Subject: date core with bad string

From: "Michael Moffatt" <[email-masked]>
Date: Tue, 4 Aug 2015 13:36:11 +0200

Hi there,

I inadvertently discovered that the following bad input leads to a date
core. While I accept that I was throwing garbage at poor old date, I
thought that the resulting core merited a bug report.

The string was:

date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015 04:00:35 +0000"'

I was doing this on Centos, but also verified the same issue on Debian
(6.0.10) with coreutils 8.5 but the problem did NOT happen on another
Debian (jessie/sid) box with coreutils 8.21.

CENTOS BOX:

[moffatt@centos ~]$ date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015
04:00:35 +0000"'
*** Error in `date': free(): invalid size: 0x00007ffff49666b0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7d19d)[0x7fcc0743719d]
date[0x4065e0]
date[0x402245]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fcc073dbaf5]
date[0x402275]
======= Memory map: ========
00400000-0040e000 r-xp 00000000 fd:00 17170463                          
/usr/bin/date
0060d000-0060e000 r--p 0000d000 fd:00 17170463                          
/usr/bin/date
0060e000-0060f000 rw-p 0000e000 fd:00 17170463                          
/usr/bin/date
01df1000-01e12000 rw-p 00000000 00:00 0                                 
[heap]
7fcc00c7d000-7fcc00c92000 r-xp 00000000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00c92000-7fcc00e91000 ---p 00015000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00e91000-7fcc00e92000 r--p 00014000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00e92000-7fcc00e93000 rw-p 00015000 fd:00 39470731                  
/usr/lib64/libgcc_s-4.8.2-20140120.so.1
7fcc00e93000-7fcc073ba000 r--p 00000000 fd:00 17268312                  
/usr/lib/locale/locale-archive
7fcc073ba000-7fcc07570000 r-xp 00000000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07570000-7fcc07770000 ---p 001b6000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07770000-7fcc07774000 r--p 001b6000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07774000-7fcc07776000 rw-p 001ba000 fd:00 39470740                  
/usr/lib64/libc-2.17.so
7fcc07776000-7fcc0777b000 rw-p 00000000 00:00 0
7fcc0777b000-7fcc0779c000 r-xp 00000000 fd:00 39470733                  
/usr/lib64/ld-2.17.so
7fcc0798a000-7fcc0798d000 rw-p 00000000 00:00 0
7fcc07999000-7fcc0799b000 rw-p 00000000 00:00 0
7fcc0799b000-7fcc0799c000 r--p 00020000 fd:00 39470733                  
/usr/lib64/ld-2.17.so
7fcc0799c000-7fcc0799d000 rw-p 00021000 fd:00 39470733                  
/usr/lib64/ld-2.17.so
7fcc0799d000-7fcc0799e000 rw-p 00000000 00:00 0
7ffff4948000-7ffff4969000 rw-p 00000000 00:00 0                         
[stack]
7ffff49fe000-7ffff4a00000 r-xp 00000000 00:00 0                         
[vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]

[moffatt@centos ~]$ yum info coreutils
Loaded plugins: fastestmirror, langpacks
Repodata is over 2 weeks old. Install yum-cron? Or run: yum makecache fast
Loading mirror speeds from cached hostfile
 * base: ftp.usf.edu
 * epel: archive.linux.duke.edu
 * extras: centos-distro.cavecreek.net
 * updates: centos.mirror.constant.com
Installed Packages
Name        : coreutils
Arch        : x86_64
Version     : 8.22
Release     : 11.el7
Size        : 14 M
Repo        : installed
>From repo   : anaconda
Summary     : A set of basic GNU tools commonly used in shell scripts
URL         : http://www.gnu.org/software/coreutils/
License     : GPLv3+
Description : These are the GNU core utilities.  This package is the
combination of
            : the old GNU fileutils, sh-utils, and textutils packages.

moffatt@centos :~$ uname -a
Linux XXXXX 3.13.0-54-generic #91-Ubuntu SMP Tue May 26 19:15:08 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux

