bugCompact Disc Input and Control Library - Bugs: bug #45017, stack overflow / crash in...

 
 

bug #45017: stack overflow / crash in _fs_iso_stat_traverse

Submitter:  Hanno Boeck <hanno>
Submitted:  Tue 05 May 2015 07:41:57 AM UTC
   
 
Category:  run-time error Severity:  5 - Average
Item Group:  libiso9660 Status:  Fixed
Privacy:  Public Assigned to:  scdbackup
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 22 Nov 2017 01:31:51 AM UTC, comment #5: 

Git sources now have Thomas Schmitt's fixes which look for deep recursion. It looks to me like this is fixed.

There soon will be a 1.0.0 release with Thomas's code.

Rocky Bernstein <rocky>
Group administrator
Sun 30 Jul 2017 04:36:25 PM UTC, comment #4: 

Or iso-info.c : print_iso9660_recurse() could get a recursion counter
which causes an emergency abort after a generous depth of directories.

Thomas Schmitt <scdbackup>
Group Member
Sun 30 Jul 2017 04:27:56 PM UTC, comment #3: 

One could give iso9660_fs.c : _iso9660_dir_to_statbuf() a new parameter
  unsigned int filecount
which would tell it whether the first, the second, or any further
record of a directory is processed. There are 7 calls of the function.

It could then raise protest or silently correct the error if filecount 1
is not yielding file name "." (from byte value 0), or if filecount 2 does
not yield ".." (from byte value 1).

Thomas Schmitt <scdbackup>
Group Member
Sun 30 Jul 2017 04:17:29 PM UTC, comment #2: 

The reason is that the first directory record in directory "/A"
bears the name "0" (ASCII 48) rather than a binary 0 byte, as prescribed
by ECMA-119 for the "." record.
(Does that error generator know about human psychology ?)

libcdio does not handle the first two directory records special
and so iso9660_ifs_readdir() hands that name to its caller
iso-info.c : print_iso9660_recurse().
This caller, in line 266 ff., would exclude "." and ".." but not
a directory named "0". That directory points to the parent as
being the directory itself.

So it comes to an endless recursion.
  2048 /a/0/0/0/0/0/0/0/0/.../0
until valgrind's stack explodes. (At least on my Debian 8.)

Thomas Schmitt <scdbackup>
Group Member
Wed 06 May 2015 07:22:37 PM UTC, comment #1: 

Hi -

I just wanted to acknowledge and thank you for all of the bug reports. These will be addressed sometime before the next release.

But I have no idea right now when I will have to time to look at. Of course, it is possible someone else in the group might look at and address.

In the meantime, if you want to submit a patch to fix these, that would also be appreciated.

Rocky Bernstein <rocky>
Group administrator
Tue 05 May 2015 07:41:57 AM UTC, original submission:  

The attached file will crash iso-info -f.

Looking at the gdb backtrace and the valgrind output it looks like the function recursively calls itself forever till the stack size grows to big and overflows.

Found with american fuzzy lop.

Hanno Boeck <hanno>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #33913:  libcdio-stackoverflow.iso added by hanno (50KiB - application/x-cd-image)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by scdbackup (Posted a comment)
  • -email is unavailable- added by scdbackup
  • -email is unavailable- added by rocky (Posted a comment)
  • -email is unavailable- added by hanno (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 10 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-04-13 rocky Open/ClosedOpen Closed
    2017-11-22 rocky StatusNone Fixed
        Assigned toNone scdbackup
    2017-07-30 scdbackup Carbon-Copy- Added scdbackup
    2015-05-06 rocky Item Grouplibcdio libiso9660
    2015-05-06 rocky CategoryNone run-time error
        Item GroupNone libcdio
    2015-05-05 hanno Attached File- Added libcdio-stackoverflow.iso.valgrind.txt, #33915
    2015-05-05 hanno Attached File- Added libcdio-stackoverflow.iso, #33913
        Attached File- Added libcdio-stackoverflow.iso.gdb-backtrace.txt, #33914

    Back to the top

    Powered by Savane 3.13-4448.
    Corresponding source code