bugGNUstep - Bugs: bug #52331, use-after-free in the...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #52331: use-after-free in the privateSetLocale function

Submitted by:  Yavor Doganov <yavor>
Submitted on:  Thu 02 Nov 2017 03:21:30 PM UTC  
 
Category: Base/FoundationSeverity: 3 - Normal
Item Group: BugStatus: Fixed
Privacy: PublicAssigned to: Fred Kiefer <FredKiefer>
Open/Closed: Closed

Sun 05 Nov 2017 12:34:52 PM UTC, comment #4:

> The GNUstep repositories are now located at GitHub:


That is very unfortunate.

> This is mentioned on the GNUstep web site but maybe not
> prominent enough.


Yes, found it. The last link under "Get it!" on the main page at gnustep.org is confusing: it points to a wiki.gnustep.org page with instructions for the old SVN repositories at gna.org.

Thanks for fixing the bug, you can close this item.

Yavor Doganov <yavor>
Sun 05 Nov 2017 11:46:51 AM UTC, comment #3:

The GNUstep repositories are now located at GitHub: https://github.com/gnustep
This is mentioned on the GNUstep web site but maybe not prominent enough.
Hopefully there will be a release of the core GNUstep components within the next few weeks.

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Sun 05 Nov 2017 06:37:21 AM UTC, comment #2:

Thanks, but could you please tell me where is the canonical repository? Gna! is gone and it looks like there wasn't migration to Savannah.

Yavor Doganov <yavor>
Sat 04 Nov 2017 10:51:17 PM UTC, comment #1:

Thank you very much for reporting this bug.
I just submitted a patch to the git repository. I was able to reproduce the issue with valgrind and with this patch the memory corruption is gone. Please test on your side as well.

Fred

Fred Kiefer <FredKiefer>
Project MemberIn charge of this item.
Thu 02 Nov 2017 03:21:30 PM UTC, original submission:

Jakub Wilk <jwilk@jwilk.net> reports via Debian (#880575):

GNUstep Base 1.25.0
Architecture: i386 (x86)

The privateSetLocale() function can use memory that has been already freed:

$ valgrind -q -- ./test-locale
==9722== Invalid read of size 1
==9722== at 0x48313D8: strlen (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==9722== by 0x4A5FD89: i_NSString__initWithCString_encoding (NSString.m:1246)
==9722== by 0x4A5CAB3: c_NSString__stringWithCString_encoding (NSString.m:954)
==9722== by 0x48E2897: privateSetLocale (GSLocale.m:75)
==9722== by 0x48E37CB: GSDefaultLanguageLocale (GSLocale.m:330)
==9722== by 0x4A9BFCC: systemLanguages (NSUserDefaults.m:375)
==9722== by 0x4A9BFCC: newLanguages (NSUserDefaults.m:397)
==9722== by 0x4A9DF6D: _c_NSUserDefaults__standardUserDefaults (NSUserDefaults.m:928)
==9722== by 0x10878E: main (test-locale.m:10)
==9722== Address 0x7a78688 is 0 bytes inside a block of size 181 free'd
==9722== at 0x482F478: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==9722== by 0x4E9CE77: setname (setlocale.c:201)
==9722== by 0x4E9CE77: setlocale (setlocale.c:456)
==9722== by 0x4B0D13D: GSPrivateNativeCStringEncoding (Unicode.m:2862)
==9722== by 0x48E2891: privateSetLocale (GSLocale.m:75)
==9722== by 0x48E37CB: GSDefaultLanguageLocale (GSLocale.m:330)
==9722== by 0x4A9BFCC: systemLanguages (NSUserDefaults.m:375)
==9722== by 0x4A9BFCC: newLanguages (NSUserDefaults.m:397)
==9722== by 0x4A9DF6D: _c_NSUserDefaults__standardUserDefaults (NSUserDefaults.m:928)
==9722== by 0x10878E: main (test-locale.m:10)
==9722== Block was alloc'd at
==9722== at 0x482E2BC: malloc (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==9722== by 0x4E9C998: new_composite_name (setlocale.c:172)
==9722== by 0x4E9CF49: setlocale (setlocale.c:378)
==9722== by 0x108742: main (test-locale.m:8)

This happens because it calls setlocale twice; once directly:

clocale = setlocale(category, clocale);

and then again indirectly: ToString -> GSPrivateNativeCStringEncoding ->
setlocale.

The other call invalidates the clocale pointer, as allowed by POSIX:
"The returned string pointer might be invalidated or the string content
might be overwritten by a subsequent call to setlocale()."

Attaching the test program. (FWIW, I can't reproduce on x86 and x86_64.)

Yavor Doganov <yavor>

 

Attached Files
file #42321:  test-locale.m added by yavor (281B - text/x-objcsrc - Test program supposed to demonstrate the bug)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by FredKiefer (Posted a comment)
  • -unavailable- added by yavor (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 18 Nov 2017 02:54:48 PM UTCFredKieferStatusReady For Test=>Fixed
      Open/ClosedIn Test=>Closed
    Sat 04 Nov 2017 10:51:17 PM UTCFredKieferStatusNone=>Ready For Test
      Assigned toNone=>FredKiefer
      Open/ClosedOpen=>In Test
    Thu 02 Nov 2017 03:21:30 PM UTCyavorAttached File-=>Added test-locale.m, #42321

    Back to the top


    Powered by Savane 3.1-cleanup1