libpkg and incorrect plist parsing #1

dnaeon · 2011-03-27T10:33:57Z

To have this here as well so it is not lost :)

When running ports/pkg2ng, libpkg tries to parse +COMMENT, +DESC, etc. which apparently should not be part of PLIST.

Complete logs were already added to pastebin, which contain more information on the issue.

Xtrace run of pkg2ng

http://www.unix-heaven.org/FreeBSD/pkgng-xtrace.out

jlaffaye · 2011-03-27T14:20:57Z

Can you upload the +CONTENTS file as well? Thanks!

dnaeon · 2011-03-27T14:59:19Z

Sure.

Please find them here:

jlaffaye · 2011-03-27T15:07:17Z

Ok, the issue is clear now: the awk script in pkg2ng does not ignore the lines which are preceeded by @ignore.
@bapt: can you take a look at this?

bapt · 2011-03-27T17:55:13Z

Sure I will.

bapt · 2011-03-27T18:04:13Z

ignore the line after @ignore in +CONTENTS in pkg2ng
Closed by 7d83419.

The attr variables type is int, but the format string in pkg_emit_error is %s. In some case with enabled ASLR this cause a core dump. 441 { 442 int attr; 443 444 while ((attr = va_arg(ap, int)) > 0) { 445 if (attr >= PKG_NUM_FIELDS || attr <= 0) { 446 pkg_emit_error("Bad argument on pkg_set %s", attr); 447 return (EPKG_FATAL); 448 } 449 450 switch (attr) { (gdb) bt #0 0x00000000007f25ab in strlen () freebsd#1 0x00000000007e8062 in __vfprintf () freebsd#2 0x00000000007a5747 in vasprintf_l () freebsd#3 0x0000000000451e7e in pkg_emit_error ( fmt=0x84b9f5 "Bad argument on pkg_set %s") at pkg_event.c:418 freebsd#4 0x00000000004264c9 in pkg_vset (pkg=0x22036461600, ap=0x6529128ac3e0) at pkg.c:446 freebsd#5 0x0000000000426409 in pkg_set2 (pkg=0x22036461600) at pkg.c:567 freebsd#6 0x00000000004024a2 in exec_audit (argc=1, argv=0x6529128acd00) at audit.c:207 freebsd#7 0x000000000040e22e in main (argc=2, argv=0x6529128accf8) at main.c:847 Sponsored-by: HardenedBSD Found-by: ASLR - stack randomization Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org> CC: Pedro Giffuni <pfg@freebsd.org CC: Baptiste Daroussin <bapt@freebsd.org>

The attr variables type is int, but the format string in pkg_emit_error is %s. In some case with enabled ASLR this cause a core dump. 441 { 442 int attr; 443 444 while ((attr = va_arg(ap, int)) > 0) { 445 if (attr >= PKG_NUM_FIELDS || attr <= 0) { 446 pkg_emit_error("Bad argument on pkg_set %s", attr); 447 return (EPKG_FATAL); 448 } 449 450 switch (attr) { (gdb) bt #0 0x00000000007f25ab in strlen () #1 0x00000000007e8062 in __vfprintf () #2 0x00000000007a5747 in vasprintf_l () #3 0x0000000000451e7e in pkg_emit_error ( fmt=0x84b9f5 "Bad argument on pkg_set %s") at pkg_event.c:418 #4 0x00000000004264c9 in pkg_vset (pkg=0x22036461600, ap=0x6529128ac3e0) at pkg.c:446 #5 0x0000000000426409 in pkg_set2 (pkg=0x22036461600) at pkg.c:567 #6 0x00000000004024a2 in exec_audit (argc=1, argv=0x6529128acd00) at audit.c:207 #7 0x000000000040e22e in main (argc=2, argv=0x6529128accf8) at main.c:847 Sponsored-by: HardenedBSD Found-by: ASLR - stack randomization Signed-off-by: Oliver Pinter <oliver.pinter@hardenedbsd.org> CC: Pedro Giffuni <pfg@freebsd.org CC: Baptiste Daroussin <bapt@freebsd.org>

Direct leak of 6 byte(s) in 1 object(s) allocated from: #0 0x7f85d208f547 in strdup (/lib64/libasan.so.6+0x58547) freebsd#1 0x497b37 in xstrdup /pkg/libpkg/xmalloc.h:34 freebsd#2 0x497b37 in elf_note_analyse /pkg/libpkg/pkg_elf.c:780 freebsd#3 0x497b37 in pkg_get_myarch_elfparse /pkg/libpkg/pkg_elf.c:907

Direct leak of 3456 byte(s) in 1 object(s) allocated from: #0 0x7fb5ed3bf748 in __interceptor_realloc (/lib64/libasan.so.6+0xab748) freebsd#1 0x78992c in ucl_utstring_append_len src/ucl_emitter_utils.c:239 freebsd#2 0x784247 in ucl_emitter_finish_object src/ucl_emitter.c:174 freebsd#3 0x785ba1 in ucl_emitter_common_elt src/ucl_emitter.c:423 freebsd#4 0x784f41 in ucl_emitter_common_start_object src/ucl_emitter.c:323 freebsd#5 0x785f6b in ucl_emitter_common_elt src/ucl_emitter.c:449 freebsd#6 0x786572 in ucl_emit_config_elt src/ucl_emitter.c:511 freebsd#7 0x7872cb in ucl_object_emit_full src/ucl_emitter.c:681 freebsd#8 0x786fdb in ucl_object_emit_len src/ucl_emitter.c:652 freebsd#9 0x786ebf in ucl_object_emit src/ucl_emitter.c:633 freebsd#10 0x5bf370 in pkg_object_dump /pkg/libpkg/pkg_object.c:38 freebsd#11 0x5c8022 in pkg_config_dump /pkg/libpkg/pkg_config.c:560 freebsd#12 0x43deb8 in show_version_info /pkg/src/main.c:387 freebsd#13 0x43f614 in main /pkg/src/main.c:809 freebsd#14 0x7fb5ec8a31e1 in __libc_start_main (/lib64/libc.so.6+0x281e1)

