GNU bug report logs - #16171
ptx: heap buffer overrun, when run with two file arguments

Previous Next

Full log

Message #13 received at 16171-done <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: Jim Meyering <jim <at> meyering.net>
Cc: 16171-done <at> debbugs.gnu.org
Subject: Re: bug#16171: ptx: heap buffer overrun,
 when run with two file arguments
Date: Mon, 28 Apr 2014 14:52:23 +0100

[Message part 1 (text/plain, inline)]

On 12/17/2013 10:29 AM, Pádraig Brady wrote:
> On 12/17/2013 02:22 AM, Jim Meyering wrote:
>> Hi,
>>
>> I built like this using just-built 4.9.0 20131216
>> (but it probably would work as well with 4.8.x):
>>
>>   make check AM_CFLAGS='-ggdb3 -static-libasan -fsanitize=address'
>>          AM_LDFLAGS='-fsanitize=address -static-libasan -lpthread -ldl'
>>
>> and then I ran this,
>>
>>   echo a > a && echo b > b &&
>>   ./ptx -g1 -w1 a b 2>&1 | asan_symbolize.py -d
>>
>> and include its output below.
>> That output shows a heap-read overrun bug that arises
>> because ptx was designed to process only one input file, yet
>> was later extended to process more than, but without some
>> important adjustments.
>>
>> The underlying problem is that swallow_file_in_memory (called from main)
>> is setting the contents of the global text_buffer for the first file,
>> then updating it (clobbering old value) for the second file.
>> Yet, some pointers to the initial buffer have been squirreled away
>> and later, one of them (keyafter) is presumed to point into
>> the new "text_buffer", which it does not.  The subsequent
>> SKIP_WHITE_BACKWARDS use backs up "cursor" until it is goes
>> out of bounds.
> 
> Nice. This is a good illustration how test coverage
> can be leveraged by (future) run time checks.
> 
> I see it here too (as the only failure in make check with -fsanitize=address

The attached should address this.
I'll push later.

thanks,
Pádraig.

[ptx-whitespace-heap-overflow.patch (text/x-patch, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.