bug#64233: patch: Ensure that makeinfo ≥ 6.8 checks the @menu structure

[Bruno Haible]

Pádraig Brady wrote:
> coreutils has a dep on makeinfo >= 6.1
> and that version supports the -c option,
> so the change should work everywhere.

Yes. makeinfo versions < 6.8 give a warning that they don't know about the
customization variable CHECK_NORMAL_MENU_STRUCTURE. You can simply ignore
this warning. makeinfo version 6.8 is already pretty widely deployed, since
it was released two years ago.

Bruno

bug#64233: patch: Ensure that makeinfo ≥ 6.8 checks the @menu structure

[Pádraig Brady]

On 22/06/2023 23:05, Bruno Haible wrote:

Makeinfo versions < 6.7 detected mistakes in the @menu structure of TeXinfo
input. Makeinfo versions ≥ 6.8 don't do this any more by default. They need
an extra option, for this validation to happen. See
.

Since doc/coreutils.texi has a hand-written @menu, it should use this extra
option.

Here's a patch to that effect. I checked it by running
   touch doc/coreutils.texi; make doc/coreutils.info V=1
and
   make sc_makefile_at_at_check



coreutils has a dep on makeinfo >= 6.1
and that version supports the -c option,
so the change should work everywhere.

Pushed.

Marking this as done.

thanks!
Pádraig

bug#64233: patch: Ensure that makeinfo ≥ 6.8 checks the @menu structure

[Bruno Haible]

Makeinfo versions < 6.7 detected mistakes in the @menu structure of TeXinfo
input. Makeinfo versions ≥ 6.8 don't do this any more by default. They need
an extra option, for this validation to happen. See
.

Since doc/coreutils.texi has a hand-written @menu, it should use this extra
option.

Here's a patch to that effect. I checked it by running
  touch doc/coreutils.texi; make doc/coreutils.info V=1
and
  make sc_makefile_at_at_check
From d3f0c8f482d8be6cb3e117331f0dca7e4fa72503 Mon Sep 17 00:00:00 2001
From: Bruno Haible 
Date: Thu, 22 Jun 2023 23:59:11 +0200
Subject: [PATCH] =?UTF-8?q?build:=20Ensure=20that=20makeinfo=20=E2=89=A5?=
 =?UTF-8?q?=206.8=20checks=20the=20@menu=20structure?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See .

* doc/local.mk (MAKEINFO): New variable.
* cfg.mk (_makefile_at_at_check_exceptions): Update.
---
 cfg.mk   | 3 ++-
 doc/local.mk | 4 
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/cfg.mk b/cfg.mk
index 92f119ee2..6ba8981ab 100644
--- a/cfg.mk
+++ b/cfg.mk
@@ -52,7 +52,8 @@ export XZ_OPT = -8e
 old_NEWS_hash = ac6cb1c35890b53e56acbfbb078fcd53
 
 # Add an exemption for sc_makefile_at_at_check.
-_makefile_at_at_check_exceptions = ' && !/^cu_install_prog/ && !/dynamic-dep/'
+_makefile_at_at_check_exceptions = \
+  ' && !/MAKEINFO/ && !/^cu_install_prog/ && !/dynamic-dep/'
 
 # Our help-version script is in a slightly different location.
 _hv_file ?= $(srcdir)/tests/misc/help-version
diff --git a/doc/local.mk b/doc/local.mk
index 9714d5b18..b5a6c33b6 100644
--- a/doc/local.mk
+++ b/doc/local.mk
@@ -25,6 +25,10 @@ doc_coreutils_TEXINFOS = \
   doc/fdl.texi \
   doc/sort-version.texi
 
+# The customization variable CHECK_NORMAL_MENU_STRUCTURE is necessary with
+# makeinfo versions ≥ 6.8.
+MAKEINFO = @MAKEINFO@ -c CHECK_NORMAL_MENU_STRUCTURE=1
+
 # The following is necessary if the package name is 8 characters or longer.
 # If the info documentation would be split into 10 or more separate files,
 # then this is necessary even if the package name is 7 characters long.
-- 
2.34.1

bug#64229: b2sum: heap-overflow in digest_check

[Pádraig Brady]

On 22/06/2023 17:33, Frank Busse wrote:

