Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
First Last Prev Next    This bug is not in your last search results.
Bug 706673 - Cups config parsing segfault
Cups config parsing segfault
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: cups (Show other bugs)
6.0
All Linux
medium Severity medium
: rc
: ---
Assigned To: Tim Waugh
qe-baseos-daemons
: Patch
Depends On:
Blocks: 784240
  Show dependency tree / graph
 
Reported: 2011-05-22 04:56 EDT by Richard Marko
Modified: 2012-01-24 06:31 EST (History)
7 users (show)

See Also:
Fixed In Version: cups-1.4.2-40.el6
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 784240 (view as bug list)
Environment:
Last Closed: 2011-12-06 10:28:34 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Minimized input file (8 bytes, application/octet-stream)
2011-05-22 04:56 EDT, Richard Marko 		no flags Details
GDB short trace (297 bytes, text/plain)
2011-05-22 04:57 EDT, Richard Marko 		no flags Details
GDB full trace (11.32 KB, text/plain)
2011-05-22 04:57 EDT, Richard Marko 		no flags Details
Valgrind output (1.95 KB, text/plain)
2011-05-22 04:58 EDT, Richard Marko 		no flags Details
GDB short trace #2 (499 bytes, text/plain)
2011-05-22 05:45 EDT, Richard Marko 		no flags Details
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
CUPS Bugs and Features 3861 None None None Never
Red Hat Product Errata RHSA-2011:1635 normal SHIPPED_LIVE Low: cups security and bug fix update 2011-12-05 19:50:41 EST

  None (edit)
Description Richard Marko 2011-05-22 04:56:25 EDT 
Created attachment 500243 [details]
Minimized input file

Description of problem:
Cups crashing with segfault on attached config file.

Version-Release number of selected component (if applicable):
Version    : 1.4.2
Release    : 35.el6_0.1


How reproducible:
Always


Steps to Reproduce:
1. download attachment
2. run /usr/sbin/cupsd -f -c ./min

  
Actual results:
Segmentation fault


Expected results:
Proper error handling


Additional info:
Fault discovered by fuzzing the configuration file.
Comment 1 Richard Marko 2011-05-22 04:57:28 EDT 
Created attachment 500244 [details]
GDB short trace
Comment 2 Richard Marko 2011-05-22 04:57:53 EDT 
Created attachment 500245 [details]
GDB full trace
Comment 3 Richard Marko 2011-05-22 04:58:12 EDT 
Created attachment 500246 [details]
Valgrind output
Comment 5 Richard Marko 2011-05-22 05:45:44 EDT 
Created attachment 500250 [details]
GDB short trace #2

Similar error in parse_aaa function (parsing logic).
I will provide additional information if required.
Comment 8 Jiri Popelka 2011-06-15 05:51:29 EDT 
Patch:
http://www.cups.org/strfiles/3861/str3861.patch
Comment 12 errata-xmlrpc 2011-12-06 10:28:34 EST 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2011-1635.html
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.