[Bug libc/27761] New: getconf: Segmentation fault when passing '-vq' as argument

[Bug libc/27761] New: getconf: Segmentation fault when passing '-vq' as argument

[johnothanking at protonmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=27761

            Bug ID: 27761
           Summary: getconf: Segmentation fault when passing '-vq' as
                    argument
           Product: glibc
           Version: 2.33
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: johnothanking at protonmail dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

I've encountered a crash in the getconf utility that occurs when passing any
argument that starts with '-v' and is more that two characters long. I've
reproduced the bug on Ubuntu 20.04, 20.10 and Artix Linux, with glibc versions
2.31 up to the current git commit. 

Reproducer:
$ getconf --version
getconf (GNU libc) 2.33.9000

$ command -v getconf
/usr/bin/getconf
$ /usr/bin/getconf -vq  # Or any letter after -v, including '-vv'

Actual result:
Segmentation fault

Expected result:
Usage: getconf [-v specification] variable_name [pathname]
       getconf -a [pathname]

The crash was first discovered in https://github.com/att/ast/issues/1174. In
the linked GitHub issue the crash was blamed on the getconf builtin provided by
ksh93. However, as seen by the reproducer above the bug isn't in ksh. When the
ksh getconf builtin is passed the -v flag, it uses the native getconf command.
>From the ksh documentation (accessible by running `builtin getconf; getconf
--man` in ksh93u+):

>   -v, --specification=name
>                  Call the native getconf(1) with option -v name.


This is the backtrace I got from gdb, using glibc commit aaa23c35:

(gdb) run -vv
Starting program: /usr/bin/getconf -vv

Program received signal SIGSEGV, Segmentation fault.
__strcmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:105
warning: Source file is more recent than executable.
105             vmovdqu (%rdi), %ymm1
(gdb) bt
#0  __strcmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:105
#1  0x00005555555571f8 in main (argc=3, argv=0x7fffffffe7b0) at getconf.c:632
(gdb) frame 1
#1  0x00005555555571f8 in main (argc=3, argv=0x7fffffffe7b0) at getconf.c:632
632       if (argc > 1 && strcmp (argv[1], "-a") == 0)
(gdb) p argv[1]
$1 = 0x0
(gdb) p argc
$2 = 3

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/27761] getconf: Segmentation fault when passing '-vq' as argument

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=27761

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.34

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
Fixed in 2.34.

-- 
You are receiving this mail because:
You are on the CC list for the bug.