bugGNU Wget - Bugs: bug #46620, NULL Point Dereference casing...

 
 

bug #46620: NULL Point Dereference casing SegFault in hsts_hash_func in 1.17

Submitted by:  Claudio Guarnieri <nex>
Submitted on:  Sun 06 Dec 2015 10:54:20 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Originator Name: Open/Closed: Closed
Release: 1.17Operating System: GNU/Linux
Reproducibility: Every TimeFixed Release: trunk
Planned Release: NoneRegression: None
Work Required: NonePatch Included: No

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Mon 07 Dec 2015 08:33:08 AM UTC, comment #3:

This issue has been fixed on 18th Nov in commit 99aa7b4f5e13a30e04d4410e98bbb81780e74f09.

The only work-around I know of is disabling HSTS (--no-hsts).

Thanks for reporting anyway.

Tim Ruehsen <rockdaboot>
Project Administrator
Sun 06 Dec 2015 11:01:31 PM UTC, comment #2:

Here, hope it helps.
Apologies for the typos in the original message.

$ gdb --args ./wget https://godzilla.seedboxes.cc
(gdb) r
Starting program: /tmp/wget-1.17/src/wget https://godzilla.seedboxes.cc
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
--2015-12-06 23:59:22-- https://godzilla.seedboxes.cc/
Resolving godzilla.seedboxes.cc... 188.122.93.226, 2a00:1630:44:803::1
Connecting to godzilla.seedboxes.cc|188.122.93.226|:443... connected.
HTTP request sent, awaiting response... 200 OK

Program received signal SIGSEGV, Segmentation fault.
0x0000000000418541 in hsts_hash_func (key=0xb98720) at hsts.c:95
95 for (h = k->host; *h; h++)

Claudio Guarnieri <nex>
Sun 06 Dec 2015 10:57:37 PM UTC, comment #1:

If you're seeing repeated and reproduceable issue, would you please provide an example command line that shows the issue?

Such examples are often very useful in identifying the use case and program path.

Darshit Shah <darnir>
Project Administrator
Sun 06 Dec 2015 10:54:20 PM UTC, original submission:

While making some requests to a site with SSL/TLS transport enabled, I'm experiencing repeated segmentation faults with version 1.17, both compiled manually as well as packaged in Debian testing.

I am able to reproduce it at every execution, and others experienced the same issue with compiled 1.17 on Ubuntu.

[code]#0 0x0000000000418541 in hsts_hash_func (key=0xb989b0) at hsts.c:95
#1 0x000000000041695c in find_cell (ht=0x69f470, key=0xb989b0) at hash.c:321
#2 0x0000000000416d4e in hash_table_remove (ht=0x69f470, key=0xb989b0) at hash.c:454
#3 0x00000000004189dc in hsts_remove_entry (store=0x682970, kh=0xb989b0) at hsts.c:239
#4 0x0000000000418f6a in hsts_store_entry (store=0x682970, scheme=SCHEME_HTTPS,
host=0x682e50 "[REDACTED]", port=0, max_age=0, include_subdomains=true) at hsts.c:425
#5 0x00000000004223aa in gethttp (u=0x69f370, hs=0x7fffffffde50, dt=0x7fffffffe1a4, proxy=0x0,
iri=0x680a40 <dummy_iri>, count=1) at http.c:3405
#6 0x0000000000423a59 in http_loop (u=0x69f370, original_url=0x69f370, newloc=0x7fffffffdfe8,
local_file=0x7fffffffdfd8, referer=0x0, dt=0x7fffffffe1a4, proxy=0x0, iri=0x680a40 <dummy_iri>) at http.c:3979
#7 0x0000000000432b7d in retrieve_url (orig_parsed=0x69f370,
origurl=0x69f3e0 "https://[REDACTED]", file=0x7fffffffe1b0, newloc=0x7fffffffe1a8, refurl=0x0, dt=0x7fffffffe1a4,
recursive=false, iri=0x680a40 <dummy_iri>, register_status=true) at retr.c:817
#8 0x000000000042bc5b in main (argc=2, argv=0x7fffffffe388) at main.c:1860[/code]

Claudio Guarnieri <nex>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by rockdaboot (Posted a comment)
  • -unavailable- added by darnir (Posted a comment)
  • -unavailable- added by nex (Submitted the item)
  •  

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 3 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 07 Dec 2015 08:33:08 AM UTCrockdabootStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>trunk

    Back to the top


    Powered by Savane 3.1-cleanup1