From unknown Wed Jun 18 23:03:33 2025 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-Mailer: MIME-tools 5.509 (Entity 5.509) Content-Type: text/plain; charset=utf-8 From: bug#21611 <21611@debbugs.gnu.org> To: bug#21611 <21611@debbugs.gnu.org> Subject: Status: probable bug in tee: tee overwrites argv[argc] (coreutils-8.24) Reply-To: bug#21611 <21611@debbugs.gnu.org> Date: Thu, 19 Jun 2025 06:03:33 +0000 retitle 21611 probable bug in tee: tee overwrites argv[argc] (coreutils-8.2= 4) reassign 21611 coreutils submitter 21611 Rainer Deyke severity 21611 normal thanks From debbugs-submit-bounces@debbugs.gnu.org Sat Oct 03 09:24:16 2015 Received: (at submit) by debbugs.gnu.org; 3 Oct 2015 13:24:16 +0000 Received: from localhost ([127.0.0.1]:52949 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZiMnO-0002MM-Ru for submit@debbugs.gnu.org; Sat, 03 Oct 2015 09:24:16 -0400 Received: from eggs.gnu.org ([208.118.235.92]:48716) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZiJRn-00048Z-DH for submit@debbugs.gnu.org; Sat, 03 Oct 2015 05:49:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZiJRm-00082k-8r for submit@debbugs.gnu.org; Sat, 03 Oct 2015 05:49:43 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50,T_DKIM_INVALID autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([208.118.235.17]:33324) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZiJRm-00082f-5U for submit@debbugs.gnu.org; Sat, 03 Oct 2015 05:49:42 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58706) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZiJRl-0001HP-9X for bug-coreutils@gnu.org; Sat, 03 Oct 2015 05:49:42 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZiJRe-00080G-JG for bug-coreutils@gnu.org; Sat, 03 Oct 2015 05:49:41 -0400 Received: from gproxy9-pub.mail.unifiedlayer.com ([69.89.20.122]:40343) by eggs.gnu.org with smtp (Exim 4.71) (envelope-from ) id 1ZiJRe-0007zR-9r for bug-coreutils@gnu.org; Sat, 03 Oct 2015 05:49:34 -0400 Received: (qmail 18621 invoked by uid 0); 3 Oct 2015 09:49:25 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy9.mail.unifiedlayer.com with SMTP; 3 Oct 2015 09:49:25 -0000 Received: from box522.bluehost.com ([74.220.219.122]) by CMOut01 with id QZpG1r0072f2jeq01ZpKsT; Sat, 03 Oct 2015 03:49:24 -0600 X-Authority-Analysis: v=2.1 cv=VOBOwb/X c=1 sm=1 tr=0 a=GsOEXm/OWkKvwdLVJsfwcA==:117 a=GsOEXm/OWkKvwdLVJsfwcA==:17 a=cNaOj0WVAAAA:8 a=f5113yIGAAAA:8 a=56pGwcx7AAAA:8 a=EUBy9LwrJNMA:10 a=GtewkceCZh0A:10 a=5lJygRwiOn0A:10 a=r77TgQKjGQsHNAKrUKIA:9 a=3i2ufHNYTxbYU0pKmOkA:9 a=QEXdDO2ut3YA:10 