Sat 05 Dec 2009 08:00:47 PM UTC, original submission:
Affected versions: All from 2.2.39 to 2.2.49, other are unknown.
Description: The commands below let setfacl crash with a core dump. Note that the input for "setfacl --restore" is invalid.
--- cut here ---
msteinbo@acer:/tmp/3>mkdir tmp
msteinbo@acer:/tmp/3>chmod 1777 tmp
msteinbo@acer:/tmp/3>getfacl tmp | tee tmp.acl
# file: tmp
# owner: msteinbo
# group: msteinbo
# flags: --t
user::rwx
group::rwx
other::rwx
msteinbo@acer:/tmp/3>sed -i 's/--t/--x/g' tmp.acl
msteinbo@acer:/tmp/3>setfacl --restore tmp.acl
setfacl: tmp.acl: Success
- glibc detected *** setfacl: double free or corruption (fasttop): 0x09dca1a8
***
======= Backtrace: =========
/lib/libc.so.6[0x437595]
/lib/libc.so.6(cfree+0x59)[0x4379d9]
setfacl[0x8049b73]
setfacl[0x804a04c]
/lib/libc.so.6(__libc_start_main+0xdc)[0x3e3e9c]
setfacl[0x80493c1]
======= Memory map: ========
00110000-00111000 r-xp 00110000 00:00 0 [vdso]
00111000-00117000 r-xp 00000000 fd:01 10171015 /lib/libacl.so.1.1.0
00117000-00118000 rwxp 00005000 fd:01 10171015 /lib/libacl.so.1.1.0
00118000-00121000 r-xp 00000000 fd:01 10171179 /lib/libnss_files-2.5.so
00121000-00122000 r-xp 00008000 fd:01 10171179 /lib/libnss_files-2.5.so
00122000-00123000 rwxp 00009000 fd:01 10171179 /lib/libnss_files-2.5.so
003b0000-003ca000 r-xp 00000000 fd:01 10171166 /lib/ld-2.5.so
003ca000-003cb000 r-xp 00019000 fd:01 10171166 /lib/ld-2.5.so
003cb000-003cc000 rwxp 0001a000 fd:01 10171166 /lib/ld-2.5.so
003ce000-0050d000 r-xp 00000000 fd:01 10171915 /lib/libc-2.5.so
0050d000-0050f000 r-xp 0013f000 fd:01 10171915 /lib/libc-2.5.so
0050f000-00510000 rwxp 00141000 fd:01 10171915 /lib/libc-2.5.so
00510000-00513000 rwxp 00510000 00:00 0
007bd000-007c8000 r-xp 00000000 fd:01 10171932 /lib/libgcc_s-4.1.2-20080825.so .1
007c8000-007c9000 rwxp 0000a000 fd:01 10171932 /lib/libgcc_s-4.1.2-20080825.so .1
00def000-00df3000 r-xp 00000000 fd:01 10171934 /lib/libattr.so.1.1.0
00df3000-00df4000 rwxp 00003000 fd:01 10171934 /lib/libattr.so.1.1.0
08048000-0804e000 r-xp 00000000 00:13 61072 /dev/shm/acl/bin/setfacl
0804e000-0804f000 rw-p 00005000 00:13 61072 /dev/shm/acl/bin/setfacl
09dca000-09deb000 rw-p 09dca000 00:00 0
b7f67000-b7f69000 rw-p b7f67000 00:00 0
b7f85000-b7f86000 rw-p b7f85000 00:00 0
bf8c5000-bf8da000 rw-p bffea000 00:00 0 [stack]
Aborted
--- cut here ---
The crash happens at the following position (reported by valgrind):
--- cut here ---
msteinbo@acer:/tmp/3>valgrind setfacl --restore tmp.acl
==25458== Memcheck, a memory error detector.
==25458== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==25458== Using LibVEX rev 1658, a library for dynamic binary translation.
==25458== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==25458== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==25458== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==25458== For more details, rerun with: -v
==25458==
setfacl: tmp.acl: Success
==25458== Invalid free() / delete / delete[]
==25458== at 0x4004FDA: free (vg_replace_malloc.c:233)
==25458== by 0x8049B72: restore (setfacl.c:245)
==25458== by 0x804A04B: main (setfacl.c:577)
==25458== Address 0x402E268 is 0 bytes inside a block of size 4 free'd
==25458== at 0x4004FDA: free (vg_replace_malloc.c:233)
==25458== by 0x804BE14: read_acl_comments (parse.c:529)
==25458== by 0x80497E3: restore (setfacl.c:136)
==25458== by 0x804A04B: main (setfacl.c:577)
==25458==
[ and so on ]
--- cut here ---
You see, the same block of memory is freeded in line 529 of parse.c and in line 245 of setfacl.c.
|