patchmake - Patches: patch #7534, Use-after-free() when eval in...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

patch #7534: Use-after-free() when eval in variable assignments reassigns the same variable

Submitter:  Lubomir Rintel <lkundrak>
Submitted:  Tue 26 Apr 2011 09:55:56 PM UTC
Votes: 10
 
Category:  None Priority:  7 - High
Status:  Done Privacy:  Public
Assigned to:  psmith Open/Closed:  Closed
Fixed Release:  CVS

Jump to the original submission

Mon 29 Aug 2011 04:25:22 PM UTC, comment #9: 

This really should have been filed as a bug... because it is a bug.  Patches are more for new features although I would prefer those to be filed as bugs as well.  I'm going to try to figure out how to close this tracker completely without losing any information in it.

Anyway I think I fixed it in the latest CVS.  Thanks!

Paul D. Smith <psmith>
Group administrator
Wed 24 Aug 2011 01:00:20 PM UTC, comment #8: 

Ping?

Lubomir Rintel <lkundrak>
Wed 03 Aug 2011 10:34:46 AM UTC, comment #7: 

/me feels like noone loves him.

Lubomir Rintel <lkundrak>
Sat 02 Jul 2011 09:41:23 PM UTC, comment #6: 

Sorry I've been on vacation; just got back.  I'll try to look at this this weekend.  Thanks.

Paul D. Smith <psmith>
Group administrator
Fri 01 Jul 2011 12:26:50 PM UTC, comment #5: 

Hello,

Is there anybody out there?

Lubomir Rintel <lkundrak>
Wed 15 Jun 2011 08:48:20 AM UTC, comment #4: 

Paul, thanks for your response. The example in the comment both contains typoes and is incomplete, sorry for that. The bug is indeed still visible in the code. Also, I've tried it with fresh CVS checkout my (Fedora 14/i386) system (valgrind output filtered for clarity):


make:master$ cvs up
? .git
? Makefile.broke
cvs update: Updating .
cvs update: Updating config
cvs update: Updating doc
cvs update: Updating glob
cvs update: Updating i18n
cvs update: Updating po
cvs update: Updating tests
cvs update: Updating tests/scripts
cvs update: Updating tests/scripts/features
cvs update: Updating tests/scripts/functions
cvs update: Updating tests/scripts/misc
cvs update: Updating tests/scripts/options
cvs update: Updating tests/scripts/targets
cvs update: Updating tests/scripts/variables
cvs update: Updating w32
cvs update: Updating w32/compat
cvs update: Updating w32/include
cvs update: Updating w32/subproc
make:master$ make make
make:master$ cat Makefile.broke
VARIABLE = $(eval VARIABLE := $(shell long-slow-command))$(VARIABLE)

wololo:
        $(VARIABLE)
make:master$ valgrind ./make -f Makefile.broke 2>&1 |egrep 'Invalid|Address|ERROR'
==26585== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 17 from 8)
==26585== Invalid read of size 1
==26585==  Address 0x4214025 is 45 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214026 is 46 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214027 is 47 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214027 is 47 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214029 is 49 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214029 is 49 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214029 is 49 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214028 is 48 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214029 is 49 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214029 is 49 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214030 is 56 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214031 is 57 bytes inside a block of size 58 free'd
==26585== Invalid read of size 1
==26585==  Address 0x4214031 is 57 bytes inside a block of size 58 free'd
==26585== ERROR SUMMARY: 74 errors from 20 contexts (suppressed: 17 from 8)
make:master$


Lubomir Rintel <lkundrak>
Sun 12 Jun 2011 07:22:12 PM UTC, comment #3: 

I've tried both the example in the comment below and also the example shown in the patch file, under valgrind, and I can't see any memory error with the current CVS HEAD version of GNU make.

Can you try your examples with GNU make 3.82 (the latest version) and, if possible, the CVS HEAD version to verify that this has been fixed already?

Paul D. Smith <psmith>
Group administrator
Wed 04 May 2011 02:44:18 PM UTC, comment #2: 

Ping?

Lubomir Rintel <lkundrak>
Tue 26 Apr 2011 10:17:37 PM UTC, comment #1: 

Needless to say; test suite passes well and the problem was checked to go away with valgrind.

Lubomir Rintel <lkundrak>
Tue 26 Apr 2011 09:55:56 PM UTC, original submission:  

In real world, such memory corruption occurs when using eval constructs for lazy assignment:

VARIABLE = $(eval VARIABLE := $(shell long-slow-command)$(VARIABLE)

See the patch file for more details.

Lubomir Rintel <lkundrak>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attached Files
file #23308:  0001-Always-copy-the-string-before-expanding-it.patch added by lkundrak (2KiB - application/octet-stream - Patches agains CVS head and make-3.81-19.el6)
file #23309:  make-3.81-copy-on-expand.patch added by lkundrak (2KiB - application/octet-stream - Patches agains CVS head and make-3.81-19.el6)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by vshih (Voted in favor of this item)
  • -email is unavailable- added by psmith (Posted a comment)
  • -email is unavailable- added by lkundrak (Submitted the item)
  •  

    There are 10 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 9 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-05-17 vshih Carbon-Copy- Added vshih
    2011-08-29 psmith StatusNone Done
        Assigned toNone psmith
        Open/ClosedOpen Closed
        Fixed ReleaseNone CVS
    2011-04-26 lkundrak Carbon-CopyRemoved lkundrak -
    2011-04-26 lkundrak Attached File- Added 0001-Always-copy-the-string-before-expanding-it.patch, #23308
        Attached File- Added make-3.81-copy-on-expand.patch, #23309
        Carbon-Copy- Added lkundrak

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code