Bug 1683292

Summary: curl crashes on http links with rate-limit
Product: Red Hat Enterprise Linux 7 Reporter: Martin Poole <mpoole>
Component: curlAssignee: Kamil Dudka <kdudka>
Status: CLOSED ERRATA QA Contact: Daniel Rusek <drusek>
Severity: high Docs Contact:
Priority: urgent    
Version: 7.6CC: drusek, fj-lsoft-oss, fkrska, hmatsumo, isolov69, kdudka, pandrade, yoguma
Target Milestone: rcKeywords: Regression, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: curl-7.29.0-52.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1711914 (view as bug list) Environment:
Last Closed: 2019-08-06 13:03:15 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1630404, 1707454, 1711914    

Description Martin Poole 2019-02-26 14:22:06 UTC 
Description of problem:

curl crashes with segm
Version-Release number of selected component (if applicable):

curl-7.29.0-48.el7

How reproducible:

Always

Steps to Reproduce:
1. curl -s --limit-rate 4m http://example.com/somebigfile
2.
3.

Actual results:

*** Error in `curl': free(): invalid pointer: 0x0000000001ea8270 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81489)[0x7fe0ef8da489]
curl[0x4085dc]
curl[0x40238e]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe0ef87b3d5]
curl[0x402412]
======= Memory map: ========
00400000-00425000 r-xp 00000000 fd:01 202452587                          /usr/bin/curl
00624000-00625000 r--p 00024000 fd:01 202452587                          /usr/bin/curl
00625000-00626000 rw-p 00025000 fd:01 202452587                          /usr/bin/curl
01e9c000-01ee0000 rw-p 00000000 00:00 0                                  [heap]
7fe0e0000000-7fe0e0021000 rw-p 00000000 00:00 0
7fe0e0021000-7fe0e4000000 ---p 00000000 00:00 0

or just

Segmentation Fault


Expected results:

rate limited download.

Additional info:

Testing prior releases indicates it is the -47 to -48 patches that introduced the regression.
Comment 5 Kamil Dudka 2019-02-26 16:08:49 UTC 
Thank you for analyzing the issue!  It seems to be caused by:

    0061-curl-7.29.0-CVE-2018-1000122.patch

The following upstream commit triggers it:

    https://github.com/curl/curl/commit/curl-7_54_0-55-gc2ddc12

... and the following upstream commit fixes it:

    https://github.com/curl/curl/commit/curl-7_54_0-70-ge3ed5cb

I need to review all the commits from upstream pull request #1449:

    https://github.com/curl/curl/pull/1449/commits

... as they seem to be tightly dependent on each other.
Comment 9 Kamil Dudka 2019-03-01 13:10:18 UTC 
I have backported additional 11 upstream commits to make the code consistent again:

https://github.com/curl/curl/commit/curl-7_54_0-58-g87eb8d5b3
https://github.com/curl/curl/commit/curl-7_54_0-60-gb8191e975
https://github.com/curl/curl/commit/curl-7_54_0-61-gf2fadf490
https://github.com/curl/curl/commit/curl-7_54_0-62-g40a074f25
https://github.com/curl/curl/commit/curl-7_54_0-63-g0cab3a394
https://github.com/curl/curl/commit/curl-7_54_0-65-g89cf6f38d
https://github.com/curl/curl/commit/curl-7_54_0-66-gc79f4908d
https://github.com/curl/curl/commit/curl-7_54_0-67-ge40e9d7f0
https://github.com/curl/curl/commit/curl-7_54_0-68-g7ee52c25f
https://github.com/curl/curl/commit/curl-7_54_0-70-ge3ed5cb38
https://github.com/curl/curl/commit/curl-7_54_0-72-geab6732fd
Comment 12 Kamil Dudka 2019-04-25 12:14:52 UTC 
*** Bug 1702828 has been marked as a duplicate of this bug. ***
Comment 13 Kamil Dudka 2019-05-17 08:27:05 UTC 
*** Bug 1710180 has been marked as a duplicate of this bug. ***
Comment 21 Kamil Dudka 2019-06-27 08:36:27 UTC 
*** Bug 1724292 has been marked as a duplicate of this bug. ***
Comment 23 errata-xmlrpc 2019-08-06 13:03:15 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2181