Bug 585206 - Unknown wn option handled as format string
Unknown wn option handled as format string
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: wordnet (Show other bugs)
rawhide
All Linux
low Severity medium
: ---
: ---
Assigned To: steve
Fedora Extras Quality Assurance
:
Depends On: 585199
Blocks:
  Show dependency treegraph
 
Reported: 2010-04-23 08:32 EDT by Petr Pisar
Modified: 2010-05-14 02:41 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: 585199
Environment:
Last Closed: 2010-05-14 02:41:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fix (272 bytes, patch)
2010-04-23 08:33 EDT, Petr Pisar
no flags Details | Diff

  None (edit)
Description Petr Pisar 2010-04-23 08:32:26 EDT
+++ This bug was initially created as a clone of Bug #585199 +++

Description of problem:

`wn' utilty from wordnet-3.0 package passes user input (executable positional
argument to fprintf(3) as format string without check for format escapes.


Version-Release number of selected component (if applicable):

wordnet-3.0-10.fc14 and lower version in all Fedoras.


How reproducible:

Compile and install wordnet package and invoke `wn' executable with invalid
arguments resulting in application error message:

    $ wn -antsn 'Hello world'
    wn: invalid search option: Hello world

Now try some formating escapes:

    $ wn -antsn '%s'
    Segmentation fault (core dumped)

    $ wn -antsn '%x %x %x %x'
    wn: invalid search option: 1 b 0 1789f60d

    $ wn -antsn '%n'
    *** %n in writable segment detected ***
    Aborted (core dumped)

Additional info:
WordNet-3.0/src/wn.c:346:

    static int error_message(char *msg)
    {
→       fprintf(stderr, msg);
        return(0);
    }

--- Additional comment from ppisar@redhat.com on 2010-04-23 08:19:52 EDT ---

Created an attachment (id=408589)
Fix

Print message as raw string.
Comment 1 Petr Pisar 2010-04-23 08:33:50 EDT
Created attachment 408592 [details]
Fix

Print message as raw string.
Comment 2 Fedora Update System 2010-04-26 04:30:18 EDT
wordnet-3.0-11.fc13 has been submitted as an update for Fedora 13.
http://admin.fedoraproject.org/updates/wordnet-3.0-11.fc13
Comment 3 Fedora Update System 2010-04-26 04:31:41 EDT
wordnet-3.0-11.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/wordnet-3.0-11.fc12
Comment 4 Fedora Update System 2010-04-26 04:44:39 EDT
wordnet-3.0-10.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/wordnet-3.0-10.fc11
Comment 5 Petr Pisar 2010-04-26 05:04:12 EDT
Fixed in CVS for F14--F11. Koji does not acceppt build tasks for F10 any more. Thus F10 will be unpatched.
Comment 6 Fedora Update System 2010-05-13 15:28:22 EDT
wordnet-3.0-11.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2010-05-13 15:30:14 EDT
wordnet-3.0-11.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2010-05-13 15:33:08 EDT
wordnet-3.0-10.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.