"You can't look at the length of the returned string as the buffer is
already corrupted at that point and memcached_response does not return
the length either."
For you to understand why what your saying is off, you will need to
spend sometime understanding how memcached_response(), which
> Calling memset() would be incorrect in this case even if you were concerned
> about a NULL character
How is it incorrect? memcached_response never writes the last byte of the
buffer, so whatever it writes will be guaranteed to be null terminated.
> i.e. the minimal change would be to insert a
Please provide a test case clearly showing the bug in the upstream
project.
Calling memset() would be incorrect in this case even if you were
concerned about a NULL character ( i.e. the minimal change would be to
insert a NULL character in the buffer after looked at the length of the
returned
> memcached_response() adds NULL to strings
Please point to the place where null is appended.
> As you can see, an error is returned back to memcached_sasl as
mentioned in the original report.
Where does it say in the original report that an error is returned?
> there is no bug in the reporters
Hi,
>From the code:
memcached_return_t rc= memcached_response(server, mech, sizeof(mech), NULL);
if (memcached_failed(rc))
memcached_response() adds NULL to strings if memcached_response() successful,
otherwise the code follows the error path. The author of this report mentions:
** Tags removed: sts-sponsor-slashd
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
response handling
To manage
** Tags removed: verification-needed
** Tags added: verification-done
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
** Changed in: libmemcached (Ubuntu Trusty)
Status: Invalid => Won't Fix
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
** Changed in: libmemcached (Ubuntu Trusty)
Status: Fix Committed => Invalid
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
This bug was fixed in the package libmemcached - 1.0.18-4.1ubuntu2
---
libmemcached (1.0.18-4.1ubuntu2) xenial; urgency=medium
* d/p/fixing_missing_null_termination.patch:
- Fix missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
response handling (LP:
This bug was fixed in the package libmemcached -
1.0.18-4.2ubuntu0.18.04.1
---
libmemcached (1.0.18-4.2ubuntu0.18.04.1) bionic; urgency=medium
* d/p/fixing_missing_null_termination.patch:
- Fix missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
response
Thanks for verifying! I'll drop the trusty package from -proposed and
release the others into -updates.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
This bug was fixed in the package libmemcached -
1.0.18-4.2ubuntu0.18.10.1
---
libmemcached (1.0.18-4.2ubuntu0.18.10.1) cosmic; urgency=medium
* d/p/fixing_missing_null_termination.patch:
- Fix missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
response
Ionna,
Let's then request the SRU verification team to drop the package for
trusty-proposed.
If SASL is not supported in the Trusty pkg, there is no point to complete the
SRU for Trusty.
Additionally, since Trusty is near to its EOL, I don't see good
reason/justification to justify the
Verification on Trusty :
**Verification failed**
libmemcached on Trusty does not support SASL authentication
Repeating the steps described in the [Test Case] of bug description :
Install the trusty-proposed packages
$ dpkg -l | grep libmemcached
ii libhashkit-dev
Correction on comment #28 :
Verification on Bionic
Repeating the steps described in the [Test Case] of bug description :
Install the bionic-proposed packages
$ dpkg -l | grep libmem
ii libhashkit-dev:amd64 1.0.18-4.2ubuntu0.18.04.1
amd64libmemcached
Verification on Cosmic :
Repeating the steps described in the [Test Case] of bug description :
Install the cosmic-proposed packages
$ dpkg -l | grep libmemcached
ii libhashkit-dev:amd64 1.0.18-4.2ubuntu0.18.10.1
amd64libmemcached hashing functions and
Verification on Bionic :
Repeating the steps described in the [Test Case] of bug description :
Install the bionic-proposed packages
$ dpkg -l | grep libmemcache
ii libhashkit-dev:amd64 1.0.18-4.2
amd64libmemcached hashing functions and
Verification on Xenial :
Repeating the steps described in the [Test Case] of bug description :
Install the xenial-proposed packages
$ dpkg -l | grep libmem
ii libhashkit-dev 1.0.18-4.1ubuntu2 amd64 libmemcached
hashing functions and algorithms (development files)
ii
** Description changed:
[Impact]
When connecting to a server using SASL,
memcached_sasl_authenticate_connection() reads the list of supported
mechanisms [1] from the server via the command
PROTOCOL_BINARY_CMD_SASL_LIST_MECHS. The server's response is a string
containing supported
** Project changed: libmemcached => ubuntu-translations
** No longer affects: ubuntu-translations
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
Thanks Łukasz, this looks appropriate for an SRU update.
Thanks
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
Hello Stefan, or anyone else affected,
Accepted libmemcached into cosmic-proposed. The package will build now
and be available at
https://launchpad.net/ubuntu/+source/libmemcached/1.0.18-4.2ubuntu0.18.10.1
in a few hours, and then in the -proposed repository.
Please help us by testing this new
I accepted this to -proposed, but since this seems to be a security-
related fix, I would really want the security team to take a look at the
change and decide whether this should actually go through -security or
both.
--
You received this bug notification because you are a member of Ubuntu
[Additionnal Sponsor note]
---
Xenial
---
Rejected:
File libmemcached_1.0.18-4.1ubuntu1.debian.tar.xz already exists in Primary
Archive for Ubuntu, but uploaded version has different contents. See more
information about this error in
https://help.launchpad.net/Packaging/UploadErrors.
