public inbox for glibc-bugs@sourceware.org help / color / mirror / Atom feed
From: "nixiaoming at huawei dot com" <sourceware-bugzilla@sourceware.org> To: glibc-bugs@sourceware.org Subject: [Bug libc/26353] New: ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow. Date: Sat, 08 Aug 2020 07:44:42 +0000 [thread overview] Message-ID: <bug-26353-131@http.sourceware.org/bugzilla/> (raw) https://sourceware.org/bugzilla/show_bug.cgi?id=26353 Bug ID: 26353 Summary: ftw/nftw:When a large nopenfd parameter is entered, ftw() or nftw() triggers stack overflow. Product: glibc Version: 2.31 Status: UNCONFIRMED Severity: normal Priority: P2 Component: libc Assignee: unassigned at sourceware dot org Reporter: nixiaoming at huawei dot com CC: drepper.fsp at gmail dot com Target Milestone: --- Invoke ftw_startup() in ftw()/nftw(). ftw_startup() does not verify the upper limit of descriptors, and alloca is used to apply for stack space, triggering stack overflow. ------- code ----- io/ftw.c: 814 /* Entry points. */ 815 816 int 817 FTW_NAME (const char *path, FTW_FUNC_T func, int descriptors) 818 { 819 return ftw_startup (path, 0, func, descriptors, 0); 820 } 833 int 834 NFTW_NAME (const char *path, NFTW_FUNC_T func, int descriptors, int flags) 835 { 836 return ftw_startup (path, 1, func, descriptors, flags); 837 } io/ftw.c: 627 static int 628 __attribute ((noinline)) 629 ftw_startup (const char *dir, int is_nftw, void *func, int descriptors, 630 int flags) 631 { 632 struct ftw_data data; 633 struct STAT st; 634 int result = 0; 635 int save_err; 636 int cwdfd = -1; 637 char *cwd = NULL; 638 char *cp; 639 640 /* First make sure the parameters are reasonable. */ 641 if (dir[0] == '\0') 642 { 643 __set_errno (ENOENT); 644 return -1; 645 } 646 647 data.maxdir = descriptors < 1 ? 1 : descriptors; /*No check upper limit. */ 648 data.actdir = 0; 649 data.dirstreams = (struct dir_data **) alloca (data.maxdir 650 * sizeof (struct dir_data *)); /* Here, the stack overflows. */ 651 memset (data.dirstreams, '\0', data.maxdir * sizeof (struct dir_data *)); 652 ----- testcase test_ftw.c ----- #include <stdlib.h> #include <stdio.h> #include <unistd.h> #include <ftw.h> int my_func(const char *file , const struct stat *sb ,int flag) { printf("%s\n", file); return 0; } int main(int argc, char *argv[]) { printf("start\n"); ftw("/", my_func, 8192*1024); printf("end\n"); return 0; } ------ message ----- test_ftw[15882]: segfault at fdb18398 ip 00000000f76028f5 sp 00000000fdb1839c error 6 in libc-2.29.so[f752e000+152000] ----- coredump ---- Type "apropos word" to search for commands related to "word"... Reading symbols from ./test_ftw...done. [New LWP 15882] Core was generated by `./test_ftw'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0xf76028f5 in ftw_startup () from /lib/libc.so.6 readline: /etc/inputrc: line 13: term: unknown variable name (gdb) bt #0 0xf76028f5 in ftw_startup () from /lib/libc.so.6 #1 0x0804852b in main (argc=1, argv=0xffb18554) at test_ftw.c:25 (gdb) i r eax 0x2000000 33554432 ecx 0x0 0 edx 0xfdb183af -38698065 ebx 0xf76f2e24 -143708636 esp 0xfdb1839c 0xfdb1839c ebp 0xffb18468 0xffb18468 esi 0x80485f6 134514166 edi 0x8048492 134513810 eip 0xf76028f5 0xf76028f5 <ftw_startup+101> eflags 0x10296 [ PF AF SF IF RF ] cs 0x23 35 ss 0x2b 43 ds 0x2b 43 es 0x2b 43 fs 0x0 0 gs 0x63 99 (gdb) shell readelf -e core-15882-test_ftw |tail LOAD 0x002000 0xf76f4000 0x00000000 0x00000 0x03000 RW 0x1000 LOAD 0x002000 0xf76f7000 0x00000000 0x02000 0x02000 RW 0x1000 LOAD 0x004000 0xf76f9000 0x00000000 0x03000 0x03000 R 0x1000 LOAD 0x007000 0xf76fc000 0x00000000 0x01000 0x01000 R E 0x1000 LOAD 0x008000 0xf76fd000 0x00000000 0x01000 0x01000 R 0x1000 LOAD 0x009000 0xf76fe000 0x00000000 0x1c000 0x1c000 R E 0x1000 LOAD 0x025000 0xf771a000 0x00000000 0x0a000 0x0a000 R 0x1000 LOAD 0x02f000 0xf7725000 0x00000000 0x01000 0x01000 R 0x1000 LOAD 0x030000 0xf7726000 0x00000000 0x01000 0x01000 RW 0x1000 LOAD 0x031000 0xffaf8000 0x00000000 0x21000 0x21000 RW 0x1000 (gdb) q -- You are receiving this mail because: You are on the CC list for the bug.
next reply other threads:[~2020-08-08 7:44 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-08-08 7:44 nixiaoming at huawei dot com [this message] 2020-08-08 7:57 ` [Bug libc/26353] " nixiaoming at huawei dot com 2020-08-08 9:20 ` nixiaoming at huawei dot com 2020-08-10 4:27 ` wangxuszcn at foxmail dot com 2020-08-19 3:35 ` nixiaoming at huawei dot com 2020-11-26 20:37 ` adhemerval.zanella at linaro dot org
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=bug-26353-131@http.sourceware.org/bugzilla/ \ --to=sourceware-bugzilla@sourceware.org \ --cc=glibc-bugs@sourceware.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).