Hi,


KLEE reported a heap-overflow in b2sum (Coreutils 9.3). When running it
with:

$ printf '\n\n0A0BA0' | coreutils-9.3/bin/b2sum -c

(even '0BA0' seems to work on my machine) ASAN confirms the issue:


#1  0x00473de0 in __interceptor_strchr (s=, c=)
#2  0x00500a81 in digest_check (checkfile_name=0x7fffe69e "stdin") 
at /tmp/src/coreutils-9.3/src/digest.c:1216
#3  0x005005e9 in main (argc=3, argv=0x7fffe3a8) at 
/tmp/src/coreutils-9.3/src/digest.c:1607


Nice one.
I'll push the attached later to fix this.

Marking this as done.

thanks,
Pádraig.
From bc5e3ab04c454c44b6c4d79b900c236cca35e9ae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A1draig=20Brady?= 
Date: Thu, 22 Jun 2023 21:33:58 +0100
Subject: [PATCH] b2sum: fix UAR with --check with malformed checksum lines

* src/digest.c (split_3): Reinstate the check for whitespace after the
digest portion of the line, so that we exit early before inspecting
the file name which would be outside the passed buffer in the case
where the input does not contain a newline.
* tests/cksum/b2sum.sh: Add a test case.
* NEWS: Mention the bug fix.
Problem reported by Frank Busse using KLEE.
Fixes https://bugs.gnu.org/64229
---
 NEWS | 4 
 src/digest.c | 4 
 tests/cksum/b2sum.sh | 5 +
 3 files changed, 13 insertions(+)

diff --git a/NEWS b/NEWS
index 3e2280777..3c134db52 100644
--- a/NEWS
+++ b/NEWS
@@ -8,6 +8,10 @@ GNU coreutils NEWS-*- outline -*-
   fail on files with inode numbers that do not fit into 32 bits.
   [This bug was present in "the beginning".]
 
+  'b2sum --check' will no longer read unallocated memory when
+  presented with malformed checksum lines.
+  [bug introduced in coreutils-9.2]
+
   'cp --parents' again succeeds when preserving mode for absolute directories.
   Previously it would have failed with a "No such file or directory" error.
   [bug introduced in coreutils-9.1]
diff --git a/src/digest.c b/src/digest.c
index ab32968db..851c7d118 100644
--- a/src/digest.c
+++ b/src/digest.c
@@ -862,6 +862,10 @@ split_3 (char *s, size_t s_len,
   while (s[i] && !ISWHITE (s[i]))
 i++;
 
+  /* The digest must be followed by at least one whitespace character.  */
+  if (i == s_len)
+return false;
+
   *d_len = &s[i] - (char *) *digest;
   s[i++] = '\0';
 
diff --git a/tests/cksum/b2sum.sh b/tests/cksum/b2sum.sh
index 6a2d13024..7013b4972 100755
--- a/tests/cksum/b2sum.sh
+++ b/tests/cksum/b2sum.sh
@@ -61,6 +61,11 @@ printf '%s\n' 'BLAKE2' 'BLAKE2b' 'BLAKE2-' 'BLAKE2(' 'BLAKE2 (' > crash.check \
   || framework_failure_
 returns_ 1 $prog -c crash.check || fail=1
 
+# This would read unallocated memory from coreutils-9.2 to coreutils-9.3
+# which would trigger with ASAN or valgrind
+printf '0A0BA0' > overflow.check || framework_failure_
+returns_ 1 $prog -c overflow.check || fail=1
+
 done
 
 Exit $fail
-- 
2.40.1

bug#64229: b2sum: heap-overflow in digest_check

[Frank Busse]

Hi,


KLEE reported a heap-overflow in b2sum (Coreutils 9.3). When running it
with:

$ printf '\n\n0A0BA0' | coreutils-9.3/bin/b2sum -c

(even '0BA0' seems to work on my machine) ASAN confirms the issue:

> #1  0x00473de0 in __interceptor_strchr (s=, 
> c=)
> #2  0x00500a81 in digest_check (checkfile_name=0x7fffe69e 
> "stdin") at /tmp/src/coreutils-9.3/src/digest.c:1216
> #3  0x005005e9 in main (argc=3, argv=0x7fffe3a8) at 
> /tmp/src/coreutils-9.3/src/digest.c:1607


Best,

Frank