bugGNU cpio - Bugs: bug #28954, Segfault when passed a...

 
 

bug #28954: Segfault when passed a non-existant file to -E

Submitter:  None
Submitted:  Sun 21 Feb 2010 05:39:57 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Discussion locked!

Wed 01 Sep 2010 04:09:10 PM UTC, comment #4: 

Actually, Ondrej's idea is better. Best not to close down cpio on this... his patch is best! Didn't notice it when I just posted.

Still, it was a fun exercise.

Chris Sherlock <tbsdy>
Wed 01 Sep 2010 04:04:15 PM UTC, comment #3: 

The problem is that read_pattern_file(...) is calling on open_error(...). It should be calling on open_fatal(...).

(file #21371)

Chris Sherlock <tbsdy>
Mon 22 Feb 2010 03:25:53 PM UTC, comment #2: 

For reference, here's a suggested patch from the Fedora maintainer, Ondrej Vasik: https://bugzilla.redhat.com/attachment.cgi?id=395458 .

Conrad Meyer <cemeyer>
Sun 21 Feb 2010 05:45:14 AM UTC, comment #1: 

Oh, I should add: I'm Conrad Meyer <konrad@tylerc.org>, and I've reported this on the Redhat bug tracker as well: https://bugzilla.redhat.com/show_bug.cgi?id=567022 .

Anonymous
Sun 21 Feb 2010 05:39:57 AM UTC, original submission:  

Problem:
When one invokes cpio like: "cpio -i -E doesnt_exist < some_cpio_archive", it segfaults.

Version:
cpio-2.9.90-6.fc11.x86_64

Looking at the patches Fedora makes to cpio, I don't think any of them affect this area of code.

Also, looking at the latest version of cpio on the downloads page, 2.10, it looks like this problem is still present.

Backtrace:
(gdb) bt
#0  _IO_getc (fp=0x0) at getc.c:40
#1  0x0000000000407971 in ds_fgetstr (f=0x0, s=0x7fffffffdcc0, eos=10 '\n') at dstring.c:74
#2  0x0000000000403f48 in read_pattern_file () at copyin.c:947
#3  process_copy_in () at copyin.c:1370
#4  0x0000000000408971 in main (argc=4, argv=0x7fffffffde18) at main.c:797

Conclusion:
It looks like this is a bug in either open_error() or read_pattern_file(). This occurs because fopen() returns NULL, and we pass this NULL on to fgetc().

Solution:
Either:
- open_error() should call call_arg_fatal() instead of call_arg_error(), or
- read_pattern_file() should exit in addition to reporting the error. E.g., replace:

  if (pattern_fp == NULL)
    open_error (pattern_file_name);

With:

  if (pattern_fp == NULL)
    {
      open_error (pattern_file_name);
      exit (...); // or similar
    }

Thanks!

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #21371:  fix.patch added by tbsdy (676B - application/octet-stream - Proposed fix)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gray (Updated the item)
  • -email is unavailable- added by tbsdy (Updated the item)
  • -email is unavailable- added by cemeyer (Posted a comment)
  • -email is unavailable- added by cemeyer ((CCing bug reporter))
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-04 gray StatusNone Fixed
        Open/ClosedOpen Closed
        Discussion LockNone Locked
    2010-09-01 tbsdy Attached File- Added fix.patch, #21371
    2010-02-22 cemeyer Carbon-Copy- Added cemeyer

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code