Direct leak of 6 byte(s) in 1 object(s) allocated from: #0 0x7f85d208f547 in strdup (/lib64/libasan.so.6+0x58547) #1 0x497b37 in xstrdup /pkg/libpkg/xmalloc.h:34 #2 0x497b37 in elf_note_analyse /pkg/libpkg/pkg_elf.c:780 #3 0x497b37 in pkg_get_myarch_elfparse /pkg/libpkg/pkg_elf.c:907

Direct leak of 3456 byte(s) in 1 object(s) allocated from: #0 0x7fb5ed3bf748 in __interceptor_realloc (/lib64/libasan.so.6+0xab748) #1 0x78992c in ucl_utstring_append_len src/ucl_emitter_utils.c:239 #2 0x784247 in ucl_emitter_finish_object src/ucl_emitter.c:174 #3 0x785ba1 in ucl_emitter_common_elt src/ucl_emitter.c:423 #4 0x784f41 in ucl_emitter_common_start_object src/ucl_emitter.c:323 #5 0x785f6b in ucl_emitter_common_elt src/ucl_emitter.c:449 #6 0x786572 in ucl_emit_config_elt src/ucl_emitter.c:511 #7 0x7872cb in ucl_object_emit_full src/ucl_emitter.c:681 #8 0x786fdb in ucl_object_emit_len src/ucl_emitter.c:652 #9 0x786ebf in ucl_object_emit src/ucl_emitter.c:633 #10 0x5bf370 in pkg_object_dump /pkg/libpkg/pkg_object.c:38 #11 0x5c8022 in pkg_config_dump /pkg/libpkg/pkg_config.c:560 #12 0x43deb8 in show_version_info /pkg/src/main.c:387 #13 0x43f614 in main /pkg/src/main.c:809 #14 0x7fb5ec8a31e1 in __libc_start_main (/lib64/libc.so.6+0x281e1)

bapt closed this as completed Mar 27, 2011

bapt reopened this Mar 27, 2011

bapt closed this as completed Mar 27, 2011

chmeeedalf mentioned this issue Feb 4, 2012

segfault on powerpc #135

Closed

chmeeedalf mentioned this issue Feb 16, 2012

segfault on powerpc (take 2) #155

Closed

rene0 mentioned this issue Apr 21, 2012

pkg audit might exit with bus error #218

Closed

mexas mentioned this issue Jun 15, 2012

portmaster patch failing in 3 places #258

Closed

dnaeon mentioned this issue Jul 3, 2012

mail/ssmtp Signal 11 during installation #286

Closed

bdrewery mentioned this issue Aug 19, 2012

SEGV in strstr when PACKAGESITE unset #329

Closed

chmeeedalf mentioned this issue Apr 3, 2013

pkgng segfaults on powerpc when installing dependent packages #485

Closed

bsdlme mentioned this issue Jun 4, 2013

pkg add dumps core #512

Closed

kwm81 mentioned this issue May 15, 2014

pkg delete gives segmention fault on HEAD #806

Closed

dnaeon mentioned this issue May 15, 2014

sysutils/ezjail: SQL logic error or missing database (sqlite) #8

Closed

ftigeot mentioned this issue May 17, 2014

Signal 11 crashes with gcc-4.7 (possible gcc bug) #809

Closed

emaste mentioned this issue Jul 24, 2014

segfault from 'pkg install pkgconf' #872

Closed

bapt mentioned this issue Jul 27, 2014

pkg 1.3.1 seg faults on 9-STABLE amd64 unless old pkg.conf is removed #888

Closed

lifanov mentioned this issue Sep 24, 2014

[regression] [1.3.8] repo override leads to segfault #1024

Closed

bapt mentioned this issue Oct 29, 2014

pkg 1.4.0.alpha3 can't use official FreeBSD repository #1058

Closed

kwm81 mentioned this issue Nov 4, 2014

1.4.0.a4 crashes with forced reinstall, 2 packages and multi repo #1072

Closed

opntr mentioned this issue Aug 5, 2015

HBSD: fix format specifier in libpkg's pkg_vets(...) #1302

Closed

evilgjb mentioned this issue Nov 18, 2016

Bus error when packaging base with the 'config' TAGS make(1) flag #1486

Closed

chrullrich mentioned this issue Nov 20, 2017

pkg enters infinite loop on self-upgrade check #1632

Closed

wtps0n mentioned this issue Apr 4, 2024

pkg 1.21.0 segfaults during upgrade of nsd , redis #2270

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

libpkg and incorrect plist parsing #1

libpkg and incorrect plist parsing #1

dnaeon commented Mar 27, 2011

jlaffaye commented Mar 27, 2011

dnaeon commented Mar 27, 2011

jlaffaye commented Mar 27, 2011

bapt commented Mar 27, 2011

bapt commented Mar 27, 2011

libpkg and incorrect plist parsing #1

libpkg and incorrect plist parsing #1

Comments

dnaeon commented Mar 27, 2011

jlaffaye commented Mar 27, 2011

dnaeon commented Mar 27, 2011

jlaffaye commented Mar 27, 2011

bapt commented Mar 27, 2011

bapt commented Mar 27, 2011