Red Hat Bugzilla – Bug 85478
ipcalc memory handling: corrupt help text in certain circumstances
Last modified: 2014-03-16 22:34:55 EDT
ipcalc help text becomes corrupt when given a CIDR style network specification with no options. This appears to be related to one or two memory handling errors inside the program. Proposed fix information at the end. How reproducible: 100% across Steps to reproduce: ipcalc 1.1/23 Actual results: Usage: `áB`áBháBháBÃÃxáBxáBáBáááBáBáBáBáB áB áB¨áB¨áB°áB°áB¸áB¸áBÃáBÃáBÃáBÃáBÃáBÃáBÃáBÃáBà áBà áBèáBèáBðáBðáBøáBøáB [OPTION...] -b, --broadcast Display calculated broadcast address -h, --hostname Show hostname determined via DNS -m, --netmask Display default netmask for IP (class A, B, or C) -n, --network Display network address -p, --prefix Display network prefix -s, --silent Don't ever display error messages Help options: -?, --help Show this help message --usage Display brief usage message Expected results: Usage: ipcalc [OPTION...] -b, --broadcast Display calculated broadcast address -h, --hostname Show hostname determined via DNS -m, --netmask Display default netmask for IP (class A, B, or C) -n, --network Display network address -p, --prefix Display network prefix -s, --silent Don't ever display error messages Help options: -?, --help Show this help message --usage Display brief usage message Additional info: there are two patches attached to this. One of them fixes the bug and the other one is for a separate memory management mistake. I am not sure if they interact. Patch 1: popt memory should not be freed before giving help text (fixes problem) Patch 2: a round close bracket ')' has been misplaced causing too small memory allocation (couldn't see any change from this)
Created attachment 90453 [details] Patch: Free popt memory only after having given out helptext N.B. Both patch 1 and patch 2 from this bug report should be applied.
Created attachment 90454 [details] allocate enough memory for string When we allocate the memory for the ip address string, we want to allocate for the string + the two characters + terminating zero rather than allocating memory for the remainder of the string starting from three characters in.
This bug also exists in RedHat 7.3. The symptom doesn't exist in RedHat 7.1 which didn't provide a help text in this case. I don't know if that means that the software is okay.
Fixed in 7.31-1; thanks!