bugfindutils - Bugs: bug #51841, find buffer-overflow with -printf...

 
 

bug #51841: find buffer-overflow with -printf '%T+'

Submitted by:  Andreas Metzler <ametzler>
Submitted on:  Thu 24 Aug 2017 05:54:37 PM UTC  
 
Category:  find Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  Bernhard Voelker <berny>
Originator Name:  Open/Closed:  Open
Release:  None Fixed Release:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Sat 09 Sep 2017 07:15:54 AM UTC, comment #9:

Thanks, pushed - with minor nit in the commit message fixed:

- tests: Test more printf format specifiers.
+ tests: test more printf format specifiers

Thanks.

Bernhard Voelker <berny>
Project AdministratorIn charge of this item.
Fri 08 Sep 2017 05:22:36 PM UTC, comment #8:

Hello,

set env(TZ) "UTC" indeed works.
normal braces, not curly ones.

Thanks. Fixed patch attached.

(file #41763)

Andreas Metzler <ametzler>
Thu 07 Sep 2017 08:43:26 PM UTC, comment #7:

Hmm, but this would change the time zone for all tests.
This works for me:

index 4d0fd28..a1e83de 100644
--- a/find/testsuite/find.gnu/printf.exp
+++ b/find/testsuite/find.gnu/printf.exp
@@ -3,5 +3,6 @@ exec mkdir tmp
exec touch tmp/file
exec chmod 600 tmp/file
exec touch -d 1990-06-22T12:00Z tmp/file
+set env(TZ) "UTC"
find_start p {tmp -type f -printf "a %d\n" -printf "b %f\n" -printf "c %h\n" -printf "d %H\n" -printf "e %l\n" -printf "f %m\n" -printf "g %n\n" -printf "h %p\n" -printf "i %P\n" -printf "j %y\n" -printf "k %Y\n" -printf "percent it%%works%%\n" -printf "string-right !%10p!\n" -printf "string-left !%-10p!\n" -printf "trunc-R !%10.6p!\n" -printf "trunc-L !%-10.6p!\n" -printf "a5 !%5d!\n" -printf "a05 !%05d!\n" -printf "a+ %+d\n" -printf "l1 %T+ %T@ TH=%TH TI=%TI TM=%TM TT=%TT Td=%Td TD=%TD Tj=%Tj Tm=%Tm TU=%TU Tw=%Tw TW=%TW Ty=%Ty TY=%TY\n" -printf "l2 M=%M\n" -printf "l3 t=%t\n" -printf "l4 y=%y Y=%Y\n" }
exec rm -rf tmp

Doesn't it for you as well?

Bernhard Voelker <berny>
Project AdministratorIn charge of this item.
Thu 07 Sep 2017 06:36:40 PM UTC, comment #6:

Well actually there is a simple way:

--- a/find/testsuite/Makefile.am
+++ b/find/testsuite/Makefile.am
@@ -24,6 +24,8 @@ FINDFLAGS =

DEJATOOL = find

+export TZ = UTC
+

I'll post an updated patch.

cu Andreas

Andreas Metzler <ametzler>
Wed 06 Sep 2017 05:51:20 PM UTC, comment #5:

On 2017-09-06 Bernhard Voelker &lt;INVALID.NOREPLY@gnu.org&gt; wrote:
&gt; It seems they fail here:
&gt; -l1 1990-06-22+14:00:00.0000000000 646056000.0000000000 [...]
&gt; +l1 1990-06-22+12:00:00.0000000000 646056000.0000000000 [...]

&gt; The expected output for '%T+' depends on the local timezone.
&gt; As the next part '%T@' is output in GMT, maybe it would work
&gt; if you set TZ to the same?

Hello,

actually I had been wondering why the tests worked since my TZ is != UTC and assumed the testsuite already used a sanitized TZ. Well I realized that the chroot was using TZ=UTC. :-(

Anyway, yes that is exactly the fix that needs to be done.
env TZ=UTC make check
would work.

However I am failing at changing find's environment in the testsuite. Any idea?

What fails:
1) adding this to the top of find/testsuite/find.gnu/printf.exp
global env;
set env{TZ} &quot;UTC&quot;

2) modifying find/testsuite/config/unix.exp
--- a/find/testsuite/config/unix.exp
+++ b/find/testsuite/config/unix.exp
@@ -27,6 +27,7 @@ global FTSFIND
verbose &quot;base_dir is $base_dir&quot; 2
global env;
set env(GNU_FINDUTILS_FD_LEAK_CHECK) &quot;1&quot;
+set env{TZ} &quot;UTC&quot;

cu Andreas

Andreas Metzler <ametzler>
Wed 06 Sep 2017 06:12:39 AM UTC, comment #4:

Thanks for the tests.

