bugfindutils - Bugs: bug #51841, find buffer-overflow with -printf...


bug #51841: find buffer-overflow with -printf '%T+'

Submitter:  Andreas Metzler <ametzler>
Submitted:  Thu 24 Aug 2017 05:54:37 PM UTC
Category:  find Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  berny
Originator Name:  Open/Closed:  Closed
Release:  None Fixed Release:  None
* Mandatory Fields

Add a New Comment Rich Markup

Jump to the original submission

Sat 09 Sep 2017 07:15:54 AM UTC, comment #9: 

Thanks, pushed - with minor nit in the commit message fixed:

- tests: Test more printf format specifiers.
+ tests: test more printf format specifiers


Bernhard Voelker <berny>
Group administrator
Fri 08 Sep 2017 05:22:36 PM UTC, comment #8: 


set env(TZ) "UTC" indeed works.
normal braces, not curly ones.

Thanks. Fixed patch attached.

(file #41763)

Andreas Metzler <ametzler>
Thu 07 Sep 2017 08:43:26 PM UTC, comment #7: 

Hmm, but this would change the time zone for all tests.
This works for me:

index 4d0fd28..a1e83de 100644
--- a/find/testsuite/find.gnu/printf.exp
+++ b/find/testsuite/find.gnu/printf.exp
@@ -3,5 +3,6 @@ exec mkdir tmp
 exec touch tmp/file
 exec chmod 600 tmp/file
 exec touch -d 1990-06-22T12:00Z tmp/file
+set env(TZ) "UTC"
 find_start p {tmp -type f -printf "a %d\n" -printf "b %f\n" -printf "c %h\n" -printf "d %H\n" -printf "e %l\n" -printf "f %m\n" -printf "g %n\n" -printf "h %p\n" -printf "i %P\n" -printf "j %y\n" -printf "k %Y\n" -printf "percent it%%works%%\n" -printf "string-right !%10p!\n" -printf "string-left !%-10p!\n" -printf "trunc-R !%10.6p!\n" -printf "trunc-L !%-10.6p!\n" -printf "a5 !%5d!\n" -printf "a05 !%05d!\n" -printf "a+ %+d\n" -printf "l1 %T+ %T@ TH=%TH TI=%TI TM=%TM TT=%TT Td=%Td TD=%TD Tj=%Tj Tm=%Tm TU=%TU Tw=%Tw TW=%TW Ty=%Ty TY=%TY\n"  -printf "l2 M=%M\n" -printf "l3 t=%t\n" -printf "l4 y=%y Y=%Y\n" }
 exec rm -rf tmp

Doesn't it for you as well?

Bernhard Voelker <berny>
Group administrator
Thu 07 Sep 2017 06:36:40 PM UTC, comment #6: 

Well actually there is a simple way:

--- a/find/testsuite/Makefile.am
+++ b/find/testsuite/Makefile.am
@@ -24,6 +24,8 @@ FINDFLAGS =

 DEJATOOL = find

+export TZ = UTC

I'll post an updated patch.

cu Andreas

Andreas Metzler <ametzler>
Wed 06 Sep 2017 05:51:20 PM UTC, comment #5: 

On 2017-09-06 Bernhard Voelker &lt;INVALID.NOREPLY@gnu.org&gt; wrote:
&gt; It seems they fail here:
&gt; -l1 1990-06-22+14:00:00.0000000000 646056000.0000000000 [...]
&gt; +l1 1990-06-22+12:00:00.0000000000 646056000.0000000000 [...]

&gt; The expected output for '%T+' depends on the local timezone.
&gt; As the next part '%T@' is output in GMT, maybe it would work
&gt; if you set TZ to the same?


actually I had been wondering why the tests worked since my TZ is !=  UTC and assumed the testsuite already used a sanitized TZ. Well I realized that the chroot was using TZ=UTC. :-(

Anyway, yes that is exactly the fix that needs to be done.
env TZ=UTC make check
would work.

However I am failing at changing find's environment in the testsuite. Any idea?

What fails:
1) adding this to the top of find/testsuite/find.gnu/printf.exp
global env;
set env{TZ} &quot;UTC&quot;

2) modifying find/testsuite/config/unix.exp
--- a/find/testsuite/config/unix.exp
+++ b/find/testsuite/config/unix.exp
@@ -27,6 +27,7 @@ global FTSFIND
 verbose &quot;base_dir is $base_dir&quot; 2
 global env;
 set env(GNU_FINDUTILS_FD_LEAK_CHECK) &quot;1&quot;
+set env{TZ} &quot;UTC&quot;

cu Andreas

Andreas Metzler <ametzler>
Wed 06 Sep 2017 06:12:39 AM UTC, comment #4: 

Thanks for the tests.

