bugGNU Wget - Bugs: bug #28793, wget segfaults when server returns...

 
 

bug #28793: wget segfaults when server returns empty HTTP response code

Submitted by:  Noël Köthe <nok>
Submitted on:  Tue 02 Feb 2010 01:07:50 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: Giuseppe Scrivano <gscrivano>
Originator Name: Open/Closed: Closed
Release: 1.12Operating System: None
Reproducibility: Every TimeFixed Release: None
Planned Release: NoneRegression: None
Work Required: NonePatch Included: Yes

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Tue 04 May 2010 03:42:53 PM UTC, comment #2:

I have applied this fix:

=== modified file 'src/http.c'
--- src/http.c 2010-05-01 20:34:11 +0000
+++ src/http.c 2010-05-04 15:31:56 +0000
@@ -1888,6 +1888,13 @@

resp = resp_new (head);
statcode = resp_status (resp, &message);
+ if (statcode < 0)
+ {
+ logprintf (LOG_NOTQUIET, _("Invalid server response.\n"));
+ CLOSE_INVALIDATE (sock);
+ xfree (head);
+ return HERR;
+ }
hs->message = xstrdup (message);
resp_free (resp);
xfree (head);
@@ -1976,6 +1983,13 @@
/* Check for status line. */
message = NULL;
statcode = resp_status (resp, &message);
+ if (statcode < 0)
+ {
+ logprintf (LOG_NOTQUIET, _("Invalid server response.\n"));
+ CLOSE_INVALIDATE (sock);
+ request_free (req);
+ return HERR;
+ }
hs->message = xstrdup (message);
if (!opt.server_response)
logprintf (LOG_VERBOSE, "%2d %s\n", statcode,

Giuseppe Scrivano <gscrivano>
Project AdministratorIn charge of this item.
Tue 04 May 2010 06:10:07 AM UTC, comment #1:

This was also reported on the mailing list recently.
http://www.mail-archive.com/bug-wget@gnu.org/msg00907.html

Attached is an updated patch to fix both locations and (unrelated) move around some declarations for msvc.

printf "HTTP" | socat TCP-LISTEN:8888 -
wget-1.12 http://localhost:8888

Thanks to Jonas H. for his trace and help reproducing this issue.

(file #20418)

Jay Satiro <raysatiro>
Tue 02 Feb 2010 01:07:50 PM UTC, original submission:

Hello,

bugreport from http://bugs.debian.org/563872
--8<--
i seem to have stumbled across a segmentation fault in wget. If the server omits the numeric HTTP response code in its reply, wget will crash with a segfault. You can try it:

printf "HTTP/1.0 OK\r\nContent-Type: text/plain\r\n\r\n" | nc -l 1234 >/dev/null &
wget http://localhost:1234/

This also works without the Content-Type header.

While this server is clearly not returning valid HTTP, wget should
probably be better behaved than to segfault.
--8<--

Patch from Raphael Geissert <geissert (ät) debian.org>:

--- wget-1.12.orig/src/http.c
+++ wget-1.12/src/http.c
@@ -1829,7 +1829,8 @@
/* Check for status line. */
message = NULL;
statcode = resp_status (resp, &message);
- hs->message = xstrdup (message);
+ if (message)
+ hs->message = xstrdup (message);
if (!opt.server_response)
logprintf (LOG_VERBOSE, "%2d %s\n", statcode,
message ? quotearg_style (escape_quoting_style, message) : "");

Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #20418:  mainline-013c8e2f5997-src-http.c.patch added by raysatiro (2KiB - text/x-diff - filename: mainline-013c8e2f5997-src-http.c.patch)
file #19606:  wget-segfault.patch added by nok (423B - text/x-diff - Patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gscrivano (Posted a comment)
  • -unavailable- added by raysatiro (Updated the item)
  • -unavailable- added by raysatiro
  • -unavailable- added by raysatiro
  • -unavailable- added by raysatiro
  • -unavailable- added by nok (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 8 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 04 May 2010 03:42:53 PM UTCgscrivanoStatusNone=>Fixed
      Assigned toNone=>gscrivano
      Open/ClosedOpen=>Closed
    Tue 04 May 2010 06:10:07 AM UTCraysatiroAttached File-=>Added mainline-013c8e2f5997-src-http.c.patch, #20418
      Carbon-Copy-=>Added "raphael geissert"
      Carbon-Copy-=>Added "jonas h."
      Carbon-Copy-=>Added
    Tue 02 Feb 2010 01:07:50 PM UTCnokAttached File-=>Added wget-segfault.patch, #19606

    Back to the top


    Powered by Savane 3.1-cleanup1