bugGNUstep - Bugs: bug #37596, NSXMLParser.m randomly crashes on...

Group
 
 

bug #37596: NSXMLParser.m randomly crashes on parsing strings

Submitter:  Sebastian Reitenbach <buzzdee>
Submitted:  Thu 18 Oct 2012 04:47:29 PM UTC
   
 
Category:  Base/Foundation Severity:  4 - Important
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 19 Oct 2012 07:11:55 AM UTC, comment #3: 

I coded a fix before I noticed your patch, but looking at it they seem very similar (the functional difference being that I tried to check that we don't read past the end of the buffer ... rarely a problem, but can could a crash).  There's a chance I made a fencepost error in the length of data to copy, so some testing that things still work, and a second pair of eyes on the code would be good.

Richard Frith-Macdonald <CaS>
Group Member
Fri 19 Oct 2012 07:04:53 AM UTC, comment #2: 

I've seen it happen only once. Trying to reproduce it, may be tricky, since I don't have direct control of the garbage of the stack ;)

Anyways, I'll try it, and will see. At least from looking at the code it looks fine to me, just a different solution to the problem.

thanks,
Sebastian

Sebastian Reitenbach <buzzdee>
Group Member
Thu 18 Oct 2012 09:47:18 PM UTC, comment #1: 

I attempted a fix, but I don't have any test code ... please could you try it and see if I messed up.

Richard Frith-Macdonald <CaS>
Group Member
Thu 18 Oct 2012 04:47:29 PM UTC, original submission:  

-[NSXMLParser _parseEntity:] gives a not NULL terminated string to sscanf which may crash, depending on the garbage on the stack, due to the fact that the string is not NULL terminated. At least seen on OpenBSD.

Its the similar problem we've seen with simplewebkits NSXMLParser. Attached patch uses the same solution Nikolaus proposed for simplewebkits NSXMLParser.

Here is a backtrace from MPDCon:

(gdb) bt
#0  0x0aba5c33 in strlen (
    str=0x8376568f "039;t notice\nDon&#039;t even sound I&#039;m coming\nSoon you&#039;ll have a .. Everyw[...]</lyrics>\n\t<url>http://lyrics.w0</page_namespac"...) at /usr/src/lib/libc/string/strlen.c:43
#1  0x0ab332c1 in sscanf (
    str=0x8376568f "039;t notice\nDon&#039;t even sound I&#039;m coming\nSoon you&#039;ll have a .. Everyw[...]</lyrics>\n\t<url>http://lyrics.w0</page_namespac"..., fmt=0x203e0481 "x%x;") at /usr/src/lib/libc/stdio/sscanf.c:59
#2  0x005796a6 in -[NSXMLParser _parseEntity:] (self=0x8224e8a4, _cmd=0x20464f38, result=0xcfbcc768) at NSXMLParser.m:1388
#3  0x0057aa24 in -[NSXMLParser parse] (self=0x8224e8a4, _cmd=0x3c011bb8) at NSXMLParser.m:1679
#4  0x1c012d90 in -[LyricsInspector updateLyrics] (self=0x87e7b984, _cmd=0x3c011b30) at LyricsInspector.m:240
#5  0x1c012878 in -[LyricsInspector songChanged:] (self=0x87e7b984, _cmd=0x3c011b20, aNotif=0x857b3504) at LyricsInspector.m:210
#6  0x004af9ee in -[NSNotificationCenter _postAndRelease:] (self=0x81febaa4, _cmd=0x2042a828, notification=0x857b3504) at NSNotificationCenter.m
#7  0x004aefeb in -[NSNotificationCenter postNotification:] (self=0x81febaa4, _cmd=0x3c003128, notification=0x857b3504) at NSNotificationCenter.
#8  0x1c003f8a in -[AppController(Private) _updateView:] (self=0x8a143484, _cmd=0x3c003078, sender=0x87e88d04) at AppController.m:585
#9  0x004c33a8 in -[NSObject performSelector:withObject:] (self=0x8a143484, _cmd=0x2044d648, aSelector=0x3c003078, anObject=0x87e88d04) at NSObj
#10 0x00538786 in -[NSTimer fire] (self=0x87e88d04, _cmd=0x20440bf8) at NSTimer.m:258
#11 0x00507d69 in -[NSRunLoop limitDateForMode:] (self=0x84592da4, _cmd=0x20440c58, mode=0x20440cb0) at NSRunLoop.m:1016
#12 0x0050427e in -[NSRunLoop runMode:beforeDate:] (self=0x84592da4, _cmd=0x200f1720, mode=0x20440cb0, date=0x86793224) at NSRunLoop.m:1255
#13 0x0029d341 in -[GSDisplayServer(EventOps) getEventMatchingMask:beforeDate:inMode:dequeue:] (self=0x8bb17c04, _cmd=0x2a9b21d8, mask=429496729
    at GSDisplayServer.m:999
#14 0x0a9d084e in __objc_xgcontextevent_linking () from /usr/local/lib/GNUstep/Bundles/libgnustep-back-022.bundle/./libgnustep-back-022
#15 0x000e7dcf in -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] (self=0x86687084, _cmd=0x2003e0e8, mask=4294967295, expiratio
    at NSApplication.m:2173
#16 0x000e5afb in -[NSApplication run] (self=0x86687084, _cmd=0x20033ee8) at NSApplication.m:1559
#17 0x000c4733 in NSApplicationMain (argc=1, argv=0xcfbccffc) at Functions.m:95
#18 0x1c013cf4 in gnustep_base_user_main (argc=1, argv=0xcfbccffc) at main.m:30
#19 0x004f341e in main (argc=1, argv=Cannot access memory at address 0x4
) at NSProcessInfo.m:984
#20 0x1c003037 in ___start (argc=1, argv=0xcfbccffc, envp=0xcfbcd004, cleanup=0, obj=0x0, ps_strings=0xcfbfdff0) at /usr/src/lib/csu/i386/crt0.c
#21 0x1c002fb2 in _start () at /usr/src/lib/csu/i386/crt0.c:77
(gdb) frame 2
#2  0x005796a6 in -[NSXMLParser _parseEntity:] (self=0x8224e8a4, _cmd=0x20464f38, result=0xcfbcc768) at NSXMLParser.m:1388
1388          if (sscanf((char *)ep+1, "x%x;", &val))
Current language:  auto; currently minimal

Sebastian Reitenbach <buzzdee>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #26787:  patch-Source_NSXMLParser_m added by buzzdee (918B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by rmottola (Updated the item)
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by buzzdee (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-01-15 rmottola Open/ClosedIn Test Closed
    2012-10-18 CaS StatusNone Fixed
        Open/ClosedOpen In Test
    2012-10-18 buzzdee Attached File- Added patch-Source_NSXMLParser_m, #26787

    Back to the top

    Powered by Savane 3.13-3230.
    Corresponding source code