Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 106152 - sys-apps/file-4.13 - libmagic magic_buffer function accesses supplied memory buffer even if size is zero
Summary: sys-apps/file-4.13 - libmagic magic_buffer function accesses supplied memory ...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Core system (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-09-15 23:40 UTC by Erik Thiele
Modified: 2005-09-19 18:45 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Erik Thiele 2005-09-15 23:40:30 UTC
* sys-apps/file
      Latest version available: 4.13
      Latest version installed: 4.13

QQQ is an empty file.
erik@g:~$ file --mime qqq
qqq: application/x-empty

if i do the following C program with libmagic:

magic_buffer(mycookie, 0, 0);

i get a segfault in libmagic. that's not ok. it should instead
return "application/x-empty"

if i do:

char a[10]={0,0,0,0,0,0,0,0,0,0};
magic_buffer(mycookie,a,0);

it returns "text/plain" instead of "application/x-empty"

both issues must be fixed

Reproducible: Always
Steps to Reproduce:




Portage 2.0.51.22-r2 (default-linux/x86/2005.0, gcc-3.3.6, glibc-2.3.5-r1, 2.6.1
2-gentoo-r10 i686)
=================================================================
System uname: 2.6.12-gentoo-r10 i686 Intel(R) Pentium(R) 4 CPU 3.00GHz
Gentoo Base System version 1.6.13
ccache version 2.3 [enabled]
dev-lang/python:     2.3.5-r2
sys-apps/sandbox:    1.2.12
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6
sys-devel/binutils:  2.15.92.0.2-r10
sys-devel/libtool:   1.5.18-r1
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="x86"
AUTOCLEAN="yes"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/2/share/config /usr/kde/3.3/env /usr/kde/3.3/share
/config /usr/kde/3.3/shutdown /usr/kde/3.4/env /usr/kde/3.4/share/config /usr/kd
e/3.4/shutdown /usr/kde/3/share/config /usr/lib/X11/xkb /usr/lib/mozilla/default
s/pref /usr/share/config /usr/share/texmf/dvipdfm/config/ /usr/share/texmf/dvips
/config/ /usr/share/texmf/tex/generic/config/ /usr/share/texmf/tex/platex/config
/ /usr/share/texmf/xdvi/ /var/qmail/control"
CONFIG_PROTECT_MASK="/etc/gconf /etc/terminfo /etc/env.d"
CXXFLAGS="-O2 -march=pentium4 -pipe -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig ccache distlocks nostrip sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org http://distro.ibiblio.org/pub/Linux/
distributions/gentoo"
LANG="de_DE"
LINGUAS="de"
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="x86 X alsa apm arts avi berkdb bitmap-fonts cdr crypt cups curl doc dvd eds
 emboss encode esd fam flac font-server foomaticdb fortran gd gdbm gif gimpprint
 gnome gphoto2 gpm gstreamer gtk gtk2 imagemagick imlib java jpeg kde ldap libg+
+ libwww mad mikmod motif mozilla mp3 mpeg ncurses nls ogg oggvorbis opengl oss 
pam pdflib perl png postgres ppds python qt quicktime readline samba scanner sdl
 slang spell ssl tcltk tcpd tetex tiff truetype truetype-fonts type1-fonts usb v
orbis xine xml2 xmms xv zlib linguas_de userland_GNU kernel_linux elibc_glibc"
Unset:  ASFLAGS, CTARGET, LC_ALL, LDFLAGS, PORTDIR_OVERLAY
Comment 1 SpanKY gentoo-dev 2005-09-16 06:17:35 UTC
pretty sure file-4.15 fixes this, please check
Comment 2 Erik Thiele 2005-09-16 06:35:07 UTC
i checked with file-4.15. problem is not solved there.
Comment 3 SpanKY gentoo-dev 2005-09-16 10:26:04 UTC
post the actual code you're using that is causing the segfault
Comment 4 Erik Thiele 2005-09-17 00:39:33 UTC
****** FIRST PROGRAM:

#include <magic.h>
#include <stdio.h>

void main()
{
  magic_t m = magic_open(MAGIC_MIME);
  printf("magic_open returned %p\n", m);
  printf("magic_load returned %d\n", magic_load(m, 0));
  printf("magic_buffer returned %s\n", magic_buffer(m, 0, 0));
}

gcc -Wall mbug1.c -lmagic
erik@g:~/magicbug$ ./a.out 
magic_open returned 0x804a050
magic_load returned 0
Segmentation Fault
erik@g:~/magicbug$ 

the segmentation fault occurs inside the magic_buffer function.



