bugGNU Wget - Bugs: bug #47882, progress: wget crashes with narrow...


bug #47882: progress: wget crashes with narrow terminal

Submitted by:  Jeff Bai <jeffbai>
Submitted on:  Tue 10 May 2016 03:50:13 AM UTC  
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  Darshit Shah <darnir>
Originator Name:  Open/Closed:  Closed
Release:  1.17.1 Operating System:  GNU/Linux
Reproducibility:  Every Time Fixed Release:  trunk
Planned Release:  None Regression:  Yes
Work Required:  None Patch Included:  No

Add a New Comment (Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Tue 10 May 2016 05:31:03 AM UTC, comment #3: 

Hi Jeff,

Thanks for the bug report. This bug with negative values being sent to memset has already been reported and fixed. The fix is available in the current git tree at commit: 7099f48.

The patches will be available in the next release of Wget. Till then Arch Linux is free to cherry pick and apply the patch on their version of 1.17.1. Else, you could also use wget-git from the AUR which has these fixes and more.

Do let us know if there are any more issues you've encountered

Darshit Shah <darnir>
Project AdministratorIn charge of this item.
Tue 10 May 2016 04:06:21 AM UTC, comment #2: 

A proposed patch by huntxu <mhuntxu AT gmail dot com>, his original comment is as follows:

The three lines [in the problematic commit] did not check if size of padding would be negative, and memset() therefore fails with a negative value.

diff --git a/src/progress.c b/src/progress.c
index 93f6246..3798ef6 100644
--- a/src/progress.c
+++ b/src/progress.c
@@ -1164,8 +1164,10 @@ create_image (struct bar_progress *bp, double dl_total_time, bool done)

   padding = bp->width - count_cols (bp->buffer);
-  memset (p, ' ', padding);
-  p += padding;
+  if (padding > 0) {
+    memset (p, ' ', padding);
+    p += padding;
+  }
   *p = '\0';

   /* 2014-11-14  Darshit Shah  <darnir@gmail.com>

Jeff Bai <jeffbai>
Tue 10 May 2016 04:03:56 AM UTC, comment #1: 

Forgot to mention that this bug does not necessarily need CJK or multi-width character(s) to trigger, all it takes is a narrow terminal.

Jeff Bai <jeffbai>
Tue 10 May 2016 03:50:13 AM UTC, original submission:  

Just a recent discovery with folks at #archlinux-cn, that wget 1.17.1 would crash on this command.

wget '中文中文中文中文'

A case of address containing multi-width characters, wget would crash with SIGSEGV and dumps core. The program crashes on memset() in libc.so. I can provide a complete backtrace once requested.

A simple git bisect leads us to this commit: http://git.savannah.gnu.org/cgit/wget.git/commit/?id=9933da2b9fdeddfc94859192438071bab7e467b2

Reverting this commit resolves the issue, just thought that this would help locating the problematic commit. There is also an issue with output file name encoding, with the same command above.

jeffbai [ ~ ] $ wget '中文中文中文中文'
--2016-05-09 21:48:46--
正在连接 已连接。
已发出 HTTP 请求,正在等待回应... 200 没有 HTTP 头,假定为 HTTP/0.9
正在保存至: “中\346%96%87中\346%96%87中\346%96%87中\346%96%87”

中�%96%87中�%96%87中�%96%     [ <=>                                    ]     113  --.-KB/s  用时 0s 

2016-05-09 21:48:47 (15.8 MB/s) - “中\346%96%87中\346%96%87中\346%96%87中\346%96%87” 已保存 [113]

As you can see, the file name requested, "中文中文中文中文" is output'd to a completely different one, "中\346%96%87中\346%96%87中\346%96%87中\346%96%87". I will open up a separate bug report for this.

Jeff Bai <jeffbai>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by darnir (Posted a comment)
  • -email is unavailable- added by jeffbai (Submitted the item)



    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2016-05-26 darnir StatusConfirmed => Fixed
        Open/ClosedOpen => Closed
    2016-05-10 darnir StatusNone => Confirmed
        Assigned toNone => darnir
        ReproducibilityIntermittent => Every Time
        Fixed ReleaseNone => trunk

    Back to the top

    Powered by Savane 3.5