Subject: bug#21213: closed (Re: bug#21213: Fwd: crash in colcrt util-linux)

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 07 Aug 2015 21:53:03 +0000

Your bug report

#21213: Fwd: crash in colcrt util-linux

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
21213: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=21213
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#21213: Fwd: crash in colcrt util-linux
From: Eric Blake <[email-masked]>
To: Alaa Mubaied <[email-masked]>, [email-masked], GNU bug control <[email-masked]>
Date: Fri, 7 Aug 2015 15:52:06 -0600
List-Id: <debbugs-submit.debbugs.gnu.org>

tag 21213 notabug
thanks

On 08/07/2015 02:41 PM, Alaa Mubaied wrote:
> Hi,
> 
> I found a crash in colcrt, (filter nroff output for CRT previewing) . - The
> colcrt command is part of the util-linux package and is available from
> Linux Kernel Archive

As you so aptly noted, colcrt is NOT part of coreutils, but part of
util-linux.  As this is not the util-linux mailing list, we can't help
you here, so I'm closing this as not a bug in the coreutils database.
However, that does not negate the fact that you have identified a
problem, nor does it prevent you from replying to this thread with more
details.

And if you do manage to report the bug correctly to the util-linux
folks, I would suggest that you also let them know that 'colcrt --help'
could be made more useful by displaying correct bug reporting
information, the way all of the coreutils already do.

-- 
Eric Blake   eblake redhat com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org

Subject: Fwd: crash in colcrt util-linux
From: Alaa Mubaied <[email-masked]>
To: [email-masked]
Date: Fri, 7 Aug 2015 13:41:18 -0700
List-Id: <debbugs-submit.debbugs.gnu.org>

Hi,

I found a crash in colcrt, (filter nroff output for CRT previewing) . - The
colcrt command is part of the util-linux package and is available from
Linux Kernel Archive
http://man7.org/linux/man-pages/man1/colcrt.1.html
https://www.kernel.org/pub/linux/utils/util-linux/v2.27/

*Details:*

platform: Linux x86/x64
Version: colcrt from util-linux-2.27

colcrt from util-linux-2.27 and below crashed by the use of colcrt command
line. the crash caused in colcrt.

when running colcrt with the following file (attached), it crashes because
i believe when colcrt.c:213 is called in colcrt.c, c returned it will
dereferencing pointer "cp" because "cp = &page[outline][outcol];" at line
205 where "cp" may point to element beyond "page" as buffer overrun. here
is the backtrace from gdb:

-bash-4.2$ gdb /opt/linuxtools/bin/colcrt
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /opt/linuxtools/bin/colcrt...done.
(gdb) r file
Starting program: /opt/linuxtools/bin/colcrt file

*Program received signal SIGSEGV, Segmentation fault.*

*216 cp[i] = c;*
colcrt (f=0x62b060) at text-utils/colcrt.c:216
Missing separate debuginfos, use: debuginfo-install
glibc-2.17-55.el7_0.5.x86_64
(gdb) bt full
#0  colcrt (f=0x62b060) at text-utils/colcrt.c:216
        c = <optimized out>
        cp = 0x606fe8 L""
        dp = <optimized out>
        i = 0
        w = 1
#1  0x00000000004015bc in main (argc=0, argv=0x7fffffffe5f8) at
text-utils/colcrt.c:139
        f = 0x62b060
        i = <optimized out>
        opt = <optimized out>
        longopts = {{name = 0x405d67 "no-underlining", has_arg = 0, flag =
0x0, val = 128}, {name = 0x405d76 "half-lines", has_arg = 0, flag = 0x0,
val = 50}, {
            name = 0x405d81 "version", has_arg = 0, flag = 0x0, val = 86},
{name = 0x405d89 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x0,
has_arg = 0, flag = 0x0, val = 0}}

Thanks
Ala'a