****** SECOND PROGRAM:

#include <magic.h>
#include <stdio.h>

void main()
{
  magic_t m = magic_open(MAGIC_MIME);
  printf("magic_open returned %p\n", m);
  printf("magic_load returned %d\n", magic_load(m, 0));
  char buf[10]={0,0,0,0,0,0,0,0,0,0};
  printf("magic_buffer returned %s\n", magic_buffer(m, buf, 0));
}

gcc -Wall mbug2.c -lmagic

erik@g:~/magicbug$ ./a.out 
magic_open returned 0x804a050
magic_load returned 0
magic_buffer returned text/plain; charset=us-ascii
erik@g:~/magicbug$ 

the result is wrong here.
- he is accessing "buf" even though the size is zero.

- he returns text/plain, even though he returns application/x-empty
  on an empty file usually, see:

  erik@g:~/magicbug$ touch emptyfile
  erik@g:~/magicbug$ file --mime emptyfile 
  emptyfile: application/x-empty
  erik@g:~/magicbug$ 
Comment 5 SpanKY gentoo-dev 2005-09-17 01:13:10 UTC
fixed in 4.15
Comment 6 Erik Thiele 2005-09-18 22:42:30 UTC
erik@goofy:~$ cd magicbug/
erik@goofy:~/magicbug$ cat mbug1.c 
#include <magic.h>
#include <stdio.h>

void main()
{
  magic_t m = magic_open(MAGIC_MIME);
  printf("magic_open returned %p\n", m);
  printf("magic_load returned %d\n", magic_load(m, 0));
  printf("magic_buffer returned %s\n", magic_buffer(m, 0, 0));
}
erik@goofy:~/magicbug$ gcc mbug1.c -o mbug1 -lmagic
mbug1.c: In Funktion 
Comment 7 Erik Thiele 2005-09-18 22:42:30 UTC
erik@goofy:~$ cd magicbug/
erik@goofy:~/magicbug$ cat mbug1.c 
#include <magic.h>
#include <stdio.h>

void main()
{
  magic_t m = magic_open(MAGIC_MIME);
  printf("magic_open returned %p\n", m);
  printf("magic_load returned %d\n", magic_load(m, 0));
  printf("magic_buffer returned %s\n", magic_buffer(m, 0, 0));
}
erik@goofy:~/magicbug$ gcc mbug1.c -o mbug1 -lmagic
mbug1.c: In Funktion »main«:
mbug1.c:5: Warnung: Rückgabetyp von »main« ist nicht »int«
erik@goofy:~/magicbug$ ./mbug1 
magic_open returned 0x804a050
magic_load returned 0
Segmentation Fault
erik@goofy:~/magicbug$ cat mbug2.c 
#include <magic.h>
#include <stdio.h>

void main()
{
  magic_t m = magic_open(MAGIC_MIME);
  printf("magic_open returned %p\n", m);
  printf("magic_load returned %d\n", magic_load(m, 0));
  char buf[10]={0,0,0,0,0,0,0,0,0,0};
  printf("magic_buffer returned %s\n", magic_buffer(m, buf, 0));
}
erik@goofy:~/magicbug$ gcc mbug2.c -o mbug2 -lmagic
mbug2.c: In Funktion »main«:
mbug2.c:5: Warnung: Rückgabetyp von »main« ist nicht »int«
erik@goofy:~/magicbug$ ./mbug2 
magic_open returned 0x804a050
magic_load returned 0
magic_buffer returned text/plain; charset=us-ascii
erik@goofy:~/magicbug$ 


root@goofy:~# emerge search file
*  sys-apps/file
      Latest version available: 4.15
      Latest version installed: 4.15
      Size of downloaded files: 533 kB
      Homepage:    ftp://ftp.astron.com/pub/file/
      Description: identify a file's format by scanning binary data for patterns
      License:     as-is



the bug is NOT fixed in 4.15 !!!
Comment 8 SpanKY gentoo-dev 2005-09-19 18:45:52 UTC
it is fixed, i just didnt revbump it because this bug is insignificant