Files
Note:
---
* No longer active upstream
- https://code.launchpad.net/libmemcached
- Last Modified: 2014-02-16
* Patch has been submitted Debian
- https://bugs.debian.org/919696
---
Under the circumstances of libmemcached being no longer active upstream
and considering the fact that @Joalif
This bug was fixed in the package libmemcached - 1.0.18-4.2ubuntu1
---
libmemcached (1.0.18-4.2ubuntu1) disco; urgency=medium
* d/p/fixing_missing_null_termination.patch:
- Fix missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
response handling (LP:
Thanks Ionna for the [test case] improvement.
Sponsored for Disco, once the package is found in disco-release, we can go
ahead with the SRU for T,X,B,C.
- Eric
** Changed in: libmemcached (Ubuntu Disco)
Status: In Progress => Fix Committed
--
You received this bug notification because
** Description changed:
[Impact]
When connecting to a server using SASL,
memcached_sasl_authenticate_connection() reads the list of supported
mechanisms [1] from the server via the command
PROTOCOL_BINARY_CMD_SASL_LIST_MECHS. The server's response is a string
containing supported
** Changed in: libmemcached (Debian)
Status: Unknown => New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
@joalif,
I'll gladly sponsor this SRU for you ... but I'm a little bit concerned
about the test case field being empty and I'm sure the SRU team (ppl who
approved upload) will do as well.
While I can understand there is no clear reproducer for that bug ...
Could you please prove somehow that
** Bug watch added: Debian Bug tracker #919696
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919696
** Also affects: libmemcached (Debian) via
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=919696
Importance: Unknown
Status: Unknown
--
You received this bug notification
** Description changed:
[Impact]
When connecting to a server using SASL,
memcached_sasl_authenticate_connection() reads the list of supported
mechanisms [1] from the server via the command
PROTOCOL_BINARY_CMD_SASL_LIST_MECHS. The server's response is a string
containing supported
** Tags removed: sts-sponsor-ddstreet
** Tags added: sts-sponsor-slashd
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
** Patch added: "lp1573594_trusty.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230346/+files/lp1573594_trusty.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
New debdiff for bionic.
** Patch added: "lp1573594_bionic.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230343/+files/lp1573594_bionic.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
New debdiff for bionic.
** Patch added: "lp1573594_bionic.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230342/+files/lp1573594_bionic.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
New debdiff for xenial.
** Patch added: "lp1573594_xenial.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230344/+files/lp1573594_xenial.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
New debdiff for disco.
** Patch added: "lp1573594_disco.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230340/+files/lp1573594_disco.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to
** Patch added: "lp1573594_cosmic.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230341/+files/lp1573594_cosmic.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
Hi @joalif,
couple changes needed in the debdiffs, please:
1) the patch "debian/patches/fix_missing_null_termination" has no suffix...
not a major problem but convention is to suffix it with ".diff" or ".patch"
2) The line in your patch:
+ * Fix missing null terminated buffer. Closes:
The attachment "lp1573594_disco.debdiff" seems to be a debdiff. The
ubuntu-sponsors team has been subscribed to the bug report so that they
can review and hopefully sponsor the debdiff. If the attachment isn't a
patch, please remove the "patch" flag from the attachment, remove the
"patch" tag,
** Patch added: "Fix for bionic"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230020/+files/lp1573594_bionic.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
** Patch added: "lp1573594_disco.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230019/+files/lp1573594_disco.debdiff
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
** Patch added: "lp1573594_xenial.debdiff"
https://bugs.launchpad.net/ubuntu/+source/libmemcached/+bug/1573594/+attachment/5230021/+files/lp1573594_xenial.debdiff
** Tags added: sts
** Tags added: sts-sponsor
--
You received this bug notification because you are a member of Ubuntu
Bugs,
** Description changed:
+ [Impact]
+
When connecting to a server using SASL,
memcached_sasl_authenticate_connection() reads the list of supported
mechanisms [1] from the server via the command
PROTOCOL_BINARY_CMD_SASL_LIST_MECHS. The server's response is a string
containing supported
** Changed in: libmemcached (Ubuntu Cosmic)
Status: New => In Progress
** Changed in: libmemcached (Ubuntu Bionic)
Status: New => In Progress
** Changed in: libmemcached (Ubuntu Xenial)
Status: New => In Progress
** Changed in: libmemcached (Ubuntu Trusty)
Status:
** Changed in: libmemcached (Ubuntu Cosmic)
Assignee: (unassigned) => Ioanna Alifieraki (joalif)
** Changed in: libmemcached (Ubuntu Bionic)
Assignee: (unassigned) => Ioanna Alifieraki (joalif)
** Changed in: libmemcached (Ubuntu Xenial)
Assignee: (unassigned) => Ioanna Alifieraki
** Also affects: libmemcached (Ubuntu Bionic)
Importance: Undecided
Status: New
** Also affects: libmemcached (Ubuntu Cosmic)
Importance: Undecided
Status: New
** Also affects: libmemcached (Ubuntu Disco)
Importance: Undecided
Assignee: Ioanna Alifieraki (joalif)
** Changed in: libmemcached (Ubuntu)
Status: Confirmed => In Progress
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
** Changed in: libmemcached (Ubuntu)
Assignee: (unassigned) => Ioanna Alifieraki (joalif)
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
Status changed to 'Confirmed' because the bug affects multiple users.
** Changed in: libmemcached (Ubuntu)
Status: New => Confirmed
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
This looks like a duplicate of #1381160.
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
response handling
To manage
** Also affects: libmemcached
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in
Thank you fr your report, sadly it was missed to be picked up so far -
I'm subscribing the security Team for their thoughts on the issue.
** Information type changed from Public to Public Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed
Reporting here as it might be security relevant and the upstream is dead
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1573594
Title:
Missing null termination in PROTOCOL_BINARY_CMD_SASL_LIST_MECHS
56 matches
Mail list logo
