bugCompact Disc Input and Control Library - Bugs: bug #22865, crash in udf_readdir() due to...

 
 

bug #22865: crash in udf_readdir() due to i_alloc_descs differences

Submitted by:  Vaclav Slavik <vslavik>
Submitted on:  Mon 07 Apr 2008 11:29:09 AM UTC  
 
Category: run-time errorSeverity: 5 - Average
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sun 18 Mar 2012 05:58:22 PM UTC, comment #2:

I believe recent work from Pete Batard has addressed this. Please try with the current git sources see if there is still a problem.

Thnaks.

Rocky Bernstein <rocky>
Project Administrator
Tue 08 Apr 2008 03:27:52 AM UTC, comment #1:

Thanks for the report and analysis.

Since I don't know what the best thing to do is, sure what you propose sounds "reasonable".

Sorry I can't be of help. This code hasn't gotten a lot of love.

Thanks.

Rocky Bernstein <rocky>
Project Administrator
Mon 07 Apr 2008 11:29:09 AM UTC, original submission:

I'm getting crashes in udf_readdir() using today's CVS sources (present in 0.80 too). Valgrind spits out many entries like this:

(with the write address going to "1,2,... bytes after" for the same filesystem entry and than again with other files (but not all).

I tried to fix it, but I don't understand the code enough to know how best to do it. The offending line of code in udf_readdir() is this:

And when I add asserts to check i_alloc_descs and i_extended_attr values there, it becomes clear it's because these values differ between p_udf_dirent->fe and p_udf_fe. But this piece of code assumes it is constant, resulting in memory overwrites. (BTW, there's a related FIXME in udf_fopen()).

The only thing I can think of is changing udf_dirent_t.fe to be a pointer and realloc() it at this place if the size differs. Does that sound reasonable? If it does, I may give it a try.

How to reproduce: download VS2008MSDNLibraryENUX1429217.iso from http://www.microsoft.com/downloads/details.aspx?FamilyId=6FF3BC60-32C8-4C22-8591-A20BF8DFF1A2&displaylang=en and run examples/utf1 with this file as its argument. (Sorry, I'm not sure how to create UDF image with the same properties -- this download is 2GB in size.)

Vaclav Slavik <vslavik>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rocky (Posted a comment)
  • -unavailable- added by vslavik (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follows 1 latest change.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 24 Apr 2012 01:57:55 PM UTCrockyOpen/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup1