Sun 21 Feb 2010 05:39:57 AM UTC, original submission:
Problem:
When one invokes cpio like: "cpio -i -E doesnt_exist < some_cpio_archive", it segfaults.
Version:
cpio-2.9.90-6.fc11.x86_64
Looking at the patches Fedora makes to cpio, I don't think any of them affect this area of code.
Also, looking at the latest version of cpio on the downloads page, 2.10, it looks like this problem is still present.
Backtrace:
(gdb) bt
#0 _IO_getc (fp=0x0) at getc.c:40
#1 0x0000000000407971 in ds_fgetstr (f=0x0, s=0x7fffffffdcc0, eos=10 '\n') at dstring.c:74
#2 0x0000000000403f48 in read_pattern_file () at copyin.c:947
#3 process_copy_in () at copyin.c:1370
#4 0x0000000000408971 in main (argc=4, argv=0x7fffffffde18) at main.c:797
Conclusion:
It looks like this is a bug in either open_error() or read_pattern_file(). This occurs because fopen() returns NULL, and we pass this NULL on to fgetc().
Solution:
Either:
- open_error() should call call_arg_fatal() instead of call_arg_error(), or
- read_pattern_file() should exit in addition to reporting the error. E.g., replace:
if (pattern_fp == NULL)
open_error (pattern_file_name);
With:
if (pattern_fp == NULL)
{
open_error (pattern_file_name);
exit (...); // or similar
}
Thanks!
|