bugGNUstep - Bugs: bug #52331, use-after-free in the...

Group
 
 

bug #52331: use-after-free in the privateSetLocale function

Submitter:  Yavor Doganov <yavor>
Submitted:  Thu 02 Nov 2017 03:21:30 PM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  FredKiefer
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Sun 05 Nov 2017 12:34:52 PM UTC, comment #4: 


> The GNUstep repositories are now located at GitHub:


That is very unfortunate.

> This is mentioned on the GNUstep web site but maybe not
> prominent enough.


Yes, found it.  The last link under "Get it!" on the main page at gnustep.org is confusing: it points to a wiki.gnustep.org page with instructions for the old SVN repositories at gna.org. 

Thanks for fixing the bug, you can close this item.

Yavor Doganov <yavor>
Sun 05 Nov 2017 11:46:51 AM UTC, comment #3: 

The GNUstep repositories are now located at GitHub: https://github.com/gnustep
This is mentioned on the GNUstep web site but maybe not prominent enough.
Hopefully there will be a release of the core GNUstep components within the next few weeks.

Fred Kiefer <FredKiefer>
Group Member
Sun 05 Nov 2017 06:37:21 AM UTC, comment #2: 

Thanks, but could you please tell me where is the canonical repository?  Gna! is gone and it looks like there wasn't migration to Savannah.

Yavor Doganov <yavor>
Sat 04 Nov 2017 10:51:17 PM UTC, comment #1: 

Thank you very much for reporting this bug.
I just submitted a patch to the git repository. I was able to reproduce the issue with valgrind and with this patch the memory corruption is gone. Please test on your side as well.

Fred

Fred Kiefer <FredKiefer>
Group Member
Thu 02 Nov 2017 03:21:30 PM UTC, original submission:  

Jakub Wilk <jwilk@jwilk.net> reports via Debian (#880575):

GNUstep Base 1.25.0
Architecture: i386 (x86)

The privateSetLocale() function can use memory that has been already freed:

$ valgrind -q -- ./test-locale
  ==9722== Invalid read of size 1
  ==9722==    at 0x48313D8: strlen (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
  ==9722==    by 0x4A5FD89: i_NSString__initWithCString_encoding (NSString.m:1246)
  ==9722==    by 0x4A5CAB3: c_NSString__stringWithCString_encoding (NSString.m:954)
  ==9722==    by 0x48E2897: privateSetLocale (GSLocale.m:75)
  ==9722==    by 0x48E37CB: GSDefaultLanguageLocale (GSLocale.m:330)
  ==9722==    by 0x4A9BFCC: systemLanguages (NSUserDefaults.m:375)
  ==9722==    by 0x4A9BFCC: newLanguages (NSUserDefaults.m:397)
  ==9722==    by 0x4A9DF6D: _c_NSUserDefaults__standardUserDefaults (NSUserDefaults.m:928)
  ==9722==    by 0x10878E: main (test-locale.m:10)
  ==9722==  Address 0x7a78688 is 0 bytes inside a block of size 181 free'd
  ==9722==    at 0x482F478: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
  ==9722==    by 0x4E9CE77: setname (setlocale.c:201)
  ==9722==    by 0x4E9CE77: setlocale (setlocale.c:456)
  ==9722==    by 0x4B0D13D: GSPrivateNativeCStringEncoding (Unicode.m:2862)
  ==9722==    by 0x48E2891: privateSetLocale (GSLocale.m:75)
  ==9722==    by 0x48E37CB: GSDefaultLanguageLocale (GSLocale.m:330)
  ==9722==    by 0x4A9BFCC: systemLanguages (NSUserDefaults.m:375)
  ==9722==    by 0x4A9BFCC: newLanguages (NSUserDefaults.m:397)
  ==9722==    by 0x4A9DF6D: _c_NSUserDefaults__standardUserDefaults (NSUserDefaults.m:928)
  ==9722==    by 0x10878E: main (test-locale.m:10)
  ==9722==  Block was alloc'd at
  ==9722==    at 0x482E2BC: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
  ==9722==    by 0x4E9C998: new_composite_name (setlocale.c:172)
  ==9722==    by 0x4E9CF49: setlocale (setlocale.c:378)
  ==9722==    by 0x108742: main (test-locale.m:8)

This happens because it calls setlocale twice; once directly:

 clocale = setlocale(category, clocale);

and then again indirectly: ToString -> GSPrivateNativeCStringEncoding ->
setlocale.

The other call invalidates the clocale pointer, as allowed by POSIX:
"The returned string pointer might be invalidated or the string content
might be overwritten by a subsequent call to setlocale()."

Attaching the test program.  (FWIW, I can't reproduce on x86 and x86_64.)

Yavor Doganov <yavor>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #42321:  test-locale.m added by yavor (281B - text/x-objcsrc - Test program supposed to demonstrate the bug)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by FredKiefer (Posted a comment)
  • -email is unavailable- added by yavor (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-11-18 FredKiefer StatusReady For Test Fixed
        Open/ClosedIn Test Closed
    2017-11-04 FredKiefer StatusNone Ready For Test
        Assigned toNone FredKiefer
        Open/ClosedOpen In Test
    2017-11-02 yavor Attached File- Added test-locale.m, #42321

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code