bugacl - Bugs: bug #28185, setfacl crashes with core dump

 
 

bug #28185: setfacl crashes with core dump

Submitter:  Markus Steinborn <msteinbo>
Submitted:  Sat 05 Dec 2009 08:00:47 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 22 Jan 2010 11:56:20 PM UTC, comment #3: 
Brandon Philips <philips>
Group administrator
Sun 06 Dec 2009 05:23:55 PM UTC, comment #2: 

Well, forget my Comment #1, the following file used with "setfacl --restore" will crash any acl from version 2.2.39 up tp 2.2.49:

Note that I have doubled the "owner"-Line.

--- cut here ---
# file: tmp
# owner: root
# owner: root
# group: root
user::rwx
group::rwx
other::rwx
--- cut here ---

The attached patch should fix the problem.


(file #19211)

Markus Steinborn <msteinbo>
Sat 05 Dec 2009 08:05:03 PM UTC, comment #1: 

Sorry, just version 2.2.48 and 2.2.49 are affected.

Thought other invalid input files could also trigger the same bug, but currently I cannot produce one, so just assume only the latest two versions are affected.

Markus Steinborn <msteinbo>
Sat 05 Dec 2009 08:00:47 PM UTC, original submission:  

Affected versions: All from 2.2.39 to 2.2.49, other are unknown.

Description: The commands below let setfacl crash with a core dump. Note that the input for "setfacl --restore" is invalid.


--- cut here ---
msteinbo@acer:/tmp/3>mkdir tmp
msteinbo@acer:/tmp/3>chmod 1777 tmp
msteinbo@acer:/tmp/3>getfacl tmp | tee tmp.acl
# file: tmp
# owner: msteinbo
# group: msteinbo
# flags: --t
user::rwx
group::rwx
other::rwx

msteinbo@acer:/tmp/3>sed -i 's/--t/--x/g' tmp.acl
msteinbo@acer:/tmp/3>setfacl --restore tmp.acl
setfacl: tmp.acl: Success
* glibc detected * setfacl: double free or corruption (fasttop): 0x09dca1a8
*
======= Backtrace: =========
/lib/libc.so.6[0x437595]
/lib/libc.so.6(cfree+0x59)[0x4379d9]
setfacl[0x8049b73]
setfacl[0x804a04c]
/lib/libc.so.6(__libc_start_main+0xdc)[0x3e3e9c]
setfacl[0x80493c1]
======= Memory map: ========
00110000-00111000 r-xp 00110000 00:00 0          [vdso]
00111000-00117000 r-xp 00000000 fd:01 10171015   /lib/libacl.so.1.1.0
00117000-00118000 rwxp 00005000 fd:01 10171015   /lib/libacl.so.1.1.0
00118000-00121000 r-xp 00000000 fd:01 10171179   /lib/libnss_files-2.5.so
00121000-00122000 r-xp 00008000 fd:01 10171179   /lib/libnss_files-2.5.so
00122000-00123000 rwxp 00009000 fd:01 10171179   /lib/libnss_files-2.5.so
003b0000-003ca000 r-xp 00000000 fd:01 10171166   /lib/ld-2.5.so
003ca000-003cb000 r-xp 00019000 fd:01 10171166   /lib/ld-2.5.so
003cb000-003cc000 rwxp 0001a000 fd:01 10171166   /lib/ld-2.5.so
003ce000-0050d000 r-xp 00000000 fd:01 10171915   /lib/libc-2.5.so
0050d000-0050f000 r-xp 0013f000 fd:01 10171915   /lib/libc-2.5.so
0050f000-00510000 rwxp 00141000 fd:01 10171915   /lib/libc-2.5.so
00510000-00513000 rwxp 00510000 00:00 0
007bd000-007c8000 r-xp 00000000 fd:01 10171932   /lib/libgcc_s-4.1.2-20080825.so                                                                            .1
007c8000-007c9000 rwxp 0000a000 fd:01 10171932   /lib/libgcc_s-4.1.2-20080825.so                                                                            .1
00def000-00df3000 r-xp 00000000 fd:01 10171934   /lib/libattr.so.1.1.0
00df3000-00df4000 rwxp 00003000 fd:01 10171934   /lib/libattr.so.1.1.0
08048000-0804e000 r-xp 00000000 00:13 61072      /dev/shm/acl/bin/setfacl
0804e000-0804f000 rw-p 00005000 00:13 61072      /dev/shm/acl/bin/setfacl
09dca000-09deb000 rw-p 09dca000 00:00 0
b7f67000-b7f69000 rw-p b7f67000 00:00 0
b7f85000-b7f86000 rw-p b7f85000 00:00 0
bf8c5000-bf8da000 rw-p bffea000 00:00 0          [stack]
Aborted
--- cut here ---

The crash happens at the following position (reported by valgrind):

--- cut here ---
msteinbo@acer:/tmp/3>valgrind setfacl --restore tmp.acl
==25458== Memcheck, a memory error detector.
==25458== Copyright (C) 2002-2006, and GNU GPL'd, by Julian Seward et al.
==25458== Using LibVEX rev 1658, a library for dynamic binary translation.
==25458== Copyright (C) 2004-2006, and GNU GPL'd, by OpenWorks LLP.
==25458== Using valgrind-3.2.1, a dynamic binary instrumentation framework.
==25458== Copyright (C) 2000-2006, and GNU GPL'd, by Julian Seward et al.
==25458== For more details, rerun with: -v
==25458==
setfacl: tmp.acl: Success
==25458== Invalid free() / delete / delete[]
==25458==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==25458==    by 0x8049B72: restore (setfacl.c:245)
==25458==    by 0x804A04B: main (setfacl.c:577)
==25458==  Address 0x402E268 is 0 bytes inside a block of size 4 free'd
==25458==    at 0x4004FDA: free (vg_replace_malloc.c:233)
==25458==    by 0x804BE14: read_acl_comments (parse.c:529)
==25458==    by 0x80497E3: restore (setfacl.c:136)
==25458==    by 0x804A04B: main (setfacl.c:577)
==25458==
[ and so on ]
--- cut here ---

You see, the same block of memory is freeded in line 529 of parse.c and in line 245 of setfacl.c.


Markus Steinborn <msteinbo>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #19211:  acl-2.2.39-coredump.patch added by msteinbo (347B - text/x-patch)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by philips (Posted a comment)
  • -email is unavailable- added by msteinbo (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2010-01-22 philips Open/ClosedOpen Closed
    2009-12-06 msteinbo Attached File- Added acl-2.2.39-coredump.patch, #19211

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code