From unknown Mon Aug 18 11:17:56 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#21213 <21213@debbugs.gnu.org> To: bug#21213 <21213@debbugs.gnu.org> Subject: Status: Fwd: crash in colcrt util-linux Reply-To: bug#21213 <21213@debbugs.gnu.org> Date: Mon, 18 Aug 2025 18:17:56 +0000 retitle 21213 Fwd: crash in colcrt util-linux reassign 21213 coreutils submitter 21213 Alaa Mubaied severity 21213 normal tag 21213 notabug thanks From debbugs-submit-bounces@debbugs.gnu.org Fri Aug 07 17:24:01 2015 Received: (at submit) by debbugs.gnu.org; 7 Aug 2015 21:24:01 +0000 Received: from localhost ([127.0.0.1]:50431 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZNp7Q-0008Uu-54 for submit@debbugs.gnu.org; Fri, 07 Aug 2015 17:24:01 -0400 Received: from eggs.gnu.org ([208.118.235.92]:34115) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZNoSI-0007Wd-6r for submit@debbugs.gnu.org; Fri, 07 Aug 2015 16:41:30 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZNoSB-00082W-FJ for submit@debbugs.gnu.org; Fri, 07 Aug 2015 16:41:25 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,FREEMAIL_FROM, HTML_MESSAGE,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:35648) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZNoSB-00082O-Bt for submit@debbugs.gnu.org; Fri, 07 Aug 2015 16:41:23 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47590) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZNoSA-0007H4-0H for bug-coreutils@gnu.org; Fri, 07 Aug 2015 16:41:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZNoS8-000819-FQ for bug-coreutils@gnu.org; Fri, 07 Aug 2015 16:41:21 -0400 Received: from mail-oi0-x22f.google.com ([2607:f8b0:4003:c06::22f]:36299) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZNoS8-00080w-7z for bug-coreutils@gnu.org; Fri, 07 Aug 2015 16:41:20 -0400 Received: by oiev193 with SMTP id v193so31388856oie.3 for ; Fri, 07 Aug 2015 13:41:19 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; bh=4NHZ/RiHPM0+YdcR2hxa33tz4FqQ37CiYkblVc3VgBE=; b=besvfX8ijDgsxwpdQYvPMUqCUVwnObGzs1XfmsUwTELwfBjMWLHSH0Mjtr526Do0P7 uUmgYCmfg4hbND69cmoNt18fH8Hbe+dLn0gHjktgyx9fVxPs8PT0I5sq4jd0flmjTXw/ S73+xL8V7gA+3KFIsYV0qaH9kvsgvTz9KwiaewhpFFBbSWcq/oEPXma8r833mKrFfRkx 5fq02DZGA3wqhDBOW2ecy0VEq/OVFOVvca3dTspLqNsM6xJ5jWhFmjeH7dV6pVPQPKsD oooMmdCUqbL4oB5HjoBNC0vpCBaQseoq3x8bP0VMrOEUuIF+f3LuurCKmpLN1KMsUncp Fzgg== MIME-Version: 1.0 X-Received: by 10.202.50.198 with SMTP id y189mr8236436oiy.21.1438980078857; Fri, 07 Aug 2015 13:41:18 -0700 (PDT) Received: by 10.76.150.6 with HTTP; Fri, 7 Aug 2015 13:41:18 -0700 (PDT) In-Reply-To: References: Date: Fri, 7 Aug 2015 13:41:18 -0700 Message-ID: Subject: Fwd: crash in colcrt util-linux From: Alaa Mubaied To: bug-coreutils@gnu.org Content-Type: multipart/mixed; boundary=001a113cfe70709564051cbea8c2 X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -4.0 (----) X-Debbugs-Envelope-To: submit X-Mailman-Approved-At: Fri, 07 Aug 2015 17:23:58 -0400 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -4.0 (----) --001a113cfe70709564051cbea8c2 Content-Type: multipart/alternative; boundary=001a113cfe7070955e051cbea8c0 --001a113cfe7070955e051cbea8c0 Content-Type: text/plain; charset=UTF-8 Hi, I found a crash in colcrt, (filter nroff output for CRT previewing) . - The colcrt command is part of the util-linux package and is available from Linux Kernel Archive http://man7.org/linux/man-pages/man1/colcrt.1.html https://www.kernel.org/pub/linux/utils/util-linux/v2.27/ *Details:* platform: Linux x86/x64 Version: colcrt from util-linux-2.27 colcrt from util-linux-2.27 and below crashed by the use of colcrt command line. the crash caused in colcrt. when running colcrt with the following file (attached), it crashes because i believe when colcrt.c:213 is called in colcrt.c, c returned it will dereferencing pointer "cp" because "cp = &page[outline][outcol];" at line 205 where "cp" may point to element beyond "page" as buffer overrun. here is the backtrace from gdb: -bash-4.2$ gdb /opt/linuxtools/bin/colcrt GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7 Copyright (C) 2013 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later This is free software: you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law. Type "show copying" and "show warranty" for details. This GDB was configured as "x86_64-redhat-linux-gnu". For bug reporting instructions, please see: ... Reading symbols from /opt/linuxtools/bin/colcrt...done. (gdb) r file Starting program: /opt/linuxtools/bin/colcrt file *Program received signal SIGSEGV, Segmentation fault.* *216 cp[i] = c;* colcrt (f=0x62b060) at text-utils/colcrt.c:216 Missing separate debuginfos, use: debuginfo-install glibc-2.17-55.el7_0.5.x86_64 (gdb) bt full #0 colcrt (f=0x62b060) at text-utils/colcrt.c:216 c = cp = 0x606fe8 L"" dp = i = 0 w = 1 #1 0x00000000004015bc in main (argc=0, argv=0x7fffffffe5f8) at text-utils/colcrt.c:139 f = 0x62b060 i = opt = longopts = {{name = 0x405d67 "no-underlining", has_arg = 0, flag = 0x0, val = 128}, {name = 0x405d76 "half-lines", has_arg = 0, flag = 0x0, val = 50}, { name = 0x405d81 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x405d89 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}} Thanks Ala'a --001a113cfe7070955e051cbea8c0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
Hi,

