Bug 1683292 - curl crashes on http links with rate-limit
Summary: curl crashes on http links with rate-limit
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: curl
Version: 7.6
Hardware: Unspecified
OS: Unspecified
urgent
high
Target Milestone: rc
: ---
Assignee: Kamil Dudka
QA Contact: Daniel Rusek
URL:
Whiteboard:
: 1702828 1710180 1724292 (view as bug list)
Depends On:
Blocks: 1630404 1707454 1711914
TreeView+ depends on / blocked
 
Reported: 2019-02-26 14:22 UTC by Martin Poole
Modified: 2019-08-06 13:03 UTC (History)
8 users (show)

Fixed In Version: curl-7.29.0-52.el7
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1711914 (view as bug list)
Environment:
Last Closed: 2019-08-06 13:03:15 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2181 None None None 2019-08-06 13:03:28 UTC

Description Martin Poole 2019-02-26 14:22:06 UTC
Description of problem:

curl crashes with segm
Version-Release number of selected component (if applicable):

curl-7.29.0-48.el7

How reproducible:

Always

Steps to Reproduce:
1. curl -s --limit-rate 4m http://example.com/somebigfile
2.
3.

Actual results:

*** Error in `curl': free(): invalid pointer: 0x0000000001ea8270 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81489)[0x7fe0ef8da489]
curl[0x4085dc]
curl[0x40238e]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fe0ef87b3d5]
curl[0x402412]
======= Memory map: ========
00400000-00425000 r-xp 00000000 fd:01 202452587                          /usr/bin/curl
00624000-00625000 r--p 00024000 fd:01 202452587                          /usr/bin/curl
00625000-00626000 rw-p 00025000 fd:01 202452587                          /usr/bin/curl
01e9c000-01ee0000 rw-p 00000000 00:00 0                                  [heap]
7fe0e0000000-7fe0e0021000 rw-p 00000000 00:00 0
7fe0e0021000-7fe0e4000000 ---p 00000000 00:00 0

or just

Segmentation Fault


Expected results:

rate limited download.

Additional info:

Testing prior releases indicates it is the -47 to -48 patches that introduced the regression.

Comment 5 Kamil Dudka 2019-02-26 16:08:49 UTC
Thank you for analyzing the issue!  It seems to be caused by:

    0061-curl-7.29.0-CVE-2018-1000122.patch

The following upstream commit triggers it:

    https://github.com/curl/curl/commit/curl-7_54_0-55-gc2ddc12

... and the following upstream commit fixes it:

    https://github.com/curl/curl/commit/curl-7_54_0-70-ge3ed5cb

I need to review all the commits from upstream pull request #1449:

    https://github.com/curl/curl/pull/1449/commits

... as they seem to be tightly dependent on each other.

Comment 12 Kamil Dudka 2019-04-25 12:14:52 UTC
*** Bug 1702828 has been marked as a duplicate of this bug. ***

Comment 13 Kamil Dudka 2019-05-17 08:27:05 UTC
*** Bug 1710180 has been marked as a duplicate of this bug. ***

Comment 21 Kamil Dudka 2019-06-27 08:36:27 UTC
*** Bug 1724292 has been marked as a duplicate of this bug. ***

Comment 23 errata-xmlrpc 2019-08-06 13:03:15 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2181


Note You need to log in before you can comment on or make changes to this bug.