bugfindutils - Bugs: bug #51841, find buffer-overflow with -printf...

 
 

bug #51841: find buffer-overflow with -printf '%T+'

Submitted by:  Andreas Metzler <ametzler>
Submitted on:  Thu 24 Aug 2017 05:54:37 PM UTC  
 
Category: findSeverity: 3 - Normal
Item Group: NoneStatus: Fixed
Privacy: PublicAssigned to: Bernhard Voelker <berny>
Originator Name: Open/Closed: Open
Release: NoneFixed Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Sat 09 Sep 2017 07:15:54 AM UTC, comment #9:

Thanks, pushed - with minor nit in the commit message fixed:

- tests: Test more printf format specifiers.
+ tests: test more printf format specifiers

Thanks.

Bernhard Voelker <berny>
Project MemberIn charge of this item.
Fri 08 Sep 2017 05:22:36 PM UTC, comment #8:

Hello,

set env(TZ) "UTC" indeed works.
normal braces, not curly ones.

Thanks. Fixed patch attached.

(file #41763)

Andreas Metzler <ametzler>
Thu 07 Sep 2017 08:43:26 PM UTC, comment #7:

Hmm, but this would change the time zone for all tests.
This works for me:

index 4d0fd28..a1e83de 100644
--- a/find/testsuite/find.gnu/printf.exp
+++ b/find/testsuite/find.gnu/printf.exp
@@ -3,5 +3,6 @@ exec mkdir tmp
exec touch tmp/file
exec chmod 600 tmp/file
exec touch -d 1990-06-22T12:00Z tmp/file
+set env(TZ) "UTC"
find_start p {tmp -type f -printf "a %d\n" -printf "b %f\n" -printf "c %h\n" -printf "d %H\n" -printf "e %l\n" -printf "f %m\n" -printf "g %n\n" -printf "h %p\n" -printf "i %P\n" -printf "j %y\n" -printf "k %Y\n" -printf "percent it%%works%%\n" -printf "string-right !%10p!\n" -printf "string-left !%-10p!\n" -printf "trunc-R !%10.6p!\n" -printf "trunc-L !%-10.6p!\n" -printf "a5 !%5d!\n" -printf "a05 !%05d!\n" -printf "a+ %+d\n" -printf "l1 %T+ %T@ TH=%TH TI=%TI TM=%TM TT=%TT Td=%Td TD=%TD Tj=%Tj Tm=%Tm TU=%TU Tw=%Tw TW=%TW Ty=%Ty TY=%TY\n" -printf "l2 M=%M\n" -printf "l3 t=%t\n" -printf "l4 y=%y Y=%Y\n" }
exec rm -rf tmp

Doesn't it for you as well?

Bernhard Voelker <berny>
Project MemberIn charge of this item.
Thu 07 Sep 2017 06:36:40 PM UTC, comment #6:

Well actually there is a simple way:

--- a/find/testsuite/Makefile.am
+++ b/find/testsuite/Makefile.am
@@ -24,6 +24,8 @@ FINDFLAGS =

DEJATOOL = find

+export TZ = UTC
+

I'll post an updated patch.

cu Andreas

Andreas Metzler <ametzler>
Wed 06 Sep 2017 05:51:20 PM UTC, comment #5:

On 2017-09-06 Bernhard Voelker &lt;INVALID.NOREPLY@gnu.org&gt; wrote:
&gt; It seems they fail here:
&gt; -l1 1990-06-22+14:00:00.0000000000 646056000.0000000000 [...]
&gt; +l1 1990-06-22+12:00:00.0000000000 646056000.0000000000 [...]

&gt; The expected output for '%T+' depends on the local timezone.
&gt; As the next part '%T@' is output in GMT, maybe it would work
&gt; if you set TZ to the same?

Hello,

actually I had been wondering why the tests worked since my TZ is != UTC and assumed the testsuite already used a sanitized TZ. Well I realized that the chroot was using TZ=UTC. :-(

Anyway, yes that is exactly the fix that needs to be done.
env TZ=UTC make check
would work.

However I am failing at changing find's environment in the testsuite. Any idea?

