First Last Prev Next    No search results available      Search page      Enter new bug
Bug#: 75305
Alias:
Product:
Component:
Status: RESOLVED
Resolution: FIXED
Assigned To: Gentoo's Team for Core System packages <base-system@gentoo.org>
Hardware:
OS:
Version:
Priority:
Severity:
Reporter: Mihai Limbasan <mihailim@gmail.com>
Add CC:
CC:
URL:
Summary:
Status Whiteboard:
Keywords:

Filename Description Type Creator Created Size Actions
bzclose-nullptr-check.diff Patch to bzip2 to fix the issue. patch Mihai Limbasan 2004-12-22 05:44 0000 487 bytes Details | Diff
Create a New Attachment (proposed patch, testcase, etc.) View All

Bug 75305 depends on: Show dependency tree
Show dependency graph
Bug 75305 blocks:
Votes: 0    Show votes for this bug    Vote for this bug

Additional Comments: (this is where you put emerge --info)







View Bug Activity   |   Format For Printing   |   XML   |   Clone This Bug

Description:   Opened: 2004-12-22 05:42 0000 
BZ2_bzclose fails to perform a NULL pointer check before actually
using the passed BZFILE * argument. The NULL check *is* performed but
only after the argument is used for the first time, resulting in a
potential NULL pointer dereference.

Reproducible: Always
Steps to Reproduce:
1. Call BZ2_bzclose with a NULL argument, resulting in a NULL pointer dereference.
Actual Results:  
SIGSEGV issued

Expected Results:  
BZ2_bzclose should have just returned without doing anything.

Bug also reported to upstream bzip2 authors / maintainers.

------- Comment #1 From Mihai Limbasan 2004-12-22 05:44:08 0000 ------- 
Created an attachment (id=46625) [edit]
Patch to bzip2 to fix the issue.

Attached patch modifies BZ2_bzclose to check its argument before first using
it, not afterwards.

------- Comment #2 From SpanKY 2004-12-22 15:34:21 0000 ------- 
i noticed this while coding some zlib/bzip2 apps of mine but figured it was a
feature ? :)

did you make this patch yourself ?  if so, have you sent it upstream ?

------- Comment #3 From Mihai Limbasan 2004-12-22 18:57:07 0000 ------- 
Definitely a bug, not a feature.
Yes and yes.

------- Comment #4 From Mihai Limbasan 2004-12-22 19:00:20 0000 ------- 
The report email seems to only have been accepted by Mr. Seward's mail server
(jseward [at] acm.org). The zlib compatibility layer author seems to have
dropped off the map - both QWF00133 [at] niftyserve.or.jp and tsuneo-y [at]
is.aist-nara.ac.jp bounce.

------- Comment #5 From SpanKY 2004-12-22 21:33:37 0000 ------- 
awesome ... if you havent heard back from them in a few days i'll gladly merge
this fix :)

------- Comment #6 From Mihai Limbasan 2004-12-26 13:04:47 0000 ------- 
No reaction from Mr. Seward yet - I think you can merge this thing. It's a very
simple and trivial patch anyway (I stumbled over it by accident while studying
the sources).

------- Comment #7 From SpanKY 2004-12-26 13:46:15 0000 ------- 
added to 1.0.2-r4

please keep us updated if you get word back from upstream :)
First Last Prev Next    No search results available      Search page      Enter new bug