a=tjHkC8YYvjsA:10 a=L8Odz-K4S_41HXqFgN0A:9 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=eldwood.com; s=default; h=Content-Type:MIME-Version:Date:Message-ID:Subject:From:To; bh=HNwBsSIR++k3w9AXeb8e1FWLBgJoHMZxHVE7oZfwMHs=; b=ptDLKkvAuBhhZW5oHLAm+pVgRAlEYe8jylNKW7FGM2uaftM6HLVfFv/593GlAp2cbvM1fDvDZscNCbWedcXP22HxWYJzO4IoxDapbSg8neMex/Xb52iJ84/QzIlUuH+j; Received: from [79.217.149.64] (port=37850 helo=[192.168.0.6]) by box522.bluehost.com with esmtpsa (TLSv1.2:DHE-RSA-AES128-SHA:128) (Exim 4.84) (envelope-from ) id 1ZiJRM-0007wp-DE for bug-coreutils@gnu.org; Sat, 03 Oct 2015 03:49:17 -0600 To: bug-coreutils@gnu.org From: Rainer Deyke Subject: probable bug in tee: tee overwrites argv[argc] (coreutils-8.24) Message-ID: <560FA48B.4030908@eldwood.com> Date: Sat, 3 Oct 2015 11:48:59 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="------------060603060206010102050409" X-Identified-User: {37072:box522.bluehost.com:feynacom:eldwood.com} {sentby:smtp auth 79.217.149.64 authed with rainerd+eldwood.com} X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 208.118.235.17 X-Spam-Score: -5.0 (-----) X-Debbugs-Envelope-To: submit X-Mailman-Approved-At: Sat, 03 Oct 2015 09:24:12 -0400 X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) This is a multi-part message in MIME format. --------------060603060206010102050409 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit As mentioned in a comment on line 198 of 'tee.c', 'tee' overwrites 'argv[argc]'. This is very bad style at best, and probably undefined behavior on at least some platforms. The attached patch replaces the current hack with another hack that is still bad style, but probably safer than the current hack. -- Rainer Deyke (rainerd@eldwood.com) --------------060603060206010102050409 Content-Type: text/plain; charset=UTF-8; name="patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="patch" LS0tIHRlZS5jCTIwMTUtMDYtMjYgMTk6MDQ6MTkuMDAwMDAwMDAwICswMjAwCisrKyB0ZWUt Zml4LmMJMjAxNS0xMC0wMyAxMTozNTozNy4xOTAyNDU3ODYgKzAyMDAKQEAgLTE5NCwxMCAr MTk0LDEyIEBACiAKICAgZGVzY3JpcHRvcnMgPSB4bm1hbGxvYyAobmZpbGVzICsgMSwgc2l6 ZW9mICpkZXNjcmlwdG9ycyk7CiAKLSAgLyogTW92ZSBhbGwgdGhlIG5hbWVzICd1cCcgb25l IGluIHRoZSBhcmd2IGFycmF5IHRvIG1ha2Ugcm9vbSBmb3IKLSAgICAgdGhlIGVudHJ5IGZv ciBzdGFuZGFyZCBvdXRwdXQuICBUaGlzIHdyaXRlcyBpbnRvIGFyZ3ZbYXJnY10uICAqLwot ICBmb3IgKGkgPSBuZmlsZXM7IGkgPj0gMTsgaS0tKQotICAgIGZpbGVzW2ldID0gZmlsZXNb aSAtIDFdOworICAvKiBFZmZlY3RpdmVseSBtb3ZlIGFsbCB0aGUgbmFtZXMgJ3VwJyBvbmUg aW4gdGhlIGFyZ3YgYXJyYXkgdG8KKyAgICAgbWFrZSByb29tIGZvciB0aGUgZW50cnkgZm9y