What fails:
1) adding this to the top of find/testsuite/find.gnu/printf.exp
global env;
set env{TZ} &quot;UTC&quot;

2) modifying find/testsuite/config/unix.exp
--- a/find/testsuite/config/unix.exp
+++ b/find/testsuite/config/unix.exp
@@ -27,6 +27,7 @@ global FTSFIND
verbose &quot;base_dir is $base_dir&quot; 2
global env;
set env(GNU_FINDUTILS_FD_LEAK_CHECK) &quot;1&quot;
+set env{TZ} &quot;UTC&quot;

cu Andreas

Andreas Metzler <ametzler>
Wed 06 Sep 2017 06:12:39 AM UTC, comment #4:

Thanks for the tests.

It seems they fail here:
-l1 1990-06-22+14:00:00.0000000000 646056000.0000000000 [...]
+l1 1990-06-22+12:00:00.0000000000 646056000.0000000000 [...]

The expected output for '%T+' depends on the local timezone.
As the next part '%T@' is output in GMT, maybe it would work
if you set TZ to the same?

Have a nice day,
Berny

Bernhard Voelker <berny>
Project MemberIn charge of this item.
Sat 02 Sep 2017 01:21:24 PM UTC, comment #3:

Hello,

find attached a patch to check %T* (limited to strftime sequences mandated by POSIX), %M, %t, %y, and %Y in the testsuite.

Works for me (on Debian GNU/Linux).

cu Andreas

(file #41718)

Andreas Metzler <ametzler>
Mon 28 Aug 2017 09:17:57 PM UTC, comment #2:

Thanks for the suggestion - I wrapped it into a patch,
and intend to push soon.

(file #41691)

Bernhard Voelker <berny>
Project MemberIn charge of this item.
Fri 25 Aug 2017 11:01:53 AM UTC, comment #1:

I think that both the bug and the fix are obvious. After the mentioned patch,
the code writes 12 bytes into a stack-allocated array of size 6 bytes:

char fmt[6];

// [...]

/* Format the main part of the time. */
if (kind == '+')
{
/* Avoid %F, some Unix versions lack it. For example:
HP Tru64 UNIX V5.1B (Rev. 2650); Wed Feb 17 22:59:59 CST 2016
Also, some older HP-UX versions expand %F as the full month (like %B).
Reported by Steven M. Schweda <sms@antinode.info> */
strcpy (fmt, "%Y-%m-%d+%T");

I believe that increasing size of the fmt array to 12 bytes will fix the bug.

Kamil Dudka <kdudka>
Thu 24 Aug 2017 05:54:37 PM UTC, original submission:

Hello,

this is https://bugs.debian.org/873032 reported by Ryan <ryan@ddn.com>:
-------------------------------------
The findutils/find version now in buster 4.6.0+git+20170729-2 fails when I use find with -printf '%T+'. If I change the time format away from + to @, it works fine.

Example bad run:
➜ find . -mindepth 1 -maxdepth 1 -printf '%T+=%p\n'

