[Bug locale/28650] New: localedef(1) aborts or crashes on wrong locale-archive

[Bug locale/28650] New: localedef(1) aborts or crashes on wrong locale-archive

[aurelien at aurel32 dot net]

https://sourceware.org/bugzilla/show_bug.cgi?id=28650

            Bug ID: 28650
           Summary: localedef(1) aborts or crashes on wrong locale-archive
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: locale
          Assignee: unassigned at sourceware dot org
          Reporter: aurelien at aurel32 dot net
  Target Milestone: ---

localedef currently blindly trust the archive header. When passed an archive
file with the wrong endianess, this leads to a segmentation fault:

  $ localedef --big-endian --list-archive /usr/lib/locale/locale-archive
  Segmentation fault (core dumped)

When passed non-archive files, asserts are reported on the best case, but
sometimes it can lead to a segmentation fault:

  $ localedef --list-archive /bin/true
  localedef: programs/locarchive.c:1643: show_archive_content: Assertion `used
< GET (head->namehash_used)' failed.
  Aborted (core dumped)

  $ localedef --list-archive /usr/lib/locale/C.utf8/LC_COLLATE
  Segmentation fault (core dumped)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug locale/28650] localedef(1) aborts or crashes on wrong locale-archive

[aurelien at aurel32 dot net]

https://sourceware.org/bugzilla/show_bug.cgi?id=28650

Aurelien Jarno <aurelien at aurel32 dot net> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
            Version|unspecified                 |2.35
             Status|NEW                         |RESOLVED

--- Comment #1 from Aurelien Jarno <aurelien at aurel32 dot net> ---
Fixed for 2.35 by:

commit cbab7f726877badc5059316e7248be7c3bff9d96
Author: Aurelien Jarno <aurelien@aurel32.net>
Date:   Sun Dec 5 11:51:17 2021 +0100

    localedef: check magic value on archive load [BZ #28650]

    localedef currently blindly trust the archive header. When passed an
    archive file with the wrong endianess, this leads to a segmentation
    fault:

      $ localedef --big-endian --list-archive /usr/lib/locale/locale-archive
      Segmentation fault (core dumped)

    When passed non-archive files, asserts are reported on the best case,
    but sometimes it can lead to a segmentation fault:

      $ localedef --list-archive /bin/true
      localedef: programs/locarchive.c:1643: show_archive_content: Assertion
`used < GET (head->namehash_used)' failed.
      Aborted (core dumped)

      $ localedef --list-archive /usr/lib/locale/C.utf8/LC_COLLATE
      Segmentation fault (core dumped)

    This patch improves the user experience by looking at the magic value,
    which is always written, but never checked. It should still be possible
    to trigger a segmentation fault with crafted files, but this already
    catch many cases.

-- 
You are receiving this mail because:
You are on the CC list for the bug.