Bug 150397 - Doing "pkg-config --help", *** buffer overflow detected ***
Doing "pkg-config --help", *** buffer overflow detected ***
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: pkgconfig (Show other bugs)
rawhide
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Matthias Clasen
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2005-03-05 10:00 EST by sangu
Modified: 2007-11-30 17:11 EST (History)
1 user (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2005-03-07 09:37:33 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description sangu 2005-03-05 10:00:47 EST
Description of problem:
$pkg-config --help
Usage: pkg-config [OPTION...]
  --version                                      output version of pkg-config
  --modversion                                   output version for package
  --atleast-pkgconfig-version=VERSION            *** buffer overflow detected
***: pkg-config terminated
Aborted

(gdb) r --help
Starting program: /usr/bin/pkg-config --help
(no debugging symbols found)
(no debugging symbols found)
Usage: usr/bin/pkg-config [OPTION...]
  --version                                      output version of pkg-config
  --modversion                                   output version for package
  --atleast-pkgconfig-version=VERSION            *** buffer overflow detected
***: /usr/bin/pkg-config terminated

Program received signal SIGABRT, Aborted.
0x00fc77e2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
(gdb) bt
#0  0x00fc77e2 in _dl_sysinfo_int80 () from /lib/ld-linux.so.2
#1  0x007067a5 in raise () from /lib/tls/libc.so.6
#2  0x00708119 in abort () from /lib/tls/libc.so.6
#3  0x0073a24a in __libc_message () from /lib/tls/libc.so.6
#4  0x007b9b01 in __chk_fail () from /lib/tls/libc.so.6
#5  0x007b9308 in _IO_str_chk_overflow () from /lib/tls/libc.so.6
#6  0x0073de8f in _IO_default_xsputn_internal () from /lib/tls/libc.so.6
#7  0x00719877 in vfprintf () from /lib/tls/libc.so.6
#8  0x007b93bb in __vsprintf_chk () from /lib/tls/libc.so.6
#9  0x007b92fd in __sprintf_chk () from /lib/tls/libc.so.6
#10 0x0804f743 in ?? ()
#11 0xbffdc852 in ?? ()
#12 0x00000001 in ?? ()
#13 0x0000000a in ?? ()
#14 0x0805a84c in _IO_stdin_used ()
#15 0x00000018 in ?? ()
#16 0x00000031 in ?? ()
#17 0x00000006 in ?? ()
#18 0x0805a80e in _IO_stdin_used ()
#19 0x74612d2d in ?? ()
#20 0x7361656c in ?? ()
#21 0x6b702d74 in ?? ()
#22 0x6e6f6367 in ?? ()
---Type <return> to continue, or q <return> to quit---
#23 0x2d676966 in ?? ()
#24 0x73726576 in ?? ()
#25 0x3d6e6f69 in ?? ()
#26 0x53524556 in ?? ()
#27 0x004e4f49 in ?? ()
#28 0x00fe1f58 in ?? ()
#29 0x00000001 in ?? ()
#30 0x00000001 in ?? ()
#31 0x00000000 in ?? ()


Version-Release number of selected component (if applicable):
pkgconfig-0.15.0-4

How reproducible:
always

Steps to Reproduce:
1.$pkg-config --help
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 sangu 2005-03-06 09:08:29 EST
in glibc-2.3.12-12

$pkg-config --help
Usage: pkg-config [OPTION...]
  --version                                      output version of pkg-config
  --modversion                                   output version for package
  --atleast-pkgconfig-version=VERSION            *** buffer overflow detected
***: pkg-config terminated
======= Backtrace: =========
/lib/tls/libc.so.6(__chk_fail+0x41)[0x222ee5]
/lib/tls/libc.so.6(__vsprintf_chk+0x0)[0x2227a8]
/lib/tls/libc.so.6(_IO_default_xsputn+0x97)[0x1aa118]
/lib/tls/libc.so.6(_IO_vfprintf+0xd8b)[0x1856dd]
/lib/tls/libc.so.6(__vsprintf_chk+0xa1)[0x222849]
/lib/tls/libc.so.6(__sprintf_chk+0x30)[0x22279c]
pkg-config[0x804f743]
pkg-config[0x804f906]
pkg-config[0x804fa2c]
pkg-config[0x804e615]
pkg-config[0x804d24e]
/lib/tls/libc.so.6(__libc_start_main+0xc6)[0x15edb6]
pkg-config[0x8049471]
======= Memory map: ========
0014a000-00268000 r-xp 00000000 03:08 16653      /lib/tls/libc-2.3.4.so
00268000-0026a000 r-xp 0011d000 03:08 16653      /lib/tls/libc-2.3.4.so
0026a000-0026c000 rwxp 0011f000 03:08 16653      /lib/tls/libc-2.3.4.so
0026c000-0026e000 rwxp 0026c000 00:00 0
00403000-0041d000 r-xp 00000000 03:08 895802     /lib/ld-2.3.4.so
0041d000-0041e000 r-xp 00019000 03:08 895802     /lib/ld-2.3.4.so
0041e000-0041f000 rwxp 0001a000 03:08 895802     /lib/ld-2.3.4.so
005ea000-005f3000 r-xp 00000000 03:08 895998     /lib/libgcc_s-4.0.0-20050303.so.1
005f3000-005f4000 rwxp 00008000 03:08 895998     /lib/libgcc_s-4.0.0-20050303.so.1
08048000-0805c000 r-xp 00000000 03:08 327403     /usr/bin/pkg-config
0805c000-0805d000 rw-p 00013000 03:08 327403     /usr/bin/pkg-config
09fb7000-09fd8000 rw-p 09fb7000 00:00 0
b7f92000-b7f94000 rw-p b7f92000 00:00 0
bfecf000-c0000000 rw-p bfecf000 00:00 0
ffffe000-fffff000 ---p 00000000 00:00 0
Aborted
Comment 2 Arjan van de Ven 2005-03-06 14:50:52 EST
can you try to get the pkg-config debuginfo rpm so that the backtrace
shows more information?
Comment 3 sangu 2005-03-06 20:45:05 EST
arjanv : pkgconfig-debuginfo package contains no files.

$rpm -qpl pkgconfig-debuginfo-0.15.0-4.i386.rpm
(contains no files)
Comment 4 Matthias Clasen 2005-03-06 22:39:10 EST
This seems to be due to use of alloca in the copy of popt included in pkgconfig.
Does gcc4 have known issues with alloca ?
Comment 5 Arjan van de Ven 2005-03-07 02:41:51 EST
not known.. this sounds really like that alloca buffer gets overflown...
Comment 6 Arjan van de Ven 2005-03-07 03:12:38 EST
line 64 of popthelp.c is
char format[10];
....
line 97 of popthelp.c is then
sprintf(format, "%%.%ds\n%%%ds", (int) (ch - help), indentLength);

which is the culprit, the content for "format" at the time of crash is
(gdb) print format
$2 = "%.24s\n%49 "

and is longer than 10 characters already (terminating zero), so this is actually
overflowing a static buffer on the stack (and the sprintf might well not be
finished yet)
Comment 9 Jakub Jelinek 2005-03-07 09:42:12 EST
That's a big gun solution.  Even if int is 64-bit (that's not the case on any
of Linux arches), it can be at most 47 characters, for 32-bit it is 29 chars.
Comment 10 Matthias Clasen 2005-03-07 10:13:42 EST
Bad me...I wasted 81 bytes. Thankfully it is only --help output and the app will
exit nanoseconds later anyway...

Note You need to log in before you can comment on or make changes to this bug.