IHN0YW5kYXJkIG91dHB1dC4gIFRoaXMgd2lsbCBjYXVzZQorICAgICB0aGUgZWxlbWVudCBv ZiBhcmd2IGltbWVkaWF0ZWx5IGJlZm9yZSB0aGUgbGlzdCBvZiBmaWxlCisgICAgIChlaXRo ZXIgYW4gb3B0aW9ucyBhcmd1bWVudCBvciBhcmd2WzBdKSB0byBiZSBvdmVyd3JpdHRlbgor ICAgICBsYXRlci4gKi8KKyAgZmlsZXMtLTsKIAogICBpZiAoT19CSU5BUlkgJiYgISBpc2F0 dHkgKFNURElOX0ZJTEVOTykpCiAgICAgeGZyZW9wZW4gKE5VTEwsICJyYiIsIHN0ZGluKTsK --------------060603060206010102050409-- From debbugs-submit-bounces@debbugs.gnu.org Sat Oct 03 20:07:01 2015 Received: (at 21611-done) by debbugs.gnu.org; 4 Oct 2015 00:07:02 +0000 Received: from localhost ([127.0.0.1]:54033 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZiWpR-0001B8-2u for submit@debbugs.gnu.org; Sat, 03 Oct 2015 20:07:01 -0400 Received: from zimbra.cs.ucla.edu ([131.179.128.68]:33670) by debbugs.gnu.org with esmtp (Exim 4.80) (envelope-from ) id 1ZiWpO-0001Az-09 for 21611-done@debbugs.gnu.org; Sat, 03 Oct 2015 20:06:59 -0400 Received: from localhost (localhost [127.0.0.1]) by zimbra.cs.ucla.edu (Postfix) with ESMTP id 17B2D160E41; Sat, 3 Oct 2015 17:06:57 -0700 (PDT) Received: from zimbra.cs.ucla.edu ([127.0.0.1]) by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10032) with ESMTP id 2O75oESDTJVg; Sat, 3 Oct 2015 17:06:55 -0700 (PDT) Received: from localhost (localhost [127.0.0.1]) by zimbra.cs.ucla.edu (Postfix) with ESMTP id C0F19160ED6; Sat, 3 Oct 2015 17:06:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at zimbra.cs.ucla.edu Received: from zimbra.cs.ucla.edu ([127.0.0.1]) by localhost (zimbra.cs.ucla.edu [127.0.0.1]) (amavisd-new, port 10026) with ESMTP id UyDK3F31hm8x; Sat, 3 Oct 2015 17:06:55 -0700 (PDT) Received: from [192.168.1.9] (pool-100-32-155-148.lsanca.fios.verizon.net [100.32.155.148]) by zimbra.cs.ucla.edu (Postfix) with ESMTPSA id 980AB160E41; Sat, 3 Oct 2015 17:06:55 -0700 (PDT) Subject: Re: bug#21611: probable bug in tee: tee overwrites argv[argc] (coreutils-8.24) To: Rainer Deyke , 21611-done@debbugs.gnu.org References: <560FA48B.4030908@eldwood.com> From: Paul Eggert Organization: UCLA Computer Science Department Message-ID: <56106D9C.4080400@cs.ucla.edu> Date: Sat, 3 Oct 2015 17:06:52 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 MIME-Version: 1.0 In-Reply-To: <560FA48B.4030908@eldwood.com> Content-Type: multipart/mixed; boundary="------------090800020403090607000102" X-Spam-Score: -0.0 (/) X-Debbugs-Envelope-To: 21611-done X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -0.0 (/) This is a multi-part message in MIME format. --------------090800020403090607000102 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Rainer Deyke