Bug 21307 - Sort segfaults (strcoll buffer overflows when LANG is set).
Sort segfaults (strcoll buffer overflows when LANG is set).
Status: CLOSED CURRENTRELEASE
Product: Red Hat Linux
Classification: Retired
Component: textutils (Show other bugs)
7.1
i686 Linux
medium Severity high
: ---
: ---
Assigned To: Bernhard Rosenkraenzer
David Lawrence
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2000-11-24 15:28 EST by e.mergl
Modified: 2007-04-18 12:30 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2001-08-17 21:07:17 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
A file that crashes sort when LANG=en_US (280.83 KB, application/octet-stream)
2001-02-20 22:43 EST, Chris Dunlop
no flags Details
A shorter example of a file that crashes sort when LANG is set. (16.02 KB, text/plain)
2001-08-17 21:07 EDT, Aleksey Nogin
no flags Details

  None (edit)
Description e.mergl 2000-11-24 15:28:37 EST
when sorting files produced by glimpse, sort dumps core.
Same sort-command with the same glimpse files works up to RH6.2.

config: textutils-2.0e-8, glibc-2.1.94-3
        NO environment variables for localization set

[root@sls glimpse]# gdb /bin/sort core
...
warning: stop_or_attach_thread: generic error
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  0x400b08e0 in strcoll () at strcoll.c:228
228     strcoll.c: No such file or directory.
(gdb)
Comment 1 e.mergl 2000-11-24 15:35:33 EST
I was wrong in my description of the environment:
the environment variable LANG was set to en_US.
After unsetting this variable the problem disappeared.
Comment 2 Bernhard Rosenkraenzer 2000-11-24 15:36:38 EST
This may still be a problem... Please attach a sample file sort coredumped on.
Comment 3 Bernhard Rosenkraenzer 2001-01-04 10:00:51 EST
Closing due to lack of input, feel free to reopen this with more information.
Comment 4 Chris Dunlop 2001-02-20 22:41:16 EST
Please re-open this case.  I can supply a file (~280Kb) that crashes sort when
LANG=en_US, but not when LANG is not set.
Comment 5 Chris Dunlop 2001-02-20 22:43:07 EST
Created attachment 10600 [details]
A file that crashes sort when LANG=en_US
Comment 6 Aleksey Nogin 2001-08-17 21:05:21 EDT
I see the same crash with LANG=ru_RU.KOI8-R (or en_US) on RH7.1+all updates. I
can reporduce it using a file with two lines: first is "./" and second contains
16400 dots.

BTW, can non-root user manipulate something on a machine to cause some admin
script running as root to overflow sort and execute something malicious? Could
be a security hole...

home:/tmp> env -i LANG=ru_RU.KOI8-R /bin/sort < sortbug
Segmentation fault (core dumped)
Exit 139
home:/tmp> env -i LANG=en_US /bin/sort < sortbug
Segmentation fault (core dumped)
Exit 139
home:/tmp> rpm -q textutils glibc
textutils-2.0.11-7
glibc-2.2.2-10
home:/tmp> gdb -core core /bin/sort
GNU gdb 5.0rh-5 Red Hat Linux 7.1
[...]
Core was generated by `/bin/sort'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /lib/i686/libc.so.6...done.
Loaded symbols for /lib/i686/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
#0  strcoll () at strcoll.c:229
229     strcoll.c: No such file or directory.
        in strcoll.c
(gdb) bt
#0  strcoll () at strcoll.c:229
#1  0x0804ef5e in __fxstat64 ()
#2  0x0804b736 in __fxstat64 ()
#3  0x0804c4f8 in __fxstat64 ()
#4  0x0804cb87 in __fxstat64 ()
#5  0x0804e22d in __fxstat64 ()
#6  0x40043177 in __libc_start_main (main=0x804cff8 <__fxstat64+15636>, argc=1,
    ubp_av=0xbfffff44, init=0x8048e9c, fini=0x8050dec <__umoddi3+860>,
    rtld_fini=0x4000e184 <_dl_fini>, stack_end=0xbfffff3c)
    at ../sysdeps/generic/libc-start.c:129
Comment 7 Aleksey Nogin 2001-08-17 21:07:13 EDT
Created attachment 28373 [details]
A shorter example of a file that crashes sort when LANG is set.
Comment 8 Bernhard Rosenkraenzer 2002-01-22 07:52:09 EST
This was fixed in 7.2.

Note You need to log in before you can comment on or make changes to this bug.