u=0x69f370, hs=0x7fffffffde50, dt=0x7fffffffe1a4, proxy=0x0,
    iri=0x680a40 <dummy_iri>, count=1) at http.c:3405
#6  0x0000000000423a59 in http_loop (u=0x69f370, original_url=0x69f370, newloc=0x7fffffffdfe8,
    local_file=0x7fffffffdfd8, referer=0x0, dt=0x7fffffffe1a4, proxy=0x0, iri=0x680a40 <dummy_iri>) at http.c:3979
#7  0x0000000000432b7d in retrieve_url (orig_parsed=0x69f370,
    origurl=0x69f3e0 "https://[REDACTED]", file=0x7fffffffe1b0, newloc=0x7fffffffe1a8, refurl=0x0, dt=0x7fffffffe1a4,
    recursive=false, iri=0x680a40 <dummy_iri>, register_status=true) at retr.c:817
#8  0x000000000042bc5b in main (argc=2, argv=0x7fffffffe388) at main.c:1860[/code]

Claudio Guarnieri <nex>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rockdaboot (Posted a comment)
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by nex (Submitted the item)
  •  

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-12-07 rockdaboot StatusNone Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone trunk

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code