It seems they fail here:
-l1 1990-06-22+14:00:00.0000000000 646056000.0000000000 [...]
+l1 1990-06-22+12:00:00.0000000000 646056000.0000000000 [...]

The expected output for '%T+' depends on the local timezone.
As the next part '%T@' is output in GMT, maybe it would work
if you set TZ to the same?

Have a nice day,
Berny

Bernhard Voelker <berny>
Project AdministratorIn charge of this item.
Sat 02 Sep 2017 01:21:24 PM UTC, comment #3:

Hello,

find attached a patch to check %T* (limited to strftime sequences mandated by POSIX), %M, %t, %y, and %Y in the testsuite.

Works for me (on Debian GNU/Linux).

cu Andreas

(file #41718)

Andreas Metzler <ametzler>
Mon 28 Aug 2017 09:17:57 PM UTC, comment #2:

Thanks for the suggestion - I wrapped it into a patch,
and intend to push soon.

(file #41691)

Bernhard Voelker <berny>
Project AdministratorIn charge of this item.
Fri 25 Aug 2017 11:01:53 AM UTC, comment #1:

I think that both the bug and the fix are obvious. After the mentioned patch,
the code writes 12 bytes into a stack-allocated array of size 6 bytes:

char fmt[6];

// [...]

/* Format the main part of the time. */
if (kind == '+')
{
/* Avoid %F, some Unix versions lack it. For example:
HP Tru64 UNIX V5.1B (Rev. 2650); Wed Feb 17 22:59:59 CST 2016
Also, some older HP-UX versions expand %F as the full month (like %B).
Reported by Steven M. Schweda <sms@antinode.info> */
strcpy (fmt, "%Y-%m-%d+%T");

I believe that increasing size of the fmt array to 12 bytes will fix the bug.

Kamil Dudka <kdudka>
Thu 24 Aug 2017 05:54:37 PM UTC, original submission:

Hello,

this is https://bugs.debian.org/873032 reported by Ryan <ryan@ddn.com>:
-------------------------------------
The findutils/find version now in buster 4.6.0+git+20170729-2 fails when I use find with -printf '%T+'. If I change the time format away from + to @, it works fine.

Example bad run:
➜ find . -mindepth 1 -maxdepth 1 -printf '%T+=%p\n'

