bugGNU Wget - Bugs: bug #28793, wget segfaults when server returns...

 
 

bug #28793: wget segfaults when server returns empty HTTP response code

Submitter:  Noël Köthe <nok>
Submitted:  Tue 02 Feb 2010 01:07:50 PM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  gscrivano
Originator Name:  Open/Closed:  Closed
Release:  1.12 Operating System:  None
Reproducibility:  Every Time Fixed Release:  None
Planned Release:  None Regression:  None
Work Required:  None Patch Included:  Yes
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 04 May 2010 03:42:53 PM UTC, comment #2: 

I have applied this fix:

=== modified file 'src/http.c'
--- src/http.c 2010-05-01 20:34:11 +0000
+++ src/http.c 2010-05-04 15:31:56 +0000
@@ -1888,6 +1888,13 @@
 
           resp = resp_new (head);
           statcode = resp_status (resp, &message);
+          if (statcode < 0)
+            {
+              logprintf (LOG_NOTQUIET, _("Invalid server response.\n"));
+              CLOSE_INVALIDATE (sock);
+              xfree (head);
+              return HERR;
+            }
           hs->message = xstrdup (message);
           resp_free (resp);
           xfree (head);
@@ -1976,6 +1983,13 @@
   /* Check for status line.  */
   message = NULL;
   statcode = resp_status (resp, &message);
+  if (statcode < 0)
+    {
+      logprintf (LOG_NOTQUIET, _("Invalid server response.\n"));
+      CLOSE_INVALIDATE (sock);
+      request_free (req);
+      return HERR;
+    }
   hs->message = xstrdup (message);
   if (!opt.server_response)
     logprintf (LOG_VERBOSE, "%2d %s\n", statcode,


Giuseppe Scrivano <gscrivano>
Group administrator
Tue 04 May 2010 06:10:07 AM UTC, comment #1: 

This was also reported on the mailing list recently.
http://www.mail-archive.com/bug-wget@gnu.org/msg00907.html

Attached is an updated patch to fix both locations and (unrelated) move around some declarations for msvc.

printf "HTTP" | socat TCP-LISTEN:8888 -
wget-1.12 http://localhost:8888

Thanks to Jonas H. for his trace and help reproducing this issue.


(file #20418)

Jay Satiro <raysatiro>
Tue 02 Feb 2010 01:07:50 PM UTC, original submission:  

Hello,

bugreport from http://bugs.debian.org/563872
--8<--
i seem to have stumbled across a segmentation fault in wget.  If the server omits the numeric HTTP response code in its reply, wget will crash with a segfault.  You can try it:

  printf "HTTP/1.0  OK\r\nContent-Type: text/plain\r\n\r\n" | nc -l 1234 >/dev/null &
  wget http://localhost:1234/

This also works without the Content-Type header.

While this server is clearly not returning valid HTTP, wget should
probably be better behaved than to segfault.
--8<--

Patch from Raphael Geissert <geissert (ät) debian.org>:

--- wget-1.12.orig/src/http.c
+++ wget-1.12/src/http.c
@@ -1829,7 +1829,8 @@
   /* Check for status line.  */
   message = NULL;
   statcode = resp_status (resp, &message);
-  hs->message = xstrdup (message);
+  if (message)
+    hs->message = xstrdup (message);
   if (!opt.server_response)
     logprintf (LOG_VERBOSE, "%2d %s\n", statcode,
                message ? quotearg_style (escape_quoting_style, message) : "");


Noël Köthe <nok>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #20418:  mainline-013c8e2f5997-src-http.c.patch added by raysatiro (2KiB - text/x-diff - filename: mainline-013c8e2f5997-src-http.c.patch)
file #19606:  wget-segfault.patch added by nok (423B - text/x-diff - Patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by gscrivano (Posted a comment)
  • -email is unavailable- added by raysatiro (Updated the item)
  • -email is unavailable- added by raysatiro
  • -email is unavailable- added by raysatiro
  • -email is unavailable- added by nok (Submitted the item)
  •  

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2024-04-11 None Carbon-CopyRemoved -
    2010-05-04 gscrivano StatusNone Fixed
        Assigned toNone gscrivano
        Open/ClosedOpen Closed
    2010-05-04 raysatiro Attached File- Added mainline-013c8e2f5997-src-http.c.patch, #20418
        Carbon-Copy- Added "raphael geissert" <geissert@debian.org>
        Carbon-Copy- Added "jonas h." <jonas@lophus.org>
        Carbon-Copy- Added
    2010-02-02 nok Attached File- Added wget-segfault.patch, #19606

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code