GNU bug report logs - #70232
Bug in argument handling may lead to segfault if --debug is passed after any compile step

Previous Next

To reply to this bug, email your comments to 70232 AT debbugs.gnu.org.

Toggle the display of automated, internal messages from the tracker.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: 37 <at> cmail.nu
To: bug-sed <at> gnu.org
Subject: Bug in argument handling may lead to segfault if --debug is passed
 after any compile step
Date: Sat, 06 Apr 2024 00:40:08 -0400

[Message part 1 (text/plain, inline)]

Hi,

This affects every version with the --debug flag to my knowledge. Tested 
on version 4.8. Reasonably simple reproducer is attached. Run with `sed 
-f repro.sed --debug`.

I believe the root cause is that sed will compile scripts *before* 
setting the debug flag, which leads to cmd->x.label_name being garbage 
since next_cmd_entry doesn't zero out the auxiliary data structure. When 
sed then tries to print the label through debug_print_program at the end 
of main, a segfault is possible due to the uninitialized read.

[repro.sed (text/plain, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.