wrote: > As mentioned in a comment on line 198 of 'tee.c', 'tee' overwrites > 'argv[argc]'. This is very bad style at best, and probably undefined behavior > on at least some platforms. Thanks for the report. It's well-defined behavior on any platform conforming to the C standard, so it should be quite safe. That being said, it's a bit faster to subtract 1 from a pointer than to do the equivalent of a memmove of an array, so it sounds a bit faster to do things the way you suggest. Cleaner, too. I installed the attached patch. --------------090800020403090607000102 Content-Type: text/plain; charset=UTF-8; name="0001-tee-simplify-argv-handling.patch" Content-Transfer-Encoding: base64 Content-Disposition: attachment; filename="0001-tee-simplify-argv-handling.patch" RnJvbSA1MGM0MTg5MTUyM2UwNzlmODdiYTI4NDliMGI0N2M1YzllYjNhM2NhIE1vbiBTZXAg MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQYXVsIEVnZ2VydCA8ZWdnZXJ0QGNzLnVjbGEuZWR1 PgpEYXRlOiBTYXQsIDMgT2N0IDIwMTUgMTc6MDE6MzIgLTA3MDAKU3ViamVjdDogW1BBVENI XSB0ZWU6IHNpbXBsaWZ5IGFyZ3YgaGFuZGxpbmcKCiogc3JjL3RlZS5jICh0ZWVfZmlsZXMp OiBMYXN0IGFyZyBpcyBub3cgY2hhciAqKiBpbnN0ZWFkIG9mIGNoYXIKY29uc3QgKiosIGFz IHRoYXQgaXMgYSBiaXQgc2ltcGxlci4gIEFsbCBjYWxsZXJzIGNoYW5nZWQuICBNb2RpZnkK ZmlsZXNbLTFdLCBub3QgZmlsZXNbbmZpbGVzXSwgYXMgdGhhdCBpcyBhIGJpdCBmYXN0ZXIg YW5kIHNpbXBsZXIuCkxhdHRlciBwcm9ibGVtIHBvaW50ZWQgb3V0IGJ5IFJhaW5lciBEZXlr ZSBpbjoKaHR0cDovL2J1Z3MuZ251Lm9yZy8yMTYxMQotLS0KIHNyYy90ZWUuYyB8IDI0ICsr KysrKysrKystLS0tLS0tLS0tLS0tLQogMSBmaWxlIGNoYW5nZWQsIDEwIGluc2VydGlvbnMo KyksIDE0IGRlbGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL3NyYy90ZWUuYyBiL3NyYy90ZWUu YwppbmRleCAzNTEyMGY4Li4zNTBhMjAxIDEwMDY0NAotLS0gYS9zcmMvdGVlLmMKKysrIGIv c3JjL3RlZS5jCkBAIC0zNiw3ICszNiw3IEBACiAgIHByb3Blcl9uYW1lICgiUmljaGFyZCBN LiBTdGFsbG1hbiIpLCBcCiAgIHByb3Blcl9uYW1lICgiRGF2aWQgTWFjS2VuemllIikKIAot c3RhdGljIGJvb2wgdGVlX2ZpbGVzIChpbnQgbmZpbGVzLCBjb25zdCBjaGFyICoqZmlsZXMp Oworc3RhdGljIGJvb2wgdGVlX2ZpbGVzIChpbnQgbmZpbGVzLCBjaGFyICoqZmlsZXMpOwog CiAvKiBJZiB0cnVlLCBhcHBlbmQgdG8gb3V0cHV0IGZpbGVzIHJhdGhlciB0aGFuIHRydW5j YXRpbmcgdGhlbS4gKi8KIHN0YXRpYyBib29sIGFwcGVuZDsKQEAgLTE2OCw3ICsxNjgsNyBA QCBtYWluIChpbnQgYXJnYywgY2hhciAqKmFyZ3YpCiAgIC8qIERvICpub3QqIHdhcm4gaWYg dGVlIGlzIGdpdmVuIG5vIGZpbGUgYXJndW1lbnRzLgogICAgICBQT1NJWCByZXF1aXJlcyB0 aGF0IGl0IHdvcmsgd2hlbiBnaXZlbiBubyBhcmd1bWVudHMuICAqLwogCi0gIG9rID0gdGVl X2ZpbGVzIChhcmdjIC0gb3B0aW5kLCAoY29uc3QgY2hhciAqKikgJmFyZ3Zbb3B0aW5kXSk7 CisgIG9rID0gdGVlX2ZpbGVzIChhcmdjIC0gb3B0aW5kLCAmYXJndltvcHRpbmRdKTsKICAg aWYgKGNsb3NlIChTVERJTl9GSUxFTk8pICE9IDApCiAgICAgZXJyb3IgKEVYSVRfRkFJTFVS