GNU bug report logs - #70232
Bug in argument handling may lead to segfault if --debug is passed after any compile step

Previous Next

Full log

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: 37 <at> cmail.nu
To: bug-sed <at> gnu.org
Subject: Bug in argument handling may lead to segfault if --debug is passed
 after any compile step
Date: Sat, 06 Apr 2024 00:40:08 -0400

[Message part 1 (text/plain, inline)]

Hi,

This affects every version with the --debug flag to my knowledge. Tested 
on version 4.8. Reasonably simple reproducer is attached. Run with `sed 
-f repro.sed --debug`.

I believe the root cause is that sed will compile scripts *before* 
setting the debug flag, which leads to cmd->x.label_name being garbage 
since next_cmd_entry doesn't zero out the auxiliary data structure. When 
sed then tries to print the label through debug_print_program at the end 
of main, a segfault is possible due to the uninitialized read.

[repro.sed (text/plain, attachment)]

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.