bugCompact Disc Input and Control Library - Bugs: bug #45017, stack overflow / crash in...

 
 

bug #45017: stack overflow / crash in _fs_iso_stat_traverse

Submitted by:  Hanno Boeck <hanno>
Submitted on:  Tue 05 May 2015 07:41:57 AM UTC  
 
Category:  run-time error Severity:  5 - Average
Item Group:  libiso9660 Status:  Fixed
Privacy:  Public Assigned to:  Thomas Schmitt <scdbackup>
Open/Closed:  Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 22 Nov 2017 01:31:51 AM UTC, comment #5:

Git sources now have Thomas Schmitt's fixes which look for deep recursion. It looks to me like this is fixed.

There soon will be a 1.0.0 release with Thomas's code.

Rocky Bernstein <rocky>
Project Administrator
Sun 30 Jul 2017 04:36:25 PM UTC, comment #4:

Or iso-info.c : print_iso9660_recurse() could get a recursion counter
which causes an emergency abort after a generous depth of directories.

Thomas Schmitt <scdbackup>
Project MemberIn charge of this item.
Sun 30 Jul 2017 04:27:56 PM UTC, comment #3:

One could give iso9660_fs.c : _iso9660_dir_to_statbuf() a new parameter
unsigned int filecount
which would tell it whether the first, the second, or any further
record of a directory is processed. There are 7 calls of the function.

It could then raise protest or silently correct the error if filecount 1
is not yielding file name "." (from byte value 0), or if filecount 2 does
not yield ".." (from byte value 1).

Thomas Schmitt <scdbackup>
Project MemberIn charge of this item.
Sun 30 Jul 2017 04:17:29 PM UTC, comment #2:

The reason is that the first directory record in directory "/A"
bears the name "0" (ASCII 48) rather than a binary 0 byte, as prescribed
by ECMA-119 for the "." record.
(Does that error generator know about human psychology ?)

libcdio does not handle the first two directory records special
and so iso9660_ifs_readdir() hands that name to its caller
iso-info.c : print_iso9660_recurse().
This caller, in line 266 ff., would exclude "." and ".." but not
a directory named "0". That directory points to the parent as
being the directory itself.

So it comes to an endless recursion.
2048 /a/0/0/0/0/0/0/0/0/.../0
until valgrind's stack explodes. (At least on my Debian 8.)

Thomas Schmitt <scdbackup>
Project MemberIn charge of this item.
Wed 06 May 2015 07:22:37 PM UTC, comment #1:

Hi -

I just wanted to acknowledge and thank you for all of the bug reports. These will be addressed sometime before the next release.

But I have no idea right now when I will have to time to look at. Of course, it is possible someone else in the group might look at and address.

In the meantime, if you want to submit a patch to fix these, that would also be appreciated.

Rocky Bernstein <rocky>
Project Administrator
Tue 05 May 2015 07:41:57 AM UTC, original submission:

The attached file will crash iso-info -f.

Looking at the gdb backtrace and the valgrind output it looks like the function recursively calls itself forever till the stack size grows to big and overflows.

Found with american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #33913:  libcdio-stackoverflow.iso added by hanno (50KiB - application/x-cd-image)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by scdbackup (Posted a comment)
  • -email is unavailable- added by scdbackup
  • -email is unavailable- added by rocky (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-11-22 rocky StatusNone => Fixed
        Assigned toNone => scdbackup
    2017-07-30 scdbackup Carbon-Copy- => Added scdbackup
    2015-05-06 rocky Item Grouplibcdio => libiso9660
    2015-05-06 rocky CategoryNone => run-time error
        Item GroupNone => libcdio
    2015-05-05 hanno Attached File- => Added libcdio-stackoverflow.iso.valgrind.txt, #33915
    2015-05-05 hanno Attached File- => Added libcdio-stackoverflow.iso, #33913
        Attached File- => Added libcdio-stackoverflow.iso.gdb-backtrace.txt, #33914

    Back to the top


    Powered by Savane 3.3