mainThe GNU Bourne-Again SHell - Support: sr #109404, Dumping binary to shell causes...

 
 

sr #109404: Dumping binary to shell causes memory corruption.

Submitter:  None
Submitted:  Wed 25 Oct 2017 01:07:29 AM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  4 - Important Status:  Need Info
Privacy:  Public Assigned to:  None
Originator Email:  -email is unavailable- Open/Closed:  Open
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 07 Nov 2017 09:57:57 PM UTC, comment #1: 

Unfortunately, it's not reproducible.

Chet Ramey <chet>
Group administrator
Wed 25 Oct 2017 01:07:29 AM UTC, original submission:  

rz crashed, resulting in sz dumping a big blob of binary into my shell, resulting in memory corruption and crash.

Unfortunately bash's own outputs stepped on a bunch of the binary so copy-pasting it again doesn't reproduce the crash.


Configuration Information [Automatically generated, do not change]:
Machine: x86_64
OS: linux-gnu
Compiler: x86_64-pc-linux-gnu-gcc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='x86_64' -DCONF_OSTYPE='linux-gnu' -DCONF_MACHTYPE='x86_64-pc-linux-gnu' -DCONF_VENDOR='pc' -DLOCALEDIR='/usr/share/locale' -DPACKAGE='bash' -DSHELL -DHAVE_$
uname output: Linux hercules 4.9.34-gentoo #1 SMP Mon Jul 3 13:01:41 PDT 2017 x86_64 Intel(R) Xeon(R) CPU E5-2620 0 @ 2.00GHz GenuineIntel GNU/Linux
Machine Type: x86_64-pc-linux-gnu

