severity 774135 important
thanks
Dixi quod…
I’ll track this down further.
OK, we have a honest code bug (typescript first, analysis below):
tglase@tglase:~ $ gdb /usr/bin/mc.distrib ~/core
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type show copying
and show warranty for details.
This GDB was configured as x86_64-linux-gnux32.
Type show configuration for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.
For help, type help.
Type apropos word to search for commands related to word...
Reading symbols from /usr/bin/mc.distrib...done.
BFD: Warning: /home/tglase/core is truncated: expected core file size =
1744896, found: 1736704.
[New LWP 22766]
[Thread debugging using libthread_db enabled]
Using host libthread_db library /lib/x86_64-linux-gnux32/libthread_db.so.1.
Core was generated by `/usr/bin/mc -d'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 0xf77a0513 in sftpfs_cb_open_connection (super=optimized out,
vpath=optimized out,
vpath_element=optimized out) at vfs_subclass.c:114
114 vpath_element-class-verrno = mcerror-code;
(gdb) bt
#0 0xf77a0513 in sftpfs_cb_open_connection (super=optimized out,
vpath=optimized out,
vpath_element=optimized out) at vfs_subclass.c:114
#1 0xf775e839 in vfs_s_get_path (vpath=vpath@entry=0xf97ae880,
archive=archive@entry=0xff95bec8,
flags=flags@entry=0) at direntry.c:1147
#2 0xf775ecfb in vfs_s_inode_from_path (vpath=vpath@entry=0xf97ae880,
flags=flags@entry=5)
at direntry.c:380
#3 0xf775eeb1 in vfs_s_opendir (vpath=optimized out) at direntry.c:409
#4 0xf775ef18 in vfs_s_chdir (vpath=optimized out) at direntry.c:477
#5 0xf7728ac1 in mc_chdir (vpath=vpath@entry=0xf9797f90) at interface.c:685
#6 0xf7735f53 in _do_panel_cd (panel=optimized out,
new_dir_vpath=0xf9797f90, cd_type=optimized out)
at panel.c:3179
#7 0xf7736afc in do_panel_cd (panel=optimized out, new_dir_vpath=optimized
out,
cd_type=optimized out) at panel.c:4535
#8 0xf77380bd in do_cd (new_dir_vpath=new_dir_vpath@entry=0xf9797f90,
exact=exact@entry=cd_parse_command)
at panel.c:4934
#9 0xf77181bb in do_cd_command (orig_cmd=optimized out) at command.c:445
#10 0xf771865f in enter (lc_cmdline=optimized out) at command.c:263
#11 command_callback (w=optimized out, sender=optimized out, msg=optimized
out,
parm=optimized out, data=optimized out) at command.c:355
#12 0xf7731e2c in send_message (data=0x0, parm=10, msg=MSG_KEY, sender=0x0,
w=optimized out)
at ../../lib/widget/widget-common.h:167
#13 midnight_callback (w=optimized out, sender=optimized out,
msg=optimized out,
parm=optimized out, data=optimized out) at midnight.c:1469
#14 0xf7719eeb in send_message (data=0x0, parm=10, msg=MSG_KEY, sender=0x0,
w=0xf9797fc0)
at ../../lib/widget/widget-common.h:167
#15 dlg_key_event (d_key=10, h=optimized out) at dialog.c:504
#16 dlg_process_event (h=optimized out, key=10, event=optimized out) at
dialog.c:1235
#17 0xf771a581 in frontend_dlg_run (h=0xf9797fc0) at dialog.c:569
#18 dlg_run (h=optimized out) at dialog.c:1266
#19 0xf7732ccd in create_panels_and_run_mc () at midnight.c:960
#20 do_nc () at midnight.c:1753
#21 0xf770d147 in main (argc=1, argv=0xff95c394) at main.c:414
(gdb) print mcerror
$1 = (GError *) 0x0
(gdb) list sftpfs_cb_open_connection
87 */
88
89 static int
90 sftpfs_cb_open_connection (struct vfs_s_super *super,
91 const vfs_path_t * vpath, const
vfs_path_element_t * vpath_element)
92 {
93 GError *mcerror = NULL;
94 sftpfs_super_data_t *sftpfs_super_data;
95 int ret_value;
96
(gdb)
97 (void) vpath;
98
99 if (vpath_element-host == NULL || *vpath_element-host == '\0')
100 {
101 vfs_print_message (_(sftp: Invalid host name.));
102 vpath_element-class-verrno = EPERM;
103 return -1;
104 }
105
106 sftpfs_super_data = g_new0 (sftpfs_super_data_t, 1);
(gdb)
107 sftpfs_super_data-original_connection_info =
vfs_path_element_clone (vpath_element);
108 super-data = sftpfs_super_data;
109 super-path_element = vfs_path_element_clone (vpath_element);
110
111 sftpfs_fill_connection_data_from_config (super, mcerror);
112 if (mc_error_message (mcerror))
113 {
114 vpath_element-class-verrno = mcerror-code;
115 return -1;
116 }
The thing is: mc_error_message free()s mcerror afterwards,
so this is a genuine use-after-free bug.
bye,
//mirabilos
--
Sometimes they [people] care too much: pretty
