Subject: bug#21213: Fwd: crash in colcrt util-linux

From: Alaa Mubaied <[email-masked]>
Date: Fri, 7 Aug 2015 13:41:18 -0700

Hi,

I found a crash in colcrt, (filter nroff output for CRT previewing) . - The
colcrt command is part of the util-linux package and is available from
Linux Kernel Archive
http://man7.org/linux/man-pages/man1/colcrt.1.html
https://www.kernel.org/pub/linux/utils/util-linux/v2.27/

*Details:*

platform: Linux x86/x64
Version: colcrt from util-linux-2.27

colcrt from util-linux-2.27 and below crashed by the use of colcrt command
line. the crash caused in colcrt.

when running colcrt with the following file (attached), it crashes because
i believe when colcrt.c:213 is called in colcrt.c, c returned it will
dereferencing pointer "cp" because "cp = &page[outline][outcol];" at line
205 where "cp" may point to element beyond "page" as buffer overrun. here
is the backtrace from gdb:

-bash-4.2$ gdb /opt/linuxtools/bin/colcrt
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /opt/linuxtools/bin/colcrt...done.
(gdb) r file
Starting program: /opt/linuxtools/bin/colcrt file

*Program received signal SIGSEGV, Segmentation fault.*

*216 cp[i] = c;*
colcrt (f=0x62b060) at text-utils/colcrt.c:216
Missing separate debuginfos, use: debuginfo-install
glibc-2.17-55.el7_0.5.x86_64
(gdb) bt full
#0  colcrt (f=0x62b060) at text-utils/colcrt.c:216
        c = <optimized out>
        cp = 0x606fe8 L""
        dp = <optimized out>
        i = 0
        w = 1
#1  0x00000000004015bc in main (argc=0, argv=0x7fffffffe5f8) at
text-utils/colcrt.c:139
        f = 0x62b060
        i = <optimized out>
        opt = <optimized out>
        longopts = {{name = 0x405d67 "no-underlining", has_arg = 0, flag =
0x0, val = 128}, {name = 0x405d76 "half-lines", has_arg = 0, flag = 0x0,
val = 50}, {
            name = 0x405d81 "version", has_arg = 0, flag = 0x0, val = 86},
{name = 0x405d89 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x0,
has_arg = 0, flag = 0x0, val = 0}}

Thanks
Ala'a