bugGNU gettext - Bugs: bug #38930, _nl_find_msg: Pointer use after...

 
 

bug #38930: _nl_find_msg: Pointer use after free and callers that can't handle -1 return.

Submitted by:  Carlos O'Donell <codonell>
Submitted on:  Tue 07 May 2013 09:13:51 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Daiki Ueno <ueno>
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 06 Sep 2013 07:11:34 AM UTC, comment #3:

Merged now:
http://git.savannah.gnu.org/cgit/gettext.git/commit/?id=e3e7f521f2e6dd4043f26046ee80eb73572e86d7

Sorry for the delay.

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Tue 14 May 2013 04:49:21 AM UTC, comment #2:

I agree that glibc and gettext really need to stay in sync and we need to do that. It won't make the 2.18 freeze though as we have a lot of other things to work on. We should try to sync within the next 6-7 months.

I'm scared by the amount of divergence that was allowed to creep in on our side. I'm really sorry about that.

Carlos O'Donell <codonell>
Tue 14 May 2013 02:01:13 AM UTC, comment #1:

Thanks. Looks reasonable and I don't see any regression on non-glibc environement either.

As a new maintainer, I'm also wondering whether to sync the file between glibc and gettext. There seems already a significant difference between them. Maybe good to discuss it on the lists later.

Daiki Ueno <ueno>
Project AdministratorIn charge of this item.
Tue 07 May 2013 09:13:51 PM UTC, original submission:

The following two glibc bugs are also GNU gettext bugs and should be fixed in GNU gettext:

Firstly there is a use after free in _nl_find_msg, fixed by glibc BZ#14277:
http://sourceware.org/bugzilla/show_bug.cgi?id=14277

That introduced another bug where if malloc fails under high memory load we might have NULL dereference.

The null dereference and callers not handling -1 return are fixed with BZ#15441:
http://sourceware.org/bugzilla/show_bug.cgi?id=15441

I have copyright assignment from Red Hat.

I'm attaching a rebased patch against gettext master.

Compiles for me. Not tested except for with glibc.

Carlos O'Donell <codonell>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #28042:  gettext-upstream.diff added by codonell (4kB - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by ueno (Posted a comment)
  • -unavailable- added by codonell (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 06 Sep 2013 07:11:34 AM UTCuenoStatusConfirmed=>Fixed
      Assigned toNone=>ueno
      Open/ClosedOpen=>Closed
    Tue 14 May 2013 02:01:13 AM UTCuenoStatusNone=>Confirmed
    Tue 07 May 2013 09:13:51 PM UTCcodonellAttached File-=>Added gettext-upstream.diff, #28042

    Back to the top


    Powered by Savane 3.1-cleanup