Fix segfault when memmoving with negative/enormous n - #21
Merged
Conversation
I observed a segmentation fault caused by trying to memmove by -15, which makes 18446744073709551601 on my 64-bit platform after an argument type promotion (from int into size_t). In my case, this was connected with filling up disk during the test facilitated by check, hence I derive that the main issue was that not enough bytes for particular type of message was actually read (and previously written, for that matter) and because of this incompleteness, get_result happily consumed more bytes than was read. Additional debugging info at the point of segfault (src/check_pack.c): > 468│ /* Move remaining data in buffer to the beginning */ > 469├> memmove(buf, buf + n, nparse); > 470│ /* If EOF has not been seen */ > 471│ if(nread > 0) > > (gdb) p nparse > $1 = -15 > (gdb) p n > $2 = 23 > (gdb) p nread > $3 = 0
jnpkrn
force-pushed
the
fix-memmove-segfault
branch
from
March 1, 2016 19:30
6abb2ce to
25a8706
Compare
Contributor
Author
|
Note that
is just as serious, however I don't feel competent to do such a complex |
Contributor
|
Jenkins: ok to test |
brarcher
added a commit
that referenced
this pull request
Mar 5, 2016
Fix segfault when memmoving with negative/enormous n
Contributor
|
Looking at the code, I agree that get_result should not attempt to consume more than is available. Probably there is a more graceful way to handle such a failure. Though, likely all it would do is attempt to abort because the framework hit a condition it is unable to handle. Thanks for the change. If you could, may you also submit a pull request adding yourself to the AUTHORS file if you are not already listed? |
Contributor
Author
|
Done: PR #22. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I observed a segmentation fault caused by trying to memmove by -15,
which makes 18446744073709551601 on my 64-bit platform after an argument
type promotion (from
intintosize_t). In my case, this was connectedwith filling up disk during the test facilitated by check, hence I derive
that the main issue was that not enough bytes for particular type of
message was actually read (and previously written, for that matter) and
because of this incompleteness,
get_resulthappily consumed more bytesthan was read.
Additional debugging info at the point of segfault (
src/check_pack.c):