GNU bug report logs - #21186
date core with bad string

Previous Next

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 21186 in the body.
You can then email your comments to 21186 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: "Michael Moffatt" <michael <at> moffatt.org.nz>
To: bug-coreutils <at> gnu.org
Subject: date core with bad string
Date: Tue, 4 Aug 2015 13:36:11 +0200

Hi there,

I inadvertently discovered that the following bad input leads to a date
core. While I accept that I was throwing garbage at poor old date, I
thought that the resulting core merited a bug report.

The string was:

date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015 04:00:35 +0000"'

I was doing this on Centos, but also verified the same issue on Debian
(6.0.10) with coreutils 8.5 but the problem did NOT happen on another
Debian (jessie/sid) box with coreutils 8.21.

CENTOS BOX:

[moffatt <at> centos ~]$ date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015
04:00:35 +0000"'
*** Error in `date': free(): invalid size: 0x00007ffff49666b0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7d19d)[0x7fcc0743719d]
date[0x4065e0]
date[0x402245]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fcc073dbaf5]
date[0x402275]
======= Memory map: ========
00400000-0040e000 r-xp 00000000 fd:00 17170463                          
/usr/bin/date
0060d000-0060e000 r--p 0000d000 fd:00 17170463                          
/usr/bin/date
0060e000-0060f000 rw-p 0000e000 fd:00 17170463                          
/usr/bin/date
01df1000-01e12000 rw-p 00000000 00:00 0                                 
[heap]
7fcc00c7d000-7fcc00c92000 r-xp 00000000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00c92000-7fcc00e91000 ---p 00015000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00e91000-7fcc00e92000 r--p 00014000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00e92000-7fcc00e93000 rw-p 00015000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00e93000-7fcc073ba000 r--p 00000000 fd:00 17268312                  
/usr/lib/locale/locale-archive
7fcc073ba000-7fcc07570000 r-xp 00000000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07570000-7fcc07770000 ---p 001b6000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07770000-7fcc07774000 r--p 001b6000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07774000-7fcc07776000 rw-p 001ba000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07776000-7fcc0777b000 rw-p 00000000 00:00 0
7fcc0777b000-7fcc0779c000 r-xp 00000000 fd:00 39470733                  
/usr/lib64/ld-2.17.so
7fcc0798a000-7fcc0798d000 rw-p 00000000 00:00 0
7fcc07999000-7fcc0799b000 rw-p 00000000 00:00 0
7fcc0799b000-7fcc0799c000 r--p 00020000 fd:00 39470733                  
/usr/lib64/ld-2.17.so
7fcc0799c000-7fcc0799d000 rw-p 00021000 fd:00 39470733                  
/usr/lib64/ld-2.17.so
7fcc0799d000-7fcc0799e000 rw-p 00000000 00:00 0
7ffff4948000-7ffff4969000 rw-p 00000000 00:00 0                         
[stack]
7ffff49fe000-7ffff4a00000 r-xp 00000000 00:00 0                         
[vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]

[moffatt <at> centos ~]$ yum info coreutils
Loaded plugins: fastestmirror, langpacks
Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast
Loading mirror speeds from cached hostfile
 * base: ftp.usf.edu
 * epel: archive.linux.duke.edu
 * extras: centos-distro.cavecreek.net
 * updates: centos.mirror.constant.com
Installed Packages
Name        : coreutils
Arch        : x86_64
Version     : 8.22
Release     : 11.el7
Size        : 14 M
Repo        : installed
From repo   : anaconda
Summary     : A set of basic GNU tools commonly used in shell scripts
URL         : http://www.gnu.org/software/coreutils/
License     : GPLv3+
Description : These are the GNU core utilities.  This package is the
combination of
            : the old GNU fileutils, sh-utils, and textutils packages.

moffatt <at> centos :~$ uname -a
Linux XXXXX 3.13.0-54-generic #91-Ubuntu SMP Tue May 26 19:15:08 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux


