Subject: bug#22489: closed (Re: bug#22489: A bug in tail.c)

From: [email-masked] (GNU bug Tracking System)
Date: Fri, 29 Jan 2016 18:31:02 +0000

Your bug report

#22489: A bug in tail.c

which was filed against the coreutils package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
22489: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=22489
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#22489: A bug in tail.c
From: Paul Eggert <[email-masked]>
To: Lei Wang <[email-masked]>, [email-masked]
Date: Fri, 29 Jan 2016 10:29:57 -0800
List-Id: <debbugs-submit.debbugs.gnu.org>

On 01/29/2016 04:38 AM, Lei Wang wrote:
> There is one condition can lead to program
> overflow, thus argc==2 and argv[1] has only one character, for example
> ./tail x , will access the next character after x, this maybe a bug

I don't see a bug there. The next character is a null byte, and ISDIGIT 
('\0') is false so the code should do the right thing. I don't think 
there is a test case that illustrates wrong behavior, but if I'm wrong 
please reply with a test case (a shell command invoking 'tail') and I'll 
reopen the bug report.

Subject: A bug in tail.c
From: Lei Wang <[email-masked]>
To: [email-masked]
Date: Fri, 29 Jan 2016 20:38:39 +0800
List-Id: <debbugs-submit.debbugs.gnu.org>

Version: GNU Coreutils 8.20-8.25 ​
File: tail.c
Bug description:
Line 1979,  parse_obsolete_option() function  has three parameters: argc,
argv, n_units.  We only need to focus on argc and argv, which is from the
main() function. Line 1992  filter  the argc and argv. When argc==2,  line
1998 p = argv[1], line 2000 *p++, then *p=argv[1][1], line 2026 while
(ISDIGIT (*p)) access p. There is one condition can lead to program
overflow, thus argc==2 and argv[1] has only one character, for example
./tail x , will access the next character after x, this maybe a bug, but
can not lead program crash.
--WangLei