It seems they fail here:
-l1 1990-06-22+14:00:00.0000000000 646056000.0000000000 [...]
+l1 1990-06-22+12:00:00.0000000000 646056000.0000000000 [...]

The expected output for '%T+' depends on the local timezone.
As the next part '%T@' is output in GMT, maybe it would work
if you set TZ to the same?

Have a nice day,

Bernhard Voelker <berny>
Group administrator
Sat 02 Sep 2017 01:21:24 PM UTC, comment #3: 


find attached a patch to check %T* (limited to strftime sequences mandated by POSIX), %M, %t, %y, and %Y in the testsuite.

Works for me (on Debian GNU/Linux).

cu Andreas

(file #41718)

Andreas Metzler <ametzler>
Mon 28 Aug 2017 09:17:57 PM UTC, comment #2: 

Thanks for the suggestion - I wrapped it into a patch,
and intend to push soon.

(file #41691)

Bernhard Voelker <berny>
Group administrator
Fri 25 Aug 2017 11:01:53 AM UTC, comment #1: 

I think that both the bug and the fix are obvious.  After the mentioned patch,
the code writes 12 bytes into a stack-allocated array of size 6 bytes:

  char fmt[6];

  // [...]

  /* Format the main part of the time. */
  if (kind == '+')
      /* Avoid %F, some Unix versions lack it.  For example:
         HP Tru64 UNIX V5.1B (Rev. 2650); Wed Feb 17 22:59:59 CST 2016
         Also, some older HP-UX versions expand %F as the full month (like %B).
         Reported by Steven M. Schweda <sms@antinode.info> */
      strcpy (fmt, "%Y-%m-%d+%T");

I believe that increasing size of the fmt array to 12 bytes will fix the bug.

Kamil Dudka <kdudka>
Thu 24 Aug 2017 05:54:37 PM UTC, original submission:  


this is https://bugs.debian.org/873032 reported by Ryan <ryan@ddn.com>:
The findutils/find version now in buster 4.6.0+git+20170729-2 fails when I use find with -printf '%T+'.  If I change the time format away from + to @, it works fine.

Example bad run:
➜  find . -mindepth 1 -maxdepth 1 -printf '%T+=%p\n'
* buffer overflow detected *: find terminated
======= Backtrace: =========
======= Memory map: ========
558ab5da3000-558ab5ddb000 r-xp 00000000 fe:01 6554946                    /usr/bin/find
558ab5fdb000-558ab5fdd000 r--p 00038000 fe:01 6554946                    /usr/bin/find
558ab5fdd000-558ab5fde000 rw-p 0003a000 fe:01 6554946                    /usr/bin/find
558ab5fde000-558ab5fdf000 rw-p 00000000 00:00 0
558ab6b5b000-558ab6b7c000 rw-p 00000000 00:00 0                          [heap]
7efe9644e000-7efe96464000 r-xp 00000000 fe:01 6422603                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96464000-7efe96663000 ---p 00016000 fe:01 6422603                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96663000-7efe96664000 r--p 00015000 fe:01 6422603                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96664000-7efe96665000 rw-p 00016000 fe:01 6422603                    /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96665000-7efe9667d000 r-xp 00000000 fe:01 6422812                    /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9667d000-7efe9687c000 ---p 00018000 fe:01 6422812                    /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687c000-7efe9687d000 r--p 00017000 fe:01 6422812                    /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687d000-7efe9687e000 rw-p 00018000 fe:01 6422812                    /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687e000-7efe96882000 rw-p 00000000 00:00 0
7efe96882000-7efe96884000 r-xp 00000000 fe:01 6422773                    /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96884000-7efe96a84000 ---p 00002000 fe:01 6422773                    /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a84000-7efe96a85000 r--p 00002000 fe:01 6422773                    /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a85000-7efe96a86000 rw-p 00003000 fe:01 6422773                    /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a86000-7efe96af8000 r-xp 00000000 fe:01 6422696                    /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96af8000-7efe96cf7000 ---p 00072000 fe:01 6422696                    /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf7000-7efe96cf8000 r--p 00071000 fe:01 6422696                    /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf8000-7efe96cf9000 rw-p 00072000 fe:01 6422696                    /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf9000-7efe96e8c000 r-xp 00000000 fe:01 6422769                    /lib/x86_64-linux-gnu/libc-2.24.so
7efe96e8c000-7efe9708c000 ---p 00193000 fe:01 6422769                    /lib/x86_64-linux-gnu/libc-2.24.so
7efe9708c000-7efe97090000 r--p 00193000 fe:01 6422769                    /lib/x86_64-linux-gnu/libc-2.24.so
7efe97090000-7efe97092000 rw-p 00197000 fe:01 6422769                    /lib/x86_64-linux-gnu/libc-2.24.so
7efe97092000-7efe97096000 rw-p 00000000 00:00 0
7efe97096000-7efe97199000 r-xp 00000000 fe:01 6422783                    /lib/x86_64-linux-gnu/libm-2.24.so
7efe97199000-7efe97398000 ---p 00103000 fe:01 6422783                    /lib/x86_64-linux-gnu/libm-2.24.so
7efe97398000-7efe97399000 r--p 00102000 fe:01 6422783                    /lib/x86_64-linux-gnu/libm-2.24.so
7efe97399000-7efe9739a000 rw-p 00103000 fe:01 6422783                    /lib/x86_64-linux-gnu/libm-2.24.so
7efe9739a000-7efe973bf000 r-xp 00000000 fe:01 6422612                    /lib/x86_64-linux-gnu/libselinux.so.1
7efe973bf000-7efe975be000 ---p 00025000 fe:01 6422612                    /lib/x86_64-linux-gnu/libselinux.so.1
7efe975be000-7efe975bf000 r--p 00024000 fe:01 6422612                    /lib/x86_64-linux-gnu/libselinux.so.1
7efe975bf000-7efe975c0000 rw-p 00025000 fe:01 6422612                    /lib/x86_64-linux-gnu/libselinux.so.1
7efe975c0000-7efe975c2000 rw-p 00000000 00:00 0
7efe975c2000-7efe975e5000 r-xp 00000000 fe:01 6422605                    /lib/x86_64-linux-gnu/ld-2.24.so
7efe97629000-7efe977c4000 r--p 00000000 fe:01 6567535                    /usr/lib/locale/locale-archive
7efe977c4000-7efe977c9000 rw-p 00000000 00:00 0
7efe977e1000-7efe977e5000 rw-p 00000000 00:00 0
7efe977e5000-7efe977e6000 r--p 00023000 fe:01 6422605                    /lib/x86_64-linux-gnu/ld-2.24.so
7efe977e6000-7efe977e7000 rw-p 00024000 fe:01 6422605                    /lib/x86_64-linux-gnu/ld-2.24.so
7efe977e7000-7efe977e8000 rw-p 00000000 00:00 0
7ffda1b71000-7ffda1b92000 rw-p 00000000 00:00 0                          [stack]
7ffda1bf8000-7ffda1bfb000 r--p 00000000 00:00 0                          [vvar]
7ffda1bfb000-7ffda1bfd000 r-xp 00000000 00:00 0                          [vdso]
[1]    29180 abort      find . -mindepth 1 -maxdepth 1 -printf '%T+=%p\n'