RSwgZXJybm8sIF8oInN0YW5kYXJkIGlucHV0IikpOwogCkBAIC0xNzYsMTEgKzE3NiwxMSBA QCBtYWluIChpbnQgYXJnYywgY2hhciAqKmFyZ3YpCiB9CiAKIC8qIENvcHkgdGhlIHN0YW5k YXJkIGlucHV0IGludG8gZWFjaCBvZiB0aGUgTkZJTEVTIGZpbGVzIGluIEZJTEVTCi0gICBh bmQgaW50byB0aGUgc3RhbmRhcmQgb3V0cHV0LgorICAgYW5kIGludG8gdGhlIHN0YW5kYXJk IG91dHB1dC4gIEFzIGEgc2lkZSBlZmZlY3QsIG1vZGlmeSBGSUxFU1stMV0uCiAgICBSZXR1 cm4gdHJ1ZSBpZiBzdWNjZXNzZnVsLiAgKi8KIAogc3RhdGljIGJvb2wKLXRlZV9maWxlcyAo aW50IG5maWxlcywgY29uc3QgY2hhciAqKmZpbGVzKQordGVlX2ZpbGVzIChpbnQgbmZpbGVz LCBjaGFyICoqZmlsZXMpCiB7CiAgIHNpemVfdCBuX291dHB1dHMgPSAwOwogICBGSUxFICoq ZGVzY3JpcHRvcnM7CkBAIC0xOTMsMTMgKzE5Myw2IEBAIHRlZV9maWxlcyAoaW50IG5maWxl cywgY29uc3QgY2hhciAqKmZpbGVzKQogICAgICA/IChhcHBlbmQgPyAiYWIiIDogIndiIikK ICAgICAgOiAoYXBwZW5kID8gImEiIDogInciKSk7CiAKLSAgZGVzY3JpcHRvcnMgPSB4bm1h bGxvYyAobmZpbGVzICsgMSwgc2l6ZW9mICpkZXNjcmlwdG9ycyk7Ci0KLSAgLyogTW92ZSBh bGwgdGhlIG5hbWVzICd1cCcgb25lIGluIHRoZSBhcmd2IGFycmF5IHRvIG1ha2Ugcm9vbSBm b3IKLSAgICAgdGhlIGVudHJ5IGZvciBzdGFuZGFyZCBvdXRwdXQuICBUaGlzIHdyaXRlcyBp bnRvIGFyZ3ZbYXJnY10uICAqLwotICBmb3IgKGkgPSBuZmlsZXM7IGkgPj0gMTsgaS0tKQot ICAgIGZpbGVzW2ldID0gZmlsZXNbaSAtIDFdOwotCiAgIGlmIChPX0JJTkFSWSAmJiAhIGlz YXR0eSAoU1RESU5fRklMRU5PKSkKICAgICB4ZnJlb3BlbiAoTlVMTCwgInJiIiwgc3RkaW4p OwogICBpZiAoT19CSU5BUlkgJiYgISBpc2F0dHkgKFNURE9VVF9GSUxFTk8pKQpAQCAtMjA3 LDEwICsyMDAsMTMgQEAgdGVlX2ZpbGVzIChpbnQgbmZpbGVzLCBjb25zdCBjaGFyICoqZmls ZXMpCiAKICAgZmFkdmlzZSAoc3RkaW4sIEZBRFZJU0VfU0VRVUVOVElBTCk7CiAKLSAgLyog SW4gdGhlIGFycmF5IG9mIE5GSUxFUyArIDEgZGVzY3JpcHRvcnMsIG1ha2UKLSAgICAgdGhl IGZpcnN0IG9uZSBjb3JyZXNwb25kIHRvIHN0YW5kYXJkIG91dHB1dC4gICAqLworICAvKiBT ZXQgdXAgRklMRVNbMCAuLiBORklMRVNdIGFuZCBERVNDUklQVE9SU1swIC4uIE5GSUxFU10u CisgICAgIEluIGJvdGggYXJyYXlzLCBlbnRyeSAwIGNvcnJlc3BvbmRzIHRvIHN0YW5kYXJk IG91dHB1dC4gICovCisKKyAgZGVzY3JpcHRvcnMgPSB4bm1hbGxvYyAobmZpbGVzICsgMSwg c2l6ZW9mICpkZXNjcmlwdG9ycyk7CisgIGZpbGVzLS07CiAgIGRlc2NyaXB0b3JzWzBdID0g c3Rkb3V0OwotICBmaWxlc1swXSA9IF8oInN0YW5kYXJkIG91dHB1dCIpOworICBmaWxlc1sw XSA9IGJhZF9jYXN0IChfKCJzdGFuZGFyZCBvdXRwdXQiKSk7CiAgIHNldHZidWYgKHN0ZG91 dCwgTlVMTCwgX0lPTkJGLCAwKTsKICAgbl9vdXRwdXRzKys7CiAKLS0gCjIuMS4wCgo= --------------090800020403090607000102-- From unknown Wed Jun 18 23:03:33 2025 Received: (at fakecontrol) by fakecontrolmessage; To: internal_control@debbugs.gnu.org From: Debbugs Internal Request Subject: Internal Control Message-Id: bug archived. Date: Sun, 01 Nov 2015 12:24:04 +0000 User-Agent: Fakemail v42.6.9 # This is a fake control message. # # The action: # bug archived. thanks # This fakemail brought to you by your local debbugs # administrator