I found a c= rash in colcrt, (filter nroff output for CRT previewing) . -=C2=A0The colcr= t command is part of the util-linux package and is available from Linux Ker= nel Archive

Details:
platform: Linux x86= /x64
Version: colcrt from util-linux-2.27

colcrt=C2=A0from util-linux-2.27=C2=A0and below=C2=A0cra= shed by the use of=C2=A0colcrt=C2=A0command line. the crash caused in=C2=A0= colcrt.

<= div style=3D"font-size:12.8000001907349px">when running=C2=A0colcrt=C2=A0with the following file (= attached), it crashes because i believe when colcrt.c:213 is called in=C2= =A0colcrt.c, c returned it will dereferencing pointer "cp" becaus= e "cp =3D &page[outline][outcol];" at line 205 where "cp= " may point to element beyond "page" as buffer overrun. here= is the backtrace from gdb:

-bash-4.2$ gdb /opt/linuxtools/bin/colcrt= =C2=A0
GNU gdb (GDB) Red Hat Enterprise = Linux 7.6.1-51.el7
Copyright (C) 2013 Fr= ee Software Foundation, Inc.
License GPL= v3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and = redistribute it.
There is NO WARRANTY, t= o the extent permitted by law.=C2=A0 Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redh= at-linux-gnu".
For bug reporting in= structions, please see:
Reading sy= mbols from /opt/linuxtools/bin/colcrt...done.
(gdb) r file
Starting program: /op= t/linuxtools/bin/colcrt=C2=A0file

= Program received signal SIGSEGV, Segmentation fault.
216 = cp[i] =3D c;
colcrt = (f=3D0x62b060) at text-utils/colcrt.c:216
Missing separate debuginfos, use: debuginfo-install glibc-2.17-55.e= l7_0.5.x86_64
(gdb) bt full
#0 =C2=A0colcrt (f=3D0x62b060) at text-utils/colcrt.c:2= 16
=C2=A0 =C2=A0 =C2=A0 =C2=A0 c =3D <= ;optimized out>
=C2=A0 =C2=A0 =C2=A0 = =C2=A0 cp =3D 0x606fe8 L""
=C2= =A0 =C2=A0 =C2=A0 =C2=A0 dp =3D <optimized out>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 i =3D 0
<= span style=3D"font-size:12.8000001907349px">=C2=A0 =C2=A0 =C2=A0 =C2=A0 w =3D 1
#1 =C2=A00x00000000004015bc in main (argc=3D0, argv=3D0x7fffffffe5f8)= at text-utils/colcrt.c:139
=C2=A0 =C2= =A0 =C2=A0 =C2=A0 f =3D 0x62b060
=C2=A0 = =C2=A0 =C2=A0 =C2=A0 i =3D <optimized out>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 opt =3D <optimized out>
=C2=A0 =C2=A0 =C2=A0 =C2=A0 longopts =3D {{name = =3D 0x405d67 "no-underlining", has_arg =3D 0, flag =3D 0x0, val = =3D 128}, {name =3D 0x405d76 "half-lines", has_arg =3D 0, flag = =3D 0x0, val =3D 50}, {
=C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 name =3D 0x405d81 "version", has_arg = =3D 0, flag =3D 0x0, val =3D 86}, {name =3D 0x405d89 "help", has_= arg =3D 0, flag =3D 0x0, val =3D 104}, {name =3D 0x0, has_arg =3D 0, flag = =3D 0x0,=C2=A0val =3D 0= }}
Thanks=C2=A0
Ala'a