Reproducing requires building find with -D_FORTIFY_SOURCE=2 in CPPFLAGS. I have bisected the issue, the point of breakage is not very surprising:

95816b29d46fb6b64754d4a66e7d918b3f134a1f is the first bad commit
commit 95816b29d46fb6b64754d4a66e7d918b3f134a1f
Author: James Youngman <jay@gnu.org>
Date:   Sun Jul 23 22:19:42 2017 +0100

    find: avoid strftime's non-portable %F specifier.

    * find/print.c (format_date): Avoid passing %F to strftime since
    some implementation lack it.  Pass the synonymous %Y-%m-%d
    instead.  This fixes a bug manifesting on HP Tru64 UNIX V5.1B.
    Reported by Steven M. Schweda <sms@antinode.info>.

cu Andreas

Andreas Metzler <ametzler>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

Attached Files
file #41763:  works_nonUTC_Test-more-printf-format-specifiers.patch added by ametzler (3KiB - text/x-diff - patch fixed for non-UTC)
file #41718:  0001-tests-Test-more-printf-format-specifiers.patch added by ametzler (2KiB - text/x-diff - Add coverage for %T (and more))
file #41691:  0001-find-avoid-buffer-overflow-with-printf-T.patch added by berny (1KiB - text/x-patch - [PATCH] find: avoid buffer-overflow with -printf '%T+')


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by jay (Updated the item)
  • -email is unavailable- added by berny (Updated the item)
  • -email is unavailable- added by kdudka (Posted a comment)
  • -email is unavailable- added by ametzler (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-08-29 jay Open/ClosedOpen Closed
    2017-09-08 ametzler Attached File- Added works_nonUTC_Test-more-printf-format-specifiers.patch, #41763
    2017-09-02 ametzler Attached File- Added 0001-tests-Test-more-printf-format-specifiers.patch, #41718
    2017-08-28 berny Attached File- Added 0001-find-avoid-buffer-overflow-with-printf-T.patch, #41691
        StatusNone Fixed
        Assigned toNone berny

    Back to the top

    Powered by Savane 3.13-04b1.
    Corresponding source code