-------------------------------------------

DEBIAN 6.0.3 BOX

michael@debian:~$ date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015
04:00:35 +0000"'
*** glibc detected *** date: munmap_chunk(): invalid pointer:
0x00007ffff48c67d0 ***
======= Backtrace: =========
/lib/libc.so.6(+0x71e16)[0x7fc1ba269e16]
date[0x4040a8]
date[0x40244e]
/lib/libc.so.6(__libc_start_main+0xfd)[0x7fc1ba216c8d]
date[0x401759]
======= Memory map: ========
00400000-0040e000 r-xp 00000000 ca:01 950349                            
/bin/date
0060e000-0060f000 rw-p 0000e000 ca:01 950349                            
/bin/date
0154a000-0156b000 rw-p 00000000 00:00 0                                 
[heap]
7fc1b9a7d000-7fc1b9a93000 r-xp 00000000 ca:01 328963                    
/lib/libgcc_s.so.1
7fc1b9a93000-7fc1b9c92000 ---p 00016000 ca:01 328963                    
/lib/libgcc_s.so.1
7fc1b9c92000-7fc1b9c93000 rw-p 00015000 ca:01 328963                    
/lib/libgcc_s.so.1
7fc1b9c93000-7fc1b9fdc000 r--p 00000000 ca:01 1151015                   
/usr/lib/locale/locale-archive
7fc1b9fdc000-7fc1b9ff3000 r-xp 00000000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1b9ff3000-7fc1ba1f2000 ---p 00017000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1ba1f2000-7fc1ba1f3000 r--p 00016000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1ba1f3000-7fc1ba1f4000 rw-p 00017000 ca:01 329040                    
/lib/libpthread-2.11.3.so
7fc1ba1f4000-7fc1ba1f8000 rw-p 00000000 00:00 0
7fc1ba1f8000-7fc1ba351000 r-xp 00000000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba351000-7fc1ba550000 ---p 00159000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba550000-7fc1ba554000 r--p 00158000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba554000-7fc1ba555000 rw-p 0015c000 ca:01 329045                    
/lib/libc-2.11.3.so
7fc1ba555000-7fc1ba55a000 rw-p 00000000 00:00 0
7fc1ba55a000-7fc1ba561000 r-xp 00000000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba561000-7fc1ba760000 ---p 00007000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba760000-7fc1ba761000 r--p 00006000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba761000-7fc1ba762000 rw-p 00007000 ca:01 329042                    
/lib/librt-2.11.3.so
7fc1ba762000-7fc1ba780000 r-xp 00000000 ca:01 329041                    
/lib/ld-2.11.3.so
7fc1ba976000-7fc1ba979000 rw-p 00000000 00:00 0
7fc1ba97d000-7fc1ba97f000 rw-p 00000000 00:00 0
7fc1ba97f000-7fc1ba980000 r--p 0001d000 ca:01 329041                    
/lib/ld-2.11.3.so
7fc1ba980000-7fc1ba981000 rw-p 0001e000 ca:01 329041                    
/lib/ld-2.11.3.so
7fc1ba981000-7fc1ba982000 rw-p 00000000 00:00 0
7ffff48b4000-7ffff48c9000 rw-p 00000000 00:00 0                         
[stack]
7ffff4902000-7ffff4903000 r-xp 00000000 00:00 0                         
[vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                 
[vsyscall]
Aborted

root@debian:/home/michael# cat /etc/debian_version
6.0.10

root@debian:/home/michael# date --version
date (GNU coreutils) 8.5
Copyright (C) 2010 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by David MacKenzie.

root@debian:/home/michael# uname -a
Linux XXXXX 2.6.32-5-xen-amd64 #1 SMP Tue May 13 18:41:58 UTC 2014 x86_64
GNU/Linux

-------------------------------------------

DEBIAN JESSIE/SID BOX

ubuntu@JESSIE:~$ date +%s -d'TZ="America/Los_Angeles" "Tue, 14 Jul 2015
04:00:35 +0000"'
date: invalid date ‘TZ="America/Los_Angeles" "Tue, 14 Jul 2015 04:00:35
+0000"’
ubuntu@JESSY:~$ cat /etc/debian_version
jessie/sid
ubuntu@zeus:~$ date --version
date (GNU coreutils) 8.21
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>.
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

Written by David MacKenzie.

ubuntu@JESSY:~$ uname -a
Linux XXXXXXX 3.13.0-24-generic #47-Ubuntu SMP Fri May 2 23:30:00 UTC 2014
x86_64 x86_64 x86_64 GNU/Linux

-------------------------------------------

I can collect further debug if necessary, but the repro is fairly
straightforward.

Regards,
Michael Moffatt.