Bug 1683292

Summary: curl crashes on http links with rate-limit
Product: Red Hat Enterprise Linux 7 Reporter: Martin Poole <mpoole>
Component: curlAssignee: Kamil Dudka <kdudka>
Status: CLOSED ERRATA QA Contact: Daniel Rusek <drusek>
Severity: high Docs Contact:
Priority: urgent    
Version: 7.6CC: drusek, fj-lsoft-oss, fkrska, hmatsumo, isolov69, kdudka, pandrade, yoguma
Target Milestone: rcKeywords: Regression, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: curl-7.29.0-52.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1711914 (view as bug list) Environment:
Last Closed: 2019-08-06 13:03:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1630404, 1707454, 1711914    

Description Martin Poole 2019-02-26 14:22:06 UTC
Description of problem:

curl crashes with segm
Version-Release number of selected component (if applicable):

curl-7.29.0-48.el7

How reproducible:

Always

Steps to Reproduce:
1. curl -s --limit-rate 4m http://example.com/somebigfile
2.
3.

Actual results:

*** Error in `curl': free(): invalid pointer: 0x0000000001ea8270 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81489)[0x7fe0ef8da489]
curl[0x4085dc]
curl[0x40238e]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe0ef87b3d5]
curl[0x402412]
======= Memory map: ========
00400000-00425000 r-xp 00000000 fd:01 202452587                          /usr/bin/curl
00624000-00625000 r--p 00024000 fd:01 202452587                          /usr/bin/curl
00625000-00626000 rw-p 00025000 fd:01 202452587                          /usr/bin/curl
01e9c000-01ee0000 rw-p 00000000 00:00 0                                  [heap]
7fe0e0000000-7fe0e0021000 rw-p 00000000 00:00 0
7fe0e0021000-7fe0e4000000 ---p 00000000 00:00 0

or just

Segmentation Fault


Expected results:

rate limited download.

Additional info:

Testing prior releases indicates it is the -47 to -48 patches that introduced the regression.

Comment 5 Kamil Dudka 2019-02-26 16:08:49 UTC
Thank you for analyzing the issue!  It seems to be caused by:

    0061-curl-7.29.0-CVE-2018-1000122.patch

The following upstream commit triggers it:

    https://github.com/curl/curl/commit/curl-7_54_0-55-gc2ddc12

... and the following upstream commit fixes it:

    https://github.com/curl/curl/commit/curl-7_54_0-70-ge3ed5cb

I need to review all the commits from upstream pull request #1449:

    https://github.com/curl/curl/pull/1449/commits

... as they seem to be tightly dependent on each other.

Comment 12 Kamil Dudka 2019-04-25 12:14:52 UTC
*** Bug 1702828 has been marked as a duplicate of this bug. ***

Comment 13 Kamil Dudka 2019-05-17 08:27:05 UTC
*** Bug 1710180 has been marked as a duplicate of this bug. ***

Comment 21 Kamil Dudka 2019-06-27 08:36:27 UTC
*** Bug 1724292 has been marked as a duplicate of this bug. ***

Comment 23 errata-xmlrpc 2019-08-06 13:03:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2181