Bug 2115206
| Summary: | String matching behaves differently on aarch64 | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Florian Festi <ffesti> | ||||
| Component: | bash | Assignee: | Siteshwar Vashisht <svashisht> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Karel Volný <kvolny> | ||||
| Severity: | low | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 9.1 | CC: | ashankar, codonell, dj, fweimer, mnewsome, pfrankli, sipoyare, svashisht | ||||
| Target Milestone: | rc | Keywords: | Reopened, Triaged | ||||
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
||||
| Hardware: | aarch64 | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | bash-5.1.8-5.el9 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2022-11-15 11:23:24 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
See https://bugzilla.redhat.com/show_bug.cgi?id=1983015 for original issue. I get following warning when I ran the reproducer through valgrind:
```
$ valgrind --track-origins=yes bash match.sh
...
==47424== For lists of detected and suppressed errors, rerun with: -s
==47424== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
==47423== Conditional jump or move depends on uninitialised value(s)
==47423== at 0x490758C: utf8_internal_loop (loop.c:336)
==47423== by 0x490758C: __gconv_transform_utf8_internal (skeleton.c:620)
==47423== by 0x4972167: mbrtowc (mbrtowc.c:86)
==47423== by 0x458C4F: read_comsub (subst.c:6243)
==47423== by 0x458C4F: command_substitute (subst.c:6544)
==47423== by 0x45ABCB: param_expand (subst.c:9860)
==47423== by 0x45D497: expand_word_internal (subst.c:10326)
==47423== by 0x45E163: expand_word_internal (subst.c:10510)
==47423== by 0x45FB1F: call_expand_word_internal (subst.c:3732)
==47423== by 0x45FB1F: expand_word_leave_quoted (subst.c:4056)
==47423== by 0x438033: execute_case_command (execute_cmd.c:3541)
==47423== by 0x438033: execute_command_internal (execute_cmd.c:954)
==47423== by 0x43A883: execute_command (execute_cmd.c:395)
==47423== by 0x423797: reader_loop (eval.c:170)
==47423== by 0x421EEF: main (shell.c:811)
==47423== Uninitialised value was created by a stack allocation
==47423== at 0x458730: command_substitute (subst.c:6306)
...
```
I have tried to patch bash through following patch:
```
diff --git a/subst.c b/subst.c
index 462752de..d80cc3f1 100644
--- a/subst.c
+++ b/subst.c
@@ -6304,11 +6304,11 @@ command_substitute (string, quoted, flags)
int quoted;
int flags;
{
- pid_t pid, old_pid, old_pipeline_pgrp, old_async_pid;
- char *istring, *s;
- int result, fildes[2], function_value, pflags, rc, tflag, fork_flags;
- WORD_DESC *ret;
- sigset_t set, oset;
+ pid_t pid=0, old_pid=0, old_pipeline_pgrp=0, old_async_pid=0;
+ char *istring=0, *s=0;
+ int result=0, fildes[2]={}, function_value=0, pflags=0, rc=0, tflag=0, fork_flags=0;
+ WORD_DESC *ret=0;
+ sigset_t set={}, oset={};
istring = (char *)NULL;
```
But I still keep getting the same warning. Can someone from glibc team look into it and help me find the root cause? This bug disappears when I try to reproduce it after recompiling bash. So it's possible it may be a bug in bash, but I have not been able to track it's root yet.
I think this is a bash bug. bufn+1 should be bufn: /* read a multibyte character from buf */ /* punt on the hard case for now */ memset (&ps, '\0', sizeof (mbstate_t)); mblen = mbrtowc (&wc, bufp-1, bufn+1, &ps); The reason is that bufp is advanced (“c = *bufp++;”), but not bufn is not decremented, so it has still the old value (4 in this case). zread has only written 4 bytes, so passing 5 to mbrtowc is wrong. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (bash bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2022:8403 |
Created attachment 1903498 [details] Reproducer Description of problem: Matching strings with non printable character works differently between aarch64 and all other architectures. Version-Release number of selected component (if applicable): bash-5.1.8-4.el9.aarch64 How reproducible: Always Steps to Reproduce: 1. Run attached script on x86_64 and aarch64 Actual results: Both printing "match" Expected results: Prints "match" on x86_64 but "no match" on aarch64 Additional info: We ran into this while fixing rpm2cpio.sh. Don't ask why we are handling binary data in a shell script. I wish we wouldn't. The attached script is basically the same code we have except it doesn't read the first string from a file. The issue is probably not restricted to the exact data shown there. Note that stripping the zero bytes with tr doesn't really seem to work properly even on other architectures and at some point a new line byte (0x0A) appears in the string for some reason I did not understand. But this can be seen on both architectures. So the cause is probably in the case statement / the matching of the variables themselves.