bugGNU patch - Bugs: bug #45248, Invalid free() with corrupt patch

 
 

bug #45248: Invalid free() with corrupt patch

Submitted by:  None
Submitted on:  Wed 03 Jun 2015 05:09:04 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Open

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 03 Jun 2015 05:09:04 PM UTC, original submission:

In the function `another_hunk`, `p_end` can be set incorrectly high by an invalid patch file. `another_hunk` loops down from `p_end`, performing `free(p_line[p_end])`. Because this frees whatever is beyond `p_line`, the behavior is not deterministic (i.e. it may not crash for you). This could pose a security vulnerability.

I am not an expert in the codebase or the patch format so the bug may be obvious to the maintainers. Otherwise, I can do some further analysis of the bug.

-Edward Williamson (edwillia AT andrew.cmu.edu)

(gdb) r --dry-run < free_segfault
Starting program: /home/ned/dev/patch/src/patch --dry-run < free_segfault
checking file 0

Program received signal SIGSEGV, Segmentation fault.
__GI___libc_free (mem=0x20a61) at malloc.c:2929
2929 malloc.c: No such file or directory.
(gdb) bt
#0 __GI___libc_free (mem=0x20a61) at malloc.c:2929
#1 0x0000000000409150 in another_hunk (difftype=CONTEXT_DIFF, rev=false) at pch.c:1184
#2 0x000000000040337a in main (argc=<optimized out>, argv=<optimized out>) at patch.c:390

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #34155:  free_segfault added by None (35B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follows 1 latest change.

Date Changed By Updated Field Previous Value => Replaced By
Wed 03 Jun 2015 05:09:04 PM UTCNoneAttached File-=>Added free_segfault, #34155

Back to the top


Powered by Savane 3.1-cleanup1