bugGNU gettext - Bugs: bug #34555, gettext crashes when I omit some...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #34555: gettext crashes when I omit some of reordered arguments.

Submitted by:  Jeong, Heon <blmarket>
Submitted on:  Sat 15 Oct 2011 06:32:58 AM UTC  
 
Category: End-user / runtimeSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Bruno Haible <haible>
Open/Closed: Closed

Sat 15 Oct 2011 03:47:43 PM UTC, comment #3:

> Currently it crashes because internal code tries to memcpy(dest, NULL, size);
> vasnprintf returns NULL so other internal functions use that result into memcpy. SIGSEGV occurs.


I see. Thanks for explaining. I've now corrected the issue, see
http://git.savannah.gnu.org/gitweb/?p=gettext.git;a=commitdiff;h=1a1831be04f634375c7e7c56cac7ec2f4167e863

> I think no output is even worse than SIGSEGV, which makes programmer
> doesn't know about what's wrong in his program.


Like it or not, POSIX specifies it like this. The programmer
can check the return value of the printf() call (which, I admit,
few programs do) or can check ferror(stdout) (which, alas,
will not detect the problem on all platforms).

> i'd better fix it with some workarounds


You can use %.0s inside a format string to consume an argument
without producing output for it.
For example, change "%3$s go %1$s" to "%3$s go %1$s%2$.0s".

Bruno Haible <haible>
Project AdministratorIn charge of this item.
Sat 15 Oct 2011 12:38:30 PM UTC, comment #2:

> It is not clear what you mean:

sry, my English skill is not quite good.

>1) Do you mean that
>printf("%3$s go %1$s", "down", "es", "down team");
>produces no output, or it crashes (SIGSEGV, core dump)?
>The expected behaviour is that it produces no output.


Currently it crashes because internal code tries to memcpy(dest, NULL, size);
I think no output is even worse than SIGSEGV, which makes programmer doesn't know about what's wrong in his program.

>2) Was that printf statement in a compilation with out without
>#include <libintl.h>?

I included gettext.h so I assume it included libintl.h too.

>3) On which platform (operating system)?

Windows and Linux, didn't tested on other platforms.

>You certainly know that the format string "%3$s go %1$s" above
>is invalid: POSIX says in ...

I see. i'd better fix it with some workarounds.

>You mean, it returns NULL? That is as it should be.

vasnprintf returns NULL so other internal functions use that result into memcpy. SIGSEGV occurs.

>An omitted argument could also occupy 8 bytes on the argument >stack,
>if it's a 'double' or 'long long' argument.
>If the code makes a wrong assumption here, it is likely that
>it will dereference invalid pointers and crash. That's why
>it is better that it just returns with an error indicator.

I know 4 byte is wrong, but it was the behavior of previous versions of gettext.(at least 0.17 I tested) I hoped it works as its previous versions but w/e.

>It sets errno. That's the "exception handling functionality"
>specified by POSIX. As you know, there is no try/catch in C.

it crashes and doesn't set errno. there's no exception handling now.

Jeong, Heon <blmarket>
Sat 15 Oct 2011 10:17:07 AM UTC, comment #1:

It is not clear what you mean:

1) Do you mean that
printf("%3$s go %1$s", "down", "es", "down team");
produces no output, or it crashes (SIGSEGV, core dump)?
The expected behaviour is that it produces no output.

2) Was that printf statement in a compilation with out without
#include <libintl.h>?

3) On which platform (operating system)?

You certainly know that the format string "%3$s go %1$s" above
is invalid: POSIX says in
<http://pubs.opengroup.org/onlinepubs/9699919799/functions/fprintf.html>
that "When numbered argument specifications are used, specifying
the Nth argument requires that all the leading arguments, from the
first to the (N-1)th, are specified in the format string."

> its internal vasnprintf returns 0 when it finds unused reordered
> argument


You mean, it returns NULL? That is as it should be.

> please regard this omitted arguments use 4 bytes


An omitted argument could also occupy 8 bytes on the argument stack,
if it's a 'double' or 'long long' argument.
If the code makes a wrong assumption here, it is likely that
it will dereference invalid pointers and crash. That's why
it is better that it just returns with an error indicator.

> at least give us some exception handling functionality


It sets errno. That's the "exception handling functionality"
specified by POSIX. As you know, there is no try/catch in C.

> I sometimes translate sentences which is not a proper gettext-type strings.
>
> e.g> printf(gettext("%s freeze%s %s!"), "Monster", flag ? "s" : "", "You");
>
> I think it's not a plural sentence, I decided to omit second
> argument when I translate this into korean language


"msgfmt -c" should not let such invalid translations go through.
That's why it is important that, as a translator, you always use
the --check option of msgfmt.

Bruno Haible <haible>
Project AdministratorIn charge of this item.
Sat 15 Oct 2011 06:32:58 AM UTC, original submission:

summary> test below fails.

printf("%3$s go %1$s", "down", "es", "down team");

because second argument isn't used.

---

I sometimes translate sentences which is not a proper gettext-type strings.

e.g> printf(gettext("%s freeze%s %s!"), "Monster", flag ? "s" : "", "You");

I think it's not a plural sentence, I decided to omit second argument when I translate this into korean language. like "%1$s는 %3$s를 얼렸다!" and gettext 0.18 crashes.

its internal vasnprintf returns 0 when it finds unused reordered argument, and it isn't handled. please regard this omitted arguments use 4 bytes(it's typical, and same as previous versions) or at least give us some exception handling functionality.

Jeong, Heon <blmarket>

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by haible (Posted a comment)
  • -unavailable- added by blmarket (Submitted the item)
  • -unavailable- added by blmarket
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sun 27 Nov 2016 01:15:16 AM UTChaibleCategoryNone=>End-user / runtime
    Sat 15 Oct 2011 03:47:43 PM UTChaibleStatusNot a Bug=>Fixed
    Sat 15 Oct 2011 10:17:07 AM UTChaibleStatusNone=>Not a Bug
      Assigned toNone=>haible
      Open/ClosedOpen=>Closed
    Sat 15 Oct 2011 06:32:58 AM UTCblmarketCarbon-Copy-=>Added -unavailable-

    Back to the top


    Powered by Savane 3.1-cleanup1