      • buffer overflow detected ***: find terminated

======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x70bfb)[0x7efe96d69bfb]
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x37)[0x7efe96df21e7]
/lib/x86_64-linux-gnu/libc.so.6(+0xf7320)[0x7efe96df0320]
find(+0xe56b)[0x558ab5db156b]
find(+0xf273)[0x558ab5db2273]
find(+0xdbe9)[0x558ab5db0be9]
find(+0xdbe9)[0x558ab5db0be9]
find(+0x7de9)[0x558ab5daade9]
find(+0x74d1)[0x558ab5daa4d1]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf1)[0x7efe96d192e1]
find(+0x761a)[0x558ab5daa61a]
======= Memory map: ========
558ab5da3000-558ab5ddb000 r-xp 00000000 fe:01 6554946 /usr/bin/find
558ab5fdb000-558ab5fdd000 r--p 00038000 fe:01 6554946 /usr/bin/find
558ab5fdd000-558ab5fde000 rw-p 0003a000 fe:01 6554946 /usr/bin/find
558ab5fde000-558ab5fdf000 rw-p 00000000 00:00 0
558ab6b5b000-558ab6b7c000 rw-p 00000000 00:00 0 [heap]
7efe9644e000-7efe96464000 r-xp 00000000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96464000-7efe96663000 ---p 00016000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96663000-7efe96664000 r--p 00015000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96664000-7efe96665000 rw-p 00016000 fe:01 6422603 /lib/x86_64-linux-gnu/libgcc_s.so.1
7efe96665000-7efe9667d000 r-xp 00000000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9667d000-7efe9687c000 ---p 00018000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687c000-7efe9687d000 r--p 00017000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687d000-7efe9687e000 rw-p 00018000 fe:01 6422812 /lib/x86_64-linux-gnu/libpthread-2.24.so
7efe9687e000-7efe96882000 rw-p 00000000 00:00 0
7efe96882000-7efe96884000 r-xp 00000000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96884000-7efe96a84000 ---p 00002000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a84000-7efe96a85000 r--p 00002000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a85000-7efe96a86000 rw-p 00003000 fe:01 6422773 /lib/x86_64-linux-gnu/libdl-2.24.so
7efe96a86000-7efe96af8000 r-xp 00000000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96af8000-7efe96cf7000 ---p 00072000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf7000-7efe96cf8000 r--p 00071000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf8000-7efe96cf9000 rw-p 00072000 fe:01 6422696 /lib/x86_64-linux-gnu/libpcre.so.3.13.3
7efe96cf9000-7efe96e8c000 r-xp 00000000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe96e8c000-7efe9708c000 ---p 00193000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe9708c000-7efe97090000 r--p 00193000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe97090000-7efe97092000 rw-p 00197000 fe:01 6422769 /lib/x86_64-linux-gnu/libc-2.24.so
7efe97092000-7efe97096000 rw-p 00000000 00:00 0
7efe97096000-7efe97199000 r-xp 00000000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe97199000-7efe97398000 ---p 00103000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe97398000-7efe97399000 r--p 00102000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe97399000-7efe9739a000 rw-p 00103000 fe:01 6422783 /lib/x86_64-linux-gnu/libm-2.24.so
7efe9739a000-7efe973bf000 r-xp 00000000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe973bf000-7efe975be000 ---p 00025000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe975be000-7efe975bf000 r--p 00024000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe975bf000-7efe975c0000 rw-p 00025000 fe:01 6422612 /lib/x86_64-linux-gnu/libselinux.so.1
7efe975c0000-7efe975c2000 rw-p 00000000 00:00 0
7efe975c2000-7efe975e5000 r-xp 00000000 fe:01 6422605 /lib/x86_64-linux-gnu/ld-2.24.so
7efe97629000-7efe977c4000 r--p 00000000 fe:01 6567535 /usr/lib/locale/locale-archive
7efe977c4000-7efe977c9000 rw-p 00000000 00:00 0
7efe977e1000-7efe977e5000 rw-p 00000000 00:00 0
7efe977e5000-7efe977e6000 r--p 00023000 fe:01 6422605 /lib/x86_64-linux-gnu/ld-2.24.so
7efe977e6000-7efe977e7000 rw-p 00024000 fe:01 6422605 /lib/x86_64-linux-gnu/ld-2.24.so
7efe977e7000-7efe977e8000 rw-p 00000000 00:00 0
7ffda1b71000-7ffda1b92000 rw-p 00000000 00:00 0 [stack]
7ffda1bf8000-7ffda1bfb000 r--p 00000000 00:00 0 [vvar]
7ffda1bfb000-7ffda1bfd000 r-xp 00000000 00:00 0 [vdso]
[1] 29180 abort find . -mindepth 1 -maxdepth 1 -printf '%T+=%p\n'
-------------------------------------

Reproducing requires building find with -D_FORTIFY_SOURCE=2 in CPPFLAGS. I have bisected the issue, the point of breakage is not very surprising:

95816b29d46fb6b64754d4a66e7d918b3f134a1f is the first bad commit
commit 95816b29d46fb6b64754d4a66e7d918b3f134a1f
Author: James Youngman <jay@gnu.org>
Date: Sun Jul 23 22:19:42 2017 +0100

find: avoid strftime's non-portable %F specifier.

* find/print.c (format_date): Avoid passing %F to strftime since
some implementation lack it. Pass the synonymous %Y-%m-%d
instead. This fixes a bug manifesting on HP Tru64 UNIX V5.1B.
Reported by Steven M. Schweda <sms@antinode.info>.

cu Andreas

Andreas Metzler <ametzler>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #41763:  works_nonUTC_Test-more-printf-format-specifiers.patch added by ametzler (3KiB - text/x-diff - patch fixed for non-UTC)
file #41718:  0001-tests-Test-more-printf-format-specifiers.patch added by ametzler (2KiB - text/x-diff - Add coverage for %T (and more))
file #41691:  0001-find-avoid-buffer-overflow-with-printf-T.patch added by berny (1KiB - text/x-patch - [PATCH] find: avoid buffer-overflow with -printf '%T+')

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by berny (Updated the item)
  • -email is unavailable- added by kdudka (Posted a comment)
  • -email is unavailable- added by ametzler (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-09-08 ametzler Attached File- => Added works_nonUTC_Test-more-printf-format-specifiers.patch, #41763
    2017-09-02 ametzler Attached File- => Added 0001-tests-Test-more-printf-format-specifiers.patch, #41718
    2017-08-28 berny Attached File- => Added 0001-find-avoid-buffer-overflow-with-printf-T.patch, #41691
        StatusNone => Fixed
        Assigned toNone => berny

    Back to the top


    Powered by Savane 3.3