Bug 895072

Summary: Possible crash when handling deletion requests
Product: [Fedora] Fedora EPEL Reporter: Jeremy Sowden <jeremy>
Component: memcachedAssignee: Paul Lindner <lindner>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: el5CC: lindner, matthias, mlichvar
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: CVE-2013-0179 Environment:
Last Closed: 2014-01-15 11:01:55 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Jeremy Sowden 2013-01-14 13:27:36 UTC 
+++ This bug was initially created as a clone of Bug #895054 +++

Description of problem:

When run with "-vv", on receipt of a binary-protocol deletion request, memcached prints out the key to be deleted in a way that can lead to a buffer overrun and crash.

Version-Release number of selected component (if applicable):

1.4.5, although this currently affects all later versions.

How reproducible:

Run memcached with "-vv", use memrm to send deletion requests and observe output.

Steps to Reproduce:

1. memcached -p 12345 -vv 2>&1 | grep '^Deleting'
2. memrm --servers localhost:12345 --binary ABCDEF xyz
3. Check the output from memcached.

Actual results:

[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting'
Deleting ABCDEF
Deleting xyzDEF

Expected results:

[jsowden:~] $ memcached -p 2300 -m 64 -c 1024 -r -vv 2>&1 | grep 'Deleting'
Deleting ABCDEF
Deleting xyz

Additional info:

I've opened a bug report upstream: https://code.google.com/p/memcached/issues/detail?id=306
Comment 1 Miroslav Lichvar 2014-01-15 11:01:55 UTC 

*** This bug has been marked as a duplicate of bug 895139 ***