      • buffer overflow detected ***: find terminated

======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x70bfb)[0x7efe96d69bfb]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7efe96df21e7]
/lib/x86_64-linux-gnu/libc.so.6(+0xf7320)[0x7efe96df0320]
find(+0xe56b)[0x558ab5db156b]
find(+0xf273)[0x558ab5db2273]
find(+0xdbe9)[0x558ab5db0be9]
find(+0xdbe9)[0x558ab5db0be9]
find(+0x7de9)[0x558ab5daade9]
find(+0x74d1)[0x558ab5daa4d1]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7efe96d192e1]
find(+0x761a)[0x558ab5daa61a]
======= Memory map: ========
558ab5da3000-558ab5ddb000 r-xp 00000000 fe:01 6554946 /usr/bin/find
558ab5fdb000-558ab5fdd000 r--p 00038000 fe:01 6554946 /usr/bin/find
558ab5fdd000-558ab5fde000 rw-p 0003a000 fe:01 6554946 /usr/bin/find
558ab5fde000-558ab5fdf000 rw-p 00000000 00:00 0
558ab6b5b000-558ab6b7c000 rw-p 00000000 00:00 0 [heap]
7efe9644e000-7efe96464000 r-xp 00000000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96464000-7efe96663000 ---p 00016000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96663000-7efe96664000 r--p 00015000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96664000-7efe96665000 rw-p 00016000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96665000-7efe9667d000 r-xp 00000000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9667d000-7efe9687c000 ---p 00018000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687c000-7efe9687d000 r--p 00017000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687d000-7efe9687e000 rw-p 00018000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687e000-7efe96882000 rw-p 00000000 00:00 0
7efe96882000-7efe96884000 r-xp 00000000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96884000-7efe96a84000 ---p 00002000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a84000-7efe96a85000 r--p 00002000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a85000-7efe96a86000 rw-p 00003000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a86000-7efe96af8000 r-xp 00000000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96af8000-7efe96cf7000 ---p 00072000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf7000-7efe96cf8000 r--p 00071000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf8000-7efe96cf9000 rw-p 00072000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf9000-7efe96e8c000 r-xp 00000000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe96e8c000-7efe9708c000 ---p 00193000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe9708c000-7efe97090000 r--p 00193000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe97090000-7efe97092000 rw-p 00197000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe97092000-7efe97096000 rw-p 00000000 00:00 0
7efe97096000-7efe97199000 r-xp 00000000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe97199000-7efe97398000 ---p 00103000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe97398000-7efe97399000 r--p 00102000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe97399000-7efe9739a000 rw-p 00103000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe9739a000-7efe973bf000 r-xp 00000000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe973bf000-7efe975be000 ---p 00025000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe975be000-7efe975bf000 r--p 00024000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe975bf000-7efe975c0000 rw-p 00025000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe975c0000-7efe975c2000 rw-p 00000000 00:00 0
7efe975c2000-7efe975e5000 r-xp 00000000 fe:01 6422605 /lib/x86_64-linux-gnu/ld-2.24.so
7efe97629000-7efe977c4000 r--p 00000000 fe:01 6567535 /usr/lib/locale/locale-archive
7efe977c4000-7efe977c9000 rw-p 00000000 00:00 0
7efe977e1000-7efe977e5000 rw-p 00000000 00:00 0
7efe977e5000-7efe977e6000 r--p 00023000 fe:01 6422605 /lib/x86_64-linux-gnu/ld-2.24.so
7efe977e6000-7efe977e7000 rw-p 00024000 fe:01 6422605 /lib/x86_64-linux-gnu/ld-2.24.so
7efe977e7000-7efe977e8000 rw-p 00000000 00:00 0
7ffda1b71000-7ffda1b92000 rw-p 00000000 00:00 0 [stack]
7ffda1bf8000-7ffda1bfb000 r--p 00000000 00:00 0 [vvar]
7ffda1bfb000-7ffda1bfd000 r-xp 00000000 00:00 0 [vdso]
[1] 29180 abort find . -mindepth 1 -maxdepth 1 -printf '%T+=%p\n'
-------------------------------------

Reproducing requires building find with -D_FORTIFY_SOURCE=2 in CPPFLAGS. I have bisected the issue, the point of breakage is not very surprising:

95816b29d46fb6b64754d4a66e7d918b3f134a1f is the first bad commit
commit 95816b29d46fb6b64754d4a66e7d918b3f134a1f
Author: James Youngman <jay@gnu.org>
Date: Sun Jul 23 22:19:42 2017 +0100

find: avoid strftime's non-portable %F specifier.

* find/print.c (format_date): Avoid passing %F to strftime since
some implementation lack it. Pass the synonymous %Y-%m-%d
instead. This fixes a bug manifesting on HP Tru64 UNIX V5.1B.
Reported by Steven M. Schweda <sms@antinode.info>.

cu Andreas

Andreas Metzler <ametzler>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #41763:  works_nonUTC_Test-more-printf-format-specifiers.patch added by ametzler (3KiB - text/x-diff - patch fixed for non-UTC)
file #41718:  0001-tests-Test-more-printf-format-specifiers.patch added by ametzler (2KiB - text/x-diff - Add coverage for %T (and more))
file #41691:  0001-find-avoid-buffer-overflow-with-printf-T.patch added by berny (1KiB - text/x-patch - [PATCH] find: avoid buffer-overflow with -printf '%T+')

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by berny (Updated the item)
  • -unavailable- added by kdudka (Posted a comment)
  • -unavailable- added by ametzler (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 5 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 08 Sep 2017 05:22:36 PM UTCametzlerAttached File-=>Added works_nonUTC_Test-more-printf-format-specifiers.patch, #41763
    Sat 02 Sep 2017 01:21:24 PM UTCametzlerAttached File-=>Added 0001-tests-Test-more-printf-format-specifiers.patch, #41718
    Mon 28 Aug 2017 09:17:57 PM UTCbernyAttached File-=>Added 0001-find-avoid-buffer-overflow-with-printf-T.patch, #41691
      StatusNone=>Fixed
      Assigned toNone=>berny

    Back to the top


    Powered by Savane 3.1-cleanup1