bugGNU patch - Bugs: bug #45248, Invalid free() with corrupt patch

 
 

bug #45248: Invalid free() with corrupt patch

Submitter:  None
Submitted:  Wed 03 Jun 2015 05:09:04 PM UTC
   
 
Category:  Parser / Internal Representation Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Mon 19 Aug 2019 10:19:22 PM UTC, comment #2: 

I cannot reproduce this with patch-2.5, patch-2.7.[456], or the current master branch.  On master, the bug doesn't even trigger with the address sanitizer on though, which should be a good indication that the bug is indeed fixed.  Because of that, let's close this bug.

Andreas Gruenbacher <agruen>
Group administrator
Mon 19 Aug 2019 09:23:30 PM UTC, comment #1: 

This this still a problem you have? I tried the attached example file and it doesn't crash for me. There is a comment in the code about avoiding bad free() calls, but I'm not sure if it is response to this issue or another.

Can you confirm if this bug still exists for you?

Jesse <newguy>
Wed 03 Jun 2015 05:09:04 PM UTC, original submission:  

In the function `another_hunk`, `p_end` can be set incorrectly high by an invalid patch file. `another_hunk` loops down from `p_end`, performing `free(p_line[p_end])`. Because this frees whatever is beyond `p_line`, the behavior is not deterministic (i.e. it may not crash for you). This could pose a security vulnerability.

I am not an expert in the codebase or the patch format so the bug may be obvious to the maintainers. Otherwise, I can do some further analysis of the bug.

-Edward Williamson (edwillia AT andrew.cmu.edu)

(gdb) r --dry-run < free_segfault
Starting program: /home/ned/dev/patch/src/patch --dry-run < free_segfault
checking file 0

Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x20a61) at malloc.c:2929
2929 malloc.c: No such file or directory.
(gdb) bt
#0  __GI___libc_free (mem=0x20a61) at malloc.c:2929
#1  0x0000000000409150 in another_hunk (difftype=CONTEXT_DIFF, rev=false) at pch.c:1184
#2  0x000000000040337a in main (argc=<optimized out>, argv=<optimized out>) at patch.c:390

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #34155:  free_segfault added by None (35B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by newguy (Posted a comment)
  • -email is unavailable- added by agruen (Updated the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-08-19 agruen StatusNone Fixed
        Open/ClosedOpen Closed
    2019-07-28 agruen CategoryNone Parser / Internal Representation
    2015-06-03 None Attached File- Added free_segfault, #34155

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code