bugGNU Wget - Bugs: bug #36823, wget crashing from memory...

 
 

bug #36823: wget crashing from memory corruption in idn functions

Submitted by:  None
Submitted on:  Tue 10 Jul 2012 07:00:14 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: None
Privacy: PublicAssigned to: None
Originator Name: Jason ContiOriginator Email: -unavailable-
Open/Closed: OpenRelease: 1.13.4
Operating System: GNU/LinuxReproducibility: Every Time
Fixed Release: NonePlanned Release: None
Regression: YesWork Required: None
Patch Included: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 10 Jul 2012 07:00:14 PM UTC, original submission:

Forwarding this bug upstream from:
https://bugs.launchpad.net/ubuntu/+source/wget/+bug/1022124

When mirroring a specific site (with wget -m), the user is experiencing a crash in wget 1.13.4 in malloc_consolidate(). wget 1.12 from a previous release does not exhibit the problem.

I have unfortunately not been able to reproduce the issue, but we've managed to track it down to a malformed script tag in all of the headers on the site:

<script src=”http://ajax.googleapis.com/ajax/libs/jquery/1.5/jquery.min.js”></script>

Note the curly quotes instead of ". There is a gdb backtrace available at:
https://bugs.launchpad.net/ubuntu/+source/wget/+bug/1022124/comments/5

and a valgrind log at:
https://bugs.launchpad.net/ubuntu/+source/wget/+bug/1022124/comments/8

which seems to point to a change to src/iri.c from commit 2f6aa1d7417df1dfc58597777686fbd77179b9fd:

diff --git a/src/iri.c b/src/iri.c
index 08cfde4..9b16639 100644
--- a/src/iri.c
+++ b/src/iri.c
@@ -264,6 +264,21 @@ remote_to_utf8 (struct iri i, const char str, const char **new)
if (!i->uri_encoding)
return false;

+ /* When `i->uri_encoding' == "UTF-8" there is nothing to convert. But we must
+ test for non-ASCII symbols for correct hostname processing in `idn_encode'
+ function. */
+ if (!strcmp (i->uri_encoding, "UTF-8"))
+ {
+ int i, len = strlen (str);
+ for (i = 0; i < len; i++)
+ if ((unsigned char) str[i] >= (unsigned char) '\200')
+ {
+ *new = strdup (str);
+ return true;
+ }
+ return false;
+ }
+
cd = iconv_open ("UTF-8", i->uri_encoding);
if (cd == (iconv_t)(-1))
return false;

We dropped the patch, rebuilt wget and haven't been able to reproduce the issue. I'm not really certain how best to fix the issue if this is indeed where the problem exists.

If any further information is required, I can request it on the launchpad bug (or information can be requested directly in the comments). Thanks for any help.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by None (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    No Changes Have Been Made to This Item

    Back to the top


    Powered by Savane 3.1-cleanup