Bug 732989

*** Bug 732286 has been marked as a duplicate of this bug. ***

(In reply to comment #0)
> Description of problem:
> sftp command always fails with 
> *** glibc detected *** /usr/bin/sftp: free(): invalid pointer:
> 0xd8d8d8d8d8d8d8d8 ***
> on program exit
> 
> Version-Release number of selected component (if applicable):
> glibc-2.14.90-5.x86_64
> openssh-5.8p2-20.fc17.x86_64
> 
> How reproducible:
> always
> 

I unsuccessfuly tried to reproduce it.


> Steps to Reproduce:
> $ sftp localhost
> tbzatek@localhost's password: 
> Connected to localhost.
> sftp> ^D
> *** glibc detected *** sftp: free(): invalid pointer: 0xd8d8d8d8d8d8d8d8 ***
> *** glibc detected *** sftp: free(): invalid pointer: 0xd8d8d8d8d8d8d8d8 ***
> *** glibc detected *** sftp: free(): invalid pointer: 0xd8d8d8d8d8d8d8d8 ***
> *** glibc detected *** sftp: free(): invalid pointer: 0xd8d8d8d8d8d8d8d8 ***
> 
> Additional info:
> Where should I place breakpoint in gdb to catch this?

int
sftp_server_main(int argc, char **argv, struct passwd *user_pw)

*** Bug 728413 has been marked as a duplicate of this bug. ***

Hmm, I am a bit annoyed that (1) the earlier bug report was closed as a duplicate of a later one - with little additional information - it would only be fair to close an earlier report as duplicate of a later one if the 2nd bug report was accompanied by a fix, (2) the newer bug report is not viewable without logging on.

While I understand the latter might be a security issue, considered that the first one is still open to public's viewing, it doesn't make sense to protect the 2nd... Likewise, although Bug 732286 looks related (mem=0xe0e0e0e0e0e0e0e0), I'd rather it is closed as duplicate if/when there is a diagnosis/fix here, and it does not make sense to protect a later report if the earlier one is still viewable to public.

Anyway, since there are two people who consistently reproduce this bug, I hope something good can come out soon.

I do not really think this is a Security sensitive bug as the sftp process is running with the user credentials.

I can get sftp to segfault if I run sftp with the environment variable MALLOC_PERTURB_=106 set.

(In reply to comment #6)
> I can get sftp to segfault if I run sftp with the environment variable
> MALLOC_PERTURB_=106 set.

Indeed I have these from "export":
declare -x MALLOC_CHECK_="1"
declare -x MALLOC_PERTURB_="145"

They came from "/etc/sysconfig/debug" - beside those those, 
it also set a 3rd variable:
export G_SLICE=debug-blocks

"/etc/sysconfig/debug" comes from a package called debugmode-9.30-2.fc15.x86_64,
 initscripts-9.30-2.fc15.src.rpm as is.

the problem is caused by the EdiLine destructor called from sftp.

Yes, there is clear bug in the libedit el_end() - there is an use of memory after free.

This should fix it:

diff --git a/src/el.c b/src/el.c
index 168734c..d41bb3b 100644
--- a/src/el.c
+++ b/src/el.c
@@ -139,13 +139,13 @@ el_end(EditLine *el)
    sig_end(el);

    el_free((ptr_t) el->el_prog);
-   el_free((ptr_t) el);
 #ifdef WIDECHAR
    el_free((ptr_t) el->el_scratch.cbuff);
    el_free((ptr_t) el->el_scratch.wbuff);
    el_free((ptr_t) el->el_lgcyconv.cbuff);
    el_free((ptr_t) el->el_lgcyconv.wbuff);
 #endif
+   el_free((ptr_t) el);
 }

fixed in libedit-3.0-3.20110802cvs.fc17

libedit-3.0-4.20110227cvs.fc16 has been submitted as an update for Fedora 16.
https://admin.fedoraproject.org/updates/libedit-3.0-4.20110227cvs.fc16

libedit-3.0-4.20110227cvs.fc15 has been submitted as an update for Fedora 15.
https://admin.fedoraproject.org/updates/libedit-3.0-4.20110227cvs.fc15

Package libedit-3.0-4.20110227cvs.fc16:
* should fix your issue,
* was pushed to the Fedora 16 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libedit-3.0-4.20110227cvs.fc16'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/libedit-3.0-4.20110227cvs.fc16
then log in and leave karma (feedback).

libedit-3.0-4.20110227cvs.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.

libedit-3.0-4.20110227cvs.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.