Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 605552 (CVE-2017-5357)

Summary: =sys-apps/ed-1.14: invalid free
Product: Gentoo Security Reporter: Agostino Sarubbo <ago>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Severity: normal CC: base-system
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
See Also:
Whiteboard: ~2 [noglsa]
Package list:
Runtime testing required: ---

Description Agostino Sarubbo gentoo-dev 2017-01-13 09:14:50 UTC
From ${URL} :

ed 1.14.1 fixes an invalid free, reported here:

echo -e "H\n?\{" | ed

Found with afl. ed 1.14.1 didn't show any more issues with afl/asan

Not sure if there's any scenario where ed is used with untrusted input.

ed isn't developed in a version control system, therefore I can't link
to a commit, but the patch to fix it is this:

--- a/regex.c	2017-01-06 02:06:04.000000000 +0100
+++ b/regex.c	2017-01-09 17:09:51.000000000 +0100
@@ -135,7 +135,6 @@ static regex_t * get_compiled_regex( con
     char buf[80];
     regerror( n, exp, buf, sizeof buf );
     set_error_msg( buf );
-    free( exp );
     exp = 0;
   return exp;

@maintainer(s): since the fixed package is already in the tree, please let us know if it is ready for the stabilization or not.
Comment 1 Lars Wendler (Polynomial-C) (RETIRED) gentoo-dev 2017-01-13 20:31:09 UTC
commit 3a9ec6527ccb64f9ca04bba9c8f7aab5040ffca3
Author: Lars Wendler <>
Date:   Fri Jan 13 21:29:32 2017

    sys-apps/ed: Security cleanup (bug #605552).

    Package-Manager: Portage-2.3.3, Repoman-2.3.1

This bug only affects =sys-apps/ed-1.14 (which I just cleaned up) and not the current stable candidate =sys-apps/ed-1.13 (see bug #605012)
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2017-01-14 00:59:18 UTC
Only one affected package, which was never marked stable, so vulnerability rating reflects that.