bugacl - Bugs: bug #28185, setfacl crashes with core dump

 
 

bug #28185: setfacl crashes with core dump

Submitted by:  Markus Steinborn <msteinbo>
Submitted on:  Sat 05 Dec 2009 08:00:47 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Fri 22 Jan 2010 11:56:20 PM UTC, comment #3:

Fixed. Thanks for the report.
http://git.savannah.gnu.org/cgit/acl.git/commit/?id=a1815d4ad4ffe84e8f7d128a38955e3dab306e0d

Brandon Philips <philips>
Project Administrator
Sun 06 Dec 2009 05:23:55 PM UTC, comment #2:

Well, forget my Comment #1, the following file used with "setfacl --restore" will crash any acl from version 2.2.39 up tp 2.2.49:

Note that I have doubled the "owner"-Line.

--- cut here ---
# file: tmp
# owner: root
# owner: root
# group: root
user::rwx
group::rwx
other::rwx
--- cut here ---

The attached patch should fix the problem.

(file #19211)

Markus Steinborn <msteinbo>
Sat 05 Dec 2009 08:05:03 PM UTC, comment #1:

Sorry, just version 2.2.48 and 2.2.49 are affected.

Thought other invalid input files could also trigger the same bug, but currently I cannot produce one, so just assume only the latest two versions are affected.

Markus Steinborn <msteinbo>
Sat 05 Dec 2009 08:00:47 PM UTC, original submission:

Affected versions: All from 2.2.39 to 2.2.49, other are unknown.

Description: The commands below let setfacl crash with a core dump. Note that the input for "setfacl --restore" is invalid.

--- cut here ---
msteinbo@acer:/tmp/3>mkdir tmp
msteinbo@acer:/tmp/3>chmod 1777 tmp
msteinbo@acer:/tmp/3>getfacl tmp | tee tmp.acl
# file: tmp
# owner: msteinbo
# group: msteinbo
# flags: --t
user::rwx
group::rwx
other::rwx

msteinbo@acer:/tmp/3>sed -i 's/--t/--x/g' tmp.acl
msteinbo@acer:/tmp/3>setfacl --restore tmp.acl
setfacl: tmp.acl: Success

      • glibc detected *** setfacl: double free or corruption (fasttop): 0x09dca1a8

***
======= Backtrace: =========
/lib/libc.so.6[0x437595]
/lib/libc.so.6(cfree+0x59)[0x4379d9]
setfacl[0x8049b73]
setfacl[0x804a04c]
/lib/libc.so.6(__libc_start_main+0xdc)[0x3e3e9c]
setfacl[0x80493c1]
======= Memory map: ========
00110000-00111000 r-xp 00110000 00:00 0 [vdso]
00111000-00117000 r-xp 00000000 fd:01 10171015 /lib/libacl.so.1.1.0
00117000-00118000 rwxp 00005000 fd:01 10171015 /lib/libacl.so.1.1.0
00118000-00121000 r-xp 00000000 fd:01 10171179 /lib/libnss_files-2.5.so
00121000-00122000 r-xp 00008000 fd:01 10171179 /lib/libnss_files-2.5.so
00122000-00123000 rwxp 00009000 fd:01 10171179 /lib/libnss_files-2.5.so
003b0000-003ca000 r-xp 00000000 fd:01 10171166 /lib/ld-2.5.so
003ca000-003cb000 r-xp 00019000 fd:01 10171166 /lib/ld-2.5.so
003cb000-003cc000 rwxp 0001a000 fd:01 10171166 /lib/ld-2.5.so
003ce000-0050d000 r-xp 00000000 fd:01 10171915 /lib/libc-2.5.so
0050d000-0050f000 r-xp 0013f000 fd:01 10171915 /lib/libc-2.5.so
0050f000-00510000 rwxp 00141000 fd:01 10171915 /lib/libc-2.5.so
00510000-00513000 rwxp 00510000 00:00 0
007bd000-007c8000 r-xp 00000000 fd:01 10171932 /lib/libgcc_s-4.1.2-20080825.so .1
007c8000-007c9000 rwxp 0000a000 fd:01 10171932 /lib/libgcc_s-4.1.2-20080825.so .1
00def000-00df3000 r-xp 00000000 fd:01 10171934 /lib/libattr.so.1.1.0
00df3000-00df4000 rwxp 00003000 fd:01 10171934 /lib/libattr.so.1.1.0
08048000-0804e000 r-xp 00000000 00:13 61072 /dev/shm/acl/bin/setfacl
0804e000-0804f000 rw-p 00005000 00:13 61072 /dev/shm/acl/bin/setfacl
09dca000-09deb000 rw-p 09dca000 00:00 0
b7f67000-b7f69000 rw-p b7f67000 00:00 0
b7f85000-b7f86000 rw-p b7f85000 00:00 0
bf8c5000-bf8da000 rw-p bffea000 00:00 0 [stack]
Aborted
--- cut here ---

The crash happens at the following position (reported by valgrind):

--- cut here ---
msteinbo@acer:/tmp/3>valgrind setfacl --restore tmp.acl
==25458== Memcheck, a memory error detector.
==25458== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==25458== Using LibVEX rev 1658, a library for dynamic binary translation.
==25458== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==25458== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==25458== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==25458== For more details, rerun with: -v
==25458==
setfacl: tmp.acl: Success
==25458== Invalid free() / delete / delete[]
==25458== at 0x4004FDA: free (vg_replace_malloc.c:233)
==25458== by 0x8049B72: restore (setfacl.c:245)
==25458== by 0x804A04B: main (setfacl.c:577)
==25458== Address 0x402E268 is 0 bytes inside a block of size 4 free'd
==25458== at 0x4004FDA: free (vg_replace_malloc.c:233)
==25458== by 0x804BE14: read_acl_comments (parse.c:529)
==25458== by 0x80497E3: restore (setfacl.c:136)
==25458== by 0x804A04B: main (setfacl.c:577)
==25458==
[ and so on ]
--- cut here ---

You see, the same block of memory is freeded in line 529 of parse.c and in line 245 of setfacl.c.

Markus Steinborn <msteinbo>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #19211:  acl-2.2.39-coredump.patch added by msteinbo (347B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by philips (Posted a comment)
  • -unavailable- added by msteinbo (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 22 Jan 2010 11:56:20 PM UTCphilipsOpen/ClosedOpen=>Closed
    Sun 06 Dec 2009 05:23:54 PM UTCmsteinboAttached File-=>Added acl-2.2.39-coredump.patch, #19211

    Back to the top


    Powered by Savane 3.1-cleanup1