bugGNU cpio - Bugs: bug #28954, Segfault when passed a...


bug #28954: Segfault when passed a non-existant file to -E

Submitted by:  None
Submitted on:  Sun 21 Feb 2010 05:39:57 AM UTC  
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Discussion locked!


Wed 01 Sep 2010 04:09:10 PM UTC, comment #4: 

Actually, Ondrej's idea is better. Best not to close down cpio on this... his patch is best! Didn't notice it when I just posted.

Still, it was a fun exercise.

Chris Sherlock <tbsdy>
Wed 01 Sep 2010 04:04:15 PM UTC, comment #3: 

The problem is that read_pattern_file(...) is calling on open_error(...). It should be calling on open_fatal(...).

(file #21371)

Chris Sherlock <tbsdy>
Mon 22 Feb 2010 03:25:53 PM UTC, comment #2: 

For reference, here's a suggested patch from the Fedora maintainer, Ondrej Vasik: https://bugzilla.redhat.com/attachment.cgi?id=395458 .

Conrad Meyer <cemeyer>
Sun 21 Feb 2010 05:45:14 AM UTC, comment #1: 

Oh, I should add: I'm Conrad Meyer <konrad@tylerc.org>, and I've reported this on the Redhat bug tracker as well: https://bugzilla.redhat.com/show_bug.cgi?id=567022 .

Sun 21 Feb 2010 05:39:57 AM UTC, original submission:  

When one invokes cpio like: "cpio -i -E doesnt_exist < some_cpio_archive", it segfaults.


Looking at the patches Fedora makes to cpio, I don't think any of them affect this area of code.

Also, looking at the latest version of cpio on the downloads page, 2.10, it looks like this problem is still present.

(gdb) bt
#0  _IO_getc (fp=0x0) at getc.c:40
#1  0x0000000000407971 in ds_fgetstr (f=0x0, s=0x7fffffffdcc0, eos=10 '\n') at dstring.c:74
#2  0x0000000000403f48 in read_pattern_file () at copyin.c:947
#3  process_copy_in () at copyin.c:1370
#4  0x0000000000408971 in main (argc=4, argv=0x7fffffffde18) at main.c:797

It looks like this is a bug in either open_error() or read_pattern_file(). This occurs because fopen() returns NULL, and we pass this NULL on to fgetc().

- open_error() should call call_arg_fatal() instead of call_arg_error(), or
- read_pattern_file() should exit in addition to reporting the error. E.g., replace:

  if (pattern_fp == NULL)
    open_error (pattern_file_name);


  if (pattern_fp == NULL)
      open_error (pattern_file_name);
      exit (...); // or similar




Attached Files
file #21371:  fix.patch added by tbsdy (676B - application/octet-stream - Proposed fix)


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by gray (Updated the item)
  • -email is unavailable- added by tbsdy (Updated the item)
  • -email is unavailable- added by cemeyer (Posted a comment)
  • -email is unavailable- added by cemeyer ((CCing bug reporter))

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-04 gray StatusNone => Fixed
        Open/ClosedOpen => Closed
        Discussion LockUnlocked => Locked
    2010-09-01 tbsdy Attached File- => Added fix.patch, #21371
    2010-02-22 cemeyer Carbon-Copy- => Added cemeyer

    Back to the top

    Powered by Savane 3.7