bugGNU Wget - Bugs: bug #28738, Segfault on malformed data

 
 

bug #28738: Segfault on malformed data

Submitted by:  Benjamin Wolsey <bwy>
Submitted on:  Tue 26 Jan 2010 08:58:58 AM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: None
Privacy: PublicAssigned to: Giuseppe Scrivano <gscrivano>
Originator Name: Benjamin WolseyOpen/Closed: Closed
Release: trunkOperating System: GNU/Linux
Reproducibility: Every TimeFixed Release: None
Planned Release: 1.13Regression: None
Work Required: NonePatch Included: No

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 25 May 2010 03:54:00 PM UTC, comment #2:

Fixed with commit 2339.

Giuseppe Scrivano <gscrivano>
Project AdministratorIn charge of this item.
Wed 27 Jan 2010 06:22:17 PM UTC, comment #1:

What I meant to say is:

To reproduce: zzuf -n -s4 -c wget http://news.bbc.co.uk/2/hi/uk_news/8479807.stm

But I find this also doesn't always work. However, using a range of fuzzing seeds (-s0:100) usually finds the fault relatively quickly regardless of the URL retrieved.

Benjamin Wolsey <bwy>
Tue 26 Jan 2010 08:58:58 AM UTC, original submission:

The resp_status function in src/http.c returns -1 on error, but in these cases does not assign a message. In two cases (lines 1851 and 1939), xstrdup is called on the message pointer without checking the return of resp_status.

If the status is malformed, this may cause a segfault because the message pointer is still NULL. The return of resp_status is checked much later (line 2199), but this is too late.

Probably the same bug reported in http://www.mail-archive.com/bug-wget@gnu.org/msg00746.html

To reproduce (maybe): http://news.bbc.co.uk/2/hi/uk_news/8479807.stm

Benjamin Wolsey <bwy>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gscrivano (Posted a comment)
  • -unavailable- added by bwy (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 25 May 2010 03:54:00 PM UTCgscrivanoAssigned toNone=>gscrivano
      Open/ClosedOpen=>Closed
      Planned ReleaseNone=>1.13

    Back to the top


    Powered by Savane 3.1-cleanup1