Bug 110422 - Using aspell as a denial-of-service/crash from a normal user account
Summary: Using aspell as a denial-of-service/crash from a normal user account
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: aspell
Version: 3.0
Hardware: i386
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Eido Inoue
QA Contact: Ben Levenson
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2003-11-19 14:53 UTC by Robert Osborne
Modified: 2007-11-30 22:06 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2004-02-19 16:58:10 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Robert Osborne 2003-11-19 14:53:31 UTC
Description of problem:
aspell-0.33.7.1-25 goes into a bad memory/processor leak when invoked
in SGML mode

Version-Release number of selected component (if applicable):
aspell-0.33.7.1-25

How reproducible:
invoke aspell with either -H or --mode=sgml

Steps to Reproduce:
1.
$ echo 'Kill me' > text.txt
2.
aspell -H -c text.txt
3.
watch a top and see the system grind to a halt
  
Actual results:
I've had to hit the power button after several of these ran
simultaneously.  I couldn't log in from the console or use
CTRL-ALT-DEL from the virtual terminal!

Expected results:


Additional info:

Comment 1 Eido Inoue 2003-12-03 16:58:53 UTC
I verified that aspell does go into a loop and consumes lots of
memory, but aspell is a non-suid userland program. If in theory (*) it
can DoS, then any userland program can also do the same, and this is
something to be examined by the kernel/libc teams.

* I was able to recover from a few of these running. It was very
difficult and took a lot of time, but I could. Eventually the apps
should terminate after they've exhausted memory.
 

Comment 2 Eido Inoue 2004-02-19 16:58:10 UTC
closing as i weas able to recover. if you aren't able to recover, the
DoS blame doesn't lie with the userspace app.


Note You need to log in before you can comment on or make changes to this bug.