-------------------------------------------

DEBIAN 6.0.3 BOX

michael <at> debian:~$ date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015
04:00:35 +0000"'
*** glibc detected *** date: munmap_chunk(): invalid pointer:
0x00007ffff48c67d0 ***
======= Backtrace: =========
/lib/libc.so.6(+0x71e16)[0x7fc1ba269e16]
date[0x4040a8]
date[0x40244e]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7fc1ba216c8d]
date[0x401759]
======= Memory map: ========
00400000-0040e000 r-xp 00000000 ca:01 950349                            
/bin/date
0060e000-0060f000 rw-p 0000e000 ca:01 950349                            
/bin/date
0154a000-0156b000 rw-p 00000000 00:00 0                                 
[heap]
7fc1b9a7d000-7fc1b9a93000 r-xp 00000000 ca:01 328963                    
/lib/libgcc_s.so.1
7fc1b9a93000-7fc1b9c92000 ---p 00016000 ca:01 328963                    
/lib/libgcc_s.so.1
7fc1b9c92000-7fc1b9c93000 rw-p 00015000 ca:01 328963                    
/lib/libgcc_s.so.1
7fc1b9c93000-7fc1b9fdc000 r--p 00000000 ca:01 1151015                   
/usr/lib/locale/locale-archive
7fc1b9fdc000-7fc1b9ff3000 r-xp 00000000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1b9ff3000-7fc1ba1f2000 ---p 00017000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1ba1f2000-7fc1ba1f3000 r--p 00016000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1ba1f3000-7fc1ba1f4000 rw-p 00017000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1ba1f4000-7fc1ba1f8000 rw-p 00000000 00:00 0
7fc1ba1f8000-7fc1ba351000 r-xp 00000000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba351000-7fc1ba550000 ---p 00159000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba550000-7fc1ba554000 r--p 00158000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba554000-7fc1ba555000 rw-p 0015c000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba555000-7fc1ba55a000 rw-p 00000000 00:00 0
7fc1ba55a000-7fc1ba561000 r-xp 00000000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba561000-7fc1ba760000 ---p 00007000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba760000-7fc1ba761000 r--p 00006000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba761000-7fc1ba762000 rw-p 00007000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba762000-7fc1ba780000 r-xp 00000000 ca:01 329041                    
/lib/ld-2.11.3.so
7fc1ba976000-7fc1ba979000 rw-p 00000000 00:00 0
7fc1ba97d000-7fc1ba97f000 rw-p 00000000 00:00 0
7fc1ba97f000-7fc1ba980000 r--p 0001d000 ca:01 329041                    
/lib/ld-2.11.3.so
7fc1ba980000-7fc1ba981000 rw-p 0001e000 ca:01 329041                    
/lib/ld-2.11.3.so
7fc1ba981000-7fc1ba982000 rw-p 00000000 00:00 0
7ffff48b4000-7ffff48c9000 rw-p 00000000 00:00 0                         
[stack]
7ffff4902000-7ffff4903000 r-xp 00000000 00:00 0                         
[vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]
Aborted

root <at> debian:/home/michael# cat /etc/debian_version
6.0.10

root <at> debian:/home/michael# date --version
date (GNU coreutils) 8.5
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by David MacKenzie.

root <at> debian:/home/michael# uname -a
Linux XXXXX 2.6.32-5-xen-amd64 #1 SMP Tue May 13 18:41:58 UTC 2014 x86_64
GNU/Linux


-------------------------------------------

DEBIAN JESSIE/SID BOX

ubuntu <at> JESSIE:~$ date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015
04:00:35 +0000"'
date: invalid date ‘TZ="America/Los_Angeles" "Tue, 14 Jul 2015 04:00:35
+0000"’
ubuntu <at> JESSY:~$ cat /etc/debian_version
jessie/sid
ubuntu <at> zeus:~$ date --version
date (GNU coreutils) 8.21
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by David MacKenzie.

ubuntu <at> JESSY:~$ uname -a
Linux XXXXXXX 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux

-------------------------------------------

I can collect further debug if necessary, but the repro is fairly
straightforward.

Regards,
Michael Moffatt.

Message #8 received at 21186 <at> debbugs.gnu.org (full text, mbox):

From: Pádraig Brady <P <at> draigBrady.com>
To: michael <at> moffatt.org.nz, 21186 <at> debbugs.gnu.org
Subject: Re: bug#21186: date core with bad string
Date: Tue, 04 Aug 2015 16:55:53 +0100

unarchive 16872
forcemerge 21186 16872
stop

On 04/08/15 12:36, Michael Moffatt wrote:
> Hi there,
> 
> I inadvertently discovered that the following bad input leads to a date
> core. While I accept that I was throwing garbage at poor old date, I
> thought that the resulting core merited a bug report.
> 
> The string was:
> 
> date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015 04:00:35 +0000"'
> 
> I was doing this on Centos, but also verified the same issue on Debian
> (6.0.10) with coreutils 8.5 but the problem did NOT happen on another
> Debian (jessie/sid) box with coreutils 8.21.


This fix which was included in coreutils 8.23
and probably backported to debian:
http://git.sv.gnu.org/gitweb/?p=gnulib.git;a=commitdiff;h=a10acfb1d2

It's not been fixed in centos 7 yet:
https://bugzilla.redhat.com/1167548

cheers,
Pádraig.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.