Bug 21307 - Sort segfaults (strcoll buffer overflows when LANG is set).
Summary: Sort segfaults (strcoll buffer overflows when LANG is set).
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Red Hat Linux
Classification: Retired
Component: textutils
Version: 7.1
Hardware: i686
OS: Linux
medium
high
Target Milestone: ---
Assignee: Bernhard Rosenkraenzer
QA Contact: David Lawrence
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2000-11-24 20:28 UTC by e.mergl
Modified: 2007-04-18 16:30 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2001-08-18 01:07:17 UTC
Embargoed:


Attachments (Terms of Use)
A file that crashes sort when LANG=en_US (280.83 KB, application/octet-stream)
2001-02-21 03:43 UTC, Chris Dunlop
no flags Details
A shorter example of a file that crashes sort when LANG is set. (16.02 KB, text/plain)
2001-08-18 01:07 UTC, Aleksey Nogin
no flags Details

Description e.mergl 2000-11-24 20:28:37 UTC
when sorting files produced by glimpse, sort dumps core.
Same sort-command with the same glimpse files works up to RH6.2.

config: textutils-2.0e-8, glibc-2.1.94-3
        NO environment variables for localization set

[root@sls glimpse]# gdb /bin/sort core
...
warning: stop_or_attach_thread: generic error
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x400b08e0 in strcoll () at strcoll.c:228
228     strcoll.c: No such file or directory.
(gdb)

Comment 1 e.mergl 2000-11-24 20:35:33 UTC
I was wrong in my description of the environment:
the environment variable LANG was set to en_US.
After unsetting this variable the problem disappeared.


Comment 2 Bernhard Rosenkraenzer 2000-11-24 20:36:38 UTC
This may still be a problem... Please attach a sample file sort coredumped on.

Comment 3 Bernhard Rosenkraenzer 2001-01-04 15:00:51 UTC
Closing due to lack of input, feel free to reopen this with more information.

Comment 4 Chris Dunlop 2001-02-21 03:41:16 UTC
Please re-open this case.  I can supply a file (~280Kb) that crashes sort when
LANG=en_US, but not when LANG is not set.

Comment 5 Chris Dunlop 2001-02-21 03:43:07 UTC
Created attachment 10600 [details]
A file that crashes sort when LANG=en_US

Comment 6 Aleksey Nogin 2001-08-18 01:05:21 UTC
I see the same crash with LANG=ru_RU.KOI8-R (or en_US) on RH7.1+all updates. I
can reporduce it using a file with two lines: first is "./" and second contains
16400 dots.

BTW, can non-root user manipulate something on a machine to cause some admin
script running as root to overflow sort and execute something malicious? Could
be a security hole...

home:/tmp> env -i LANG=ru_RU.KOI8-R /bin/sort < sortbug
Segmentation fault (core dumped)
Exit 139
home:/tmp> env -i LANG=en_US /bin/sort < sortbug
Segmentation fault (core dumped)
Exit 139
home:/tmp> rpm -q textutils glibc
textutils-2.0.11-7
glibc-2.2.2-10
home:/tmp> gdb -core core /bin/sort
GNU gdb 5.0rh-5 Red Hat Linux 7.1
[...]
Core was generated by `/bin/sort'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/i686/libc.so.6...done.
Loaded symbols for /lib/i686/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  strcoll () at strcoll.c:229
229     strcoll.c: No such file or directory.
        in strcoll.c
(gdb) bt
#0  strcoll () at strcoll.c:229
#1  0x0804ef5e in __fxstat64 ()
#2  0x0804b736 in __fxstat64 ()
#3  0x0804c4f8 in __fxstat64 ()
#4  0x0804cb87 in __fxstat64 ()
#5  0x0804e22d in __fxstat64 ()
#6  0x40043177 in __libc_start_main (main=0x804cff8 <__fxstat64+15636>, argc=1,
    ubp_av=0xbfffff44, init=0x8048e9c, fini=0x8050dec <__umoddi3+860>,
    rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbfffff3c)
    at ../sysdeps/generic/libc-start.c:129


Comment 7 Aleksey Nogin 2001-08-18 01:07:13 UTC
Created attachment 28373 [details]
A shorter example of a file that crashes sort when LANG is set.

Comment 8 Bernhard Rosenkraenzer 2002-01-22 12:52:09 UTC
This was fixed in 7.2.


Note You need to log in before you can comment on or make changes to this bug.