Bash Version: 4.3
Patch Level: 48
Release Status: release



glibc version 2.23-r4



laurence@hercules /tmp $tR.kI=i���I,��乲h��}X>w��Fap{'����U�y�L��*1y"S�CEĊg�u9x;�W�*** Error in `-bash': malloc(): smallbin double linked list corrupted: 0x000000000144a4a0 *
======= Backtrace: =========
/lib64/libc.so.6(+0x6f273)[0x7fec5ffdd273]
/lib64/libc.so.6(+0x748e6)[0x7fec5ffe28e6]
/lib64/libc.so.6(+0x76be5)[0x7fec5ffe4be5]
/lib64/libc.so.6(__libc_malloc+0x78)[0x7fec5ffe6898]
-bash[0x46fe43]
-bash[0x470531]
-bash[0x4443de]
-bash[0x44ea1a]
/lib64/libreadline.so.6(rl_completion_matches+0x96)[0x7fec605849a6]
-bash[0x452725]
-bash[0x452b91]
/lib64/libreadline.so.6(+0x1fa97)[0x7fec60584a97]
/lib64/libreadline.so.6(rl_complete_internal+0x132)[0x7fec60584c72]
/lib64/libreadline.so.6(_rl_dispatch_subseq+0x248)[0x7fec6057bf88]
/lib64/libreadline.so.6(readline_internal_char+0xa2)[0x7fec6057c432]
/lib64/libreadline.so.6(readline+0x55)[0x7fec6057cbd5]
-bash[0x40a5e5]
-bash[0x40c771]
-bash[0x40f60a]
-bash[0x412c04]
-bash[0x409f2b]
-bash[0x409ff8]
-bash[0x40a1d9]
-bash[0x408ae4]
/lib64/libc.so.6(__libc_start_main+0xf0)[0x7fec5ff8e790]
-bash[0x4094c9]
======= Memory map: ========
00400000-004ab000 r-xp 00000000 00:13 2527182                            /bin/bash
006aa000-006ab000 r--p 000aa000 00:13 2527182                            /bin/bash
006ab000-006af000 rw-p 000ab000 00:13 2527182                            /bin/bash
006af000-006b9000 rw-p 00000000 00:00 0
0140f000-0146a000 rw-p 00000000 00:00 0                                  [heap]
7fec58000000-7fec58021000 rw-p 00000000 00:00 0
7fec58021000-7fec5c000000 ---p 00000000 00:00 0
7fec5f50c000-7fec5f522000 r-xp 00000000 00:13 5129052                    /usr/lib64/gcc/x86_64-pc-linux-gnu/5.4.0/libgcc_s.so.1
7fec5f522000-7fec5f721000 ---p 00016000 00:13 5129052                    /usr/lib64/gcc/x86_64-pc-linux-gnu/5.4.0/libgcc_s.so.1
7fec5f721000-7fec5f722000 r--p 00015000 00:13 5129052                    /usr/lib64/gcc/x86_64-pc-linux-gnu/5.4.0/libgcc_s.so.1
7fec5f722000-7fec5f723000 rw-p 00016000 00:13 5129052                    /usr/lib64/gcc/x86_64-pc-linux-gnu/5.4.0/libgcc_s.so.1
7fec5f739000-7fec5f743000 r-xp 00000000 00:13 2442803                    /lib64/libnss_files-2.23.so
7fec5f743000-7fec5f942000 ---p 0000a000 00:13 2442803                    /lib64/libnss_files-2.23.so
7fec5f942000-7fec5f943000 r--p 00009000 00:13 2442803                    /lib64/libnss_files-2.23.so
7fec5f943000-7fec5f944000 rw-p 0000a000 00:13 2442803                    /lib64/libnss_files-2.23.so
7fec5f944000-7fec5f94e000 r-xp 00000000 00:13 2442973                    /lib64/libnss_nis-2.23.so
7fec5f94e000-7fec5fb4d000 ---p 0000a000 00:13 2442973                    /lib64/libnss_nis-2.23.so
7fec5fb4d000-7fec5fb4e000 r--p 00009000 00:13 2442973                    /lib64/libnss_nis-2.23.so
7fec5fb4e000-7fec5fb4f000 rw-p 0000a000 00:13 2442973                    /lib64/libnss_nis-2.23.so
7fec5fb4f000-7fec5fb63000 r-xp 00000000 00:13 2442903                    /lib64/libnsl-2.23.so
7fec5fb63000-7fec5fd62000 ---p 00014000 00:13 2442903                    /lib64/libnsl-2.23.so
7fec5fd62000-7fec5fd63000 r--p 00013000 00:13 2442903                    /lib64/libnsl-2.23.so
7fec5fd63000-7fec5fd64000 rw-p 00014000 00:13 2442903                    /lib64/libnsl-2.23.so
7fec5fd64000-7fec5fd66000 rw-p 00000000 00:00 0
7fec5fd66000-7fec5fd6d000 r-xp 00000000 00:13 2443010                    /lib64/libnss_compat-2.23.so
7fec5fd6d000-7fec5ff6c000 ---p 00007000 00:13 2443010                    /lib64/libnss_compat-2.23.so
7fec5ff6c000-7fec5ff6d000 r--p 00006000 00:13 2443010                    /lib64/libnss_compat-2.23.so
7fec5ff6d000-7fec5ff6e000 rw-p 00007000 00:13 2443010                    /lib64/libnss_compat-2.23.so
7fec5ff6e000-7fec600fe000 r-xp 00000000 00:13 2443174                    /lib64/libc-2.23.so
7fec600fe000-7fec602fd000 ---p 00190000 00:13 2443174                    /lib64/libc-2.23.so
7fec602fd000-7fec60301000 r--p 0018f000 00:13 2443174                    /lib64/libc-2.23.so
7fec60301000-7fec60303000 rw-p 00193000 00:13 2443174                    /lib64/libc-2.23.so
7fec60303000-7fec60307000 rw-p 00000000 00:00 0
7fec60307000-7fec6035f000 r-xp 00000000 00:13 2458719                    /lib64/libncurses.so.6.0
7fec6035f000-7fec6055f000 ---p 00058000 00:13 2458719                    /lib64/libncurses.so.6.0
7fec6055f000-7fec60563000 r--p 00058000 00:13 2458719                    /lib64/libncurses.so.6.0
7fec60563000-7fec60564000 rw-p 0005c000 00:13 2458719                    /lib64/libncurses.so.6.0
7fec60564000-7fec60565000 rw-p 00000000 00:00 0
7fec60565000-7fec605a6000 r-xp 00000000 00:13 2513773                    /lib64/libreadline.so.6.3
7fec605a6000-7fec607a5000 ---p 00041000 00:13 2513773                    /lib64/libreadline.so.6.3
7fec607a5000-7fec607a7000 r--p 00040000 00:13 2513773                    /lib64/libreadline.so.6.3
7fec607a7000-7fec607ae000 rw-p 00042000 00:13 2513773                    /lib64/libreadline.so.6.3
7fec607ae000-7fec607af000 rw-p 00000000 00:00 0
7fec607af000-7fec607d2000 r-xp 00000000 00:13 2443142                    /lib64/ld-2.23.so
7fec607d8000-7fec609b8000 r--p 00000000 00:13 2444762                    /usr/lib64/locale/locale-archive
7fec609b8000-7fec609bb000 rw-p 00000000 00:00 0
7fec609c9000-7fec609ca000 rw-p 00000000 00:00 0
7fec609ca000-7fec609d1000 r--s 00000000 00:13 2444761                    /usr/lib64/gconv/gconv-modules.cache
7fec609d1000-7fec609d2000 rw-p 00000000 00:00 0
7fec609d2000-7fec609d3000 r--p 00023000 00:13 2443142                    /lib64/ld-2.23.so
7fec609d3000-7fec609d4000 rw-p 00024000 00:13 2443142                    /lib64/ld-2.23.so
7fec609d4000-7fec609d5000 rw-p 00000000 00:00 0
7ffd4c059000-7ffd4c07a000 rw-p 00000000 00:00 0                          [stack]
7ffd4c0c6000-7ffd4c0c8000 r--p 00000000 00:00 0                          [vvar]
7ffd4c0c8000-7ffd4c0ca000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by None (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-11-07 chet StatusNone Need Info

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code