--001a113cfe7070955e051cbea8c0-- --001a113cfe70709564051cbea8c2 Content-Type: application/octet-stream; name=file Content-Disposition: attachment; filename=file Content-Transfer-Encoding: base64 X-Attachment-Id: f_id1w9k1g0 XxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXABAXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcX FxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXVxcXFxcXFxcXFxcX FxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcX FxcXFxcXFxcXFxcXFxcXFxcXFxcXDxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcXFxcX FxcXFxcXFxcXFxcXFxcXFw8XFxcXFxcXFxcXFxcXX1U7X19fX1U7X19EX19mX1U7X19EX19mX19f X0RfX2ZfX19fPl9fICBfQFdfX11+X19fS19flH4= --001a113cfe70709564051cbea8c2-- From debbugs-submit-bounces@debbugs.gnu.org Fri Aug 07 17:52:17 2015 Received: (at control) by debbugs.gnu.org; 7 Aug 2015 21:52:17 +0000 Received: from localhost ([127.0.0.1]:50438 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZNpYn-0000jF-1l for submit@debbugs.gnu.org; Fri, 07 Aug 2015 17:52:17 -0400 Received: from mx1.redhat.com ([209.132.183.28]:38063) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZNpYj-0000j0-Rp; Fri, 07 Aug 2015 17:52:14 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by mx1.redhat.com (Postfix) with ESMTPS id 7D34BAACCC; Fri, 7 Aug 2015 21:52:12 +0000 (UTC) Received: from [10.3.113.187] (ovpn-113-187.phx2.redhat.com [10.3.113.187]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t77LqB3L016045; Fri, 7 Aug 2015 17:52:12 -0400 Subject: Re: bug#21213: Fwd: crash in colcrt util-linux To: Alaa Mubaied , 21213-done@debbugs.gnu.org, GNU bug control References: From: Eric Blake Openpgp: url=http://people.redhat.com/eblake/eblake.gpg Organization: Red Hat, Inc. Message-ID: <55C52886.7050905@redhat.com> Date: Fri, 7 Aug 2015 15:52:06 -0600 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.1.0 MIME-Version: 1.0 In-Reply-To: Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="TjlrbHTHhjNos3DNxo35jUHbhOqpkCx8W" X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Spam-Score: -5.1 (-----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.1 (-----) This is an OpenPGP/MIME signed message (RFC 4880 and 3156) --TjlrbHTHhjNos3DNxo35jUHbhOqpkCx8W Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable tag 21213 notabug thanks On 08/07/2015 02:41 PM, Alaa Mubaied wrote: > Hi, >=20 > I found a crash in colcrt, (filter nroff output for CRT previewing) . -= The > colcrt command is part of the util-linux package and is available from > Linux Kernel Archive As you so aptly noted, colcrt is NOT part of coreutils, but part of util-linux. As this is not the util-linux mailing list, we can't help you here, so I'm closing this as not a bug in the coreutils database. However, that does not negate the fact that you have identified a problem, nor does it prevent you from replying to this thread with more details. And if you do manage to report the bug correctly to the util-linux folks, I would suggest that you also let them know that 'colcrt --help' could be made more useful by displaying correct bug reporting information, the way all of the coreutils already do. --=20 Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --TjlrbHTHhjNos3DNxo35jUHbhOqpkCx8W Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ iQEcBAEBCAAGBQJVxSiGAAoJEKeha0olJ0NqLRAH/3aPFATSh3OmGs5HOJ/NHc/S fl3K5t7ElC6uyYBTDpra5wBZZ4mfWYMKIhffRl6BHHcG9C8ZiMNyET/2bPYzimGy kBOL4lS0C0xtHWMjqPph3ivcb27PQvbfMiHJyMR96fTDz5PLCDjUmrZGOLXfakZm SEiMNHJxdJahdKuMEWytX1dmTwUd1jLA9q/G0cXyxhgwJkFtbF6jPtMUrxflLHub VzvOjv0dAdkbdJYOS+ii/YkODxFOs+cZpkLrbvn6SrUyeHcZGqtt5lB/D+Om6bzX 5EB+nq7FJ8TcoPc2EwUZOQGnX209rUV5Xe2We5UlUfa84PXM0snrFHyRf6g3d9I= =9TXC -----END PGP SIGNATURE----- --TjlrbHTHhjNos3DNxo35jUHbhOqpkCx8W-- From unknown Mon Aug 18 11:17:56 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Sat, 05 Sep 2015 11:24:05 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator