argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Hans Petter Selasky]

[-- Attachment #1: Type: text/plain, Size: 1242 bytes --]

Dear GNU libc people,

I'm a FreeBSD developer and we have a port of some of your glibc code. I 
recently found a bug, which I'm not sure if you've fixed.

The fix for FreeBSD is here:
https://svnweb.freebsd.org/changeset/ports/531220

> Log:
>   Fix segmentation fault when showing help text.
>   Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>   
>   Backtrace:
>   #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>          hhstate=0x7fffffffe5d8) at argp-help.c:1164
>   #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>   #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>          name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>   #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>          name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>   

It turns out the argp_help invoke _help with a NULL state. In some cases 
the state may be used when printing the help message, for example when 
running dvbv5-scan w/o any arguments in FreeBSD.

Fix this by creating a dummy argp_state structure on the stack, and fill 
in the used arguments.

I hope my fix is right. At least it fixes the issue for me.

Thank you!

--HPS


[-- Attachment #2: patch-argp-help.c --]
[-- Type: text/x-csrc, Size: 441 bytes --]

--- argp-help.c.orig	2020-04-09 17:39:48 UTC
+++ argp-help.c
@@ -1704,7 +1704,10 @@ Try `%s --help' or `%s --usage' for more information.\
 void __argp_help (const struct argp *argp, FILE *stream,
 		  unsigned flags, char *name)
 {
-  _help (argp, 0, stream, flags, name);
+  struct argp_state state = {
+    .root_argp = argp,
+  };
+  _help (argp, &state, stream, flags, name);
 }
 #ifdef weak_alias
 weak_alias (__argp_help, argp_help)

Re: argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Carlos O'Donell]

On 4/9/20 5:12 PM, Hans Petter Selasky wrote:
> Dear GNU libc people,
> 
> I'm a FreeBSD developer and we have a port of some of your glibc code. I recently found a bug, which I'm not sure if you've fixed.
> 
> The fix for FreeBSD is here:
> https://svnweb.freebsd.org/changeset/ports/531220
> 
>> Log:
>>   Fix segmentation fault when showing help text.
>>   Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>>     Backtrace:
>>   #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>>          hhstate=0x7fffffffe5d8) at argp-help.c:1164
>>   #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>>   #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>>          name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>>   #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>>          name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>>   
> 
> It turns out the argp_help invoke _help with a NULL state. In some cases the state may be used when printing the help message, for example when running dvbv5-scan w/o any arguments in FreeBSD.

Do you have a distilled minimal C example that shows the crash?

I just want to make sure we understand exactly what dvbv5-scan
is doing with the API.

> Fix this by creating a dummy argp_state structure on the stack, and fill in the used arguments.
> 
> I hope my fix is right. At least it fixes the issue for me.
 
In glibc we have:

1164       const char *tstr = real->doc ? dgettext (state == NULL ? NULL
1165                                                : state->root_argp->argp_domain,
1166                                                real->doc) : 0;

We are constantly checking for a NULL state and not using it.

It comes from this commit:

commit 400cc70af5972a50618702da02d18aee845ce542
Author: Ulrich Drepper <drepper@redhat.com>
Date:   Wed May 10 06:39:15 2006 +0000

    * io/ftw.c (open_dir_stream): Return right away if REALLOC fails.
    
            [Coverity CID 229, 230]
    
            * argp/argp-help.c (hol_entry_help): Handle STATE==NULL in ARG and
            DGETTEXT calls.
            (hol_help): Likewise.  [Coverity CID 226, 227]
    
            * string/argz-replace.c (__argz_replace): Unconditionally call
            free on SRC.  [Coverity CID 225]
    
            * nis/nis_creategroup.c (nis_creategroup): No need to duplicate
            the return value of __nis_default_owner and __nis_default_group,
            it has been especially allocated.  [Coverity CID 224]

The STATE=NULL part looks relevant.

Do you have this fix?

-- 
Cheers,
Carlos.

Re: argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Hans Petter Selasky]

On 2020-04-09 23:32, Carlos O'Donell wrote:
> On 4/9/20 5:12 PM, Hans Petter Selasky wrote:
>> Dear GNU libc people,
>>
>> I'm a FreeBSD developer and we have a port of some of your glibc code. I recently found a bug, which I'm not sure if you've fixed.
>>
>> The fix for FreeBSD is here:
>> https://svnweb.freebsd.org/changeset/ports/531220
>>
>>> Log:
>>>    Fix segmentation fault when showing help text.
>>>    Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>>>      Backtrace:
>>>    #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>>>           hhstate=0x7fffffffe5d8) at argp-help.c:1164
>>>    #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>>>    #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>>>           name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>>>    #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>>>           name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>>>    
>>
>> It turns out the argp_help invoke _help with a NULL state. In some cases the state may be used when printing the help message, for example when running dvbv5-scan w/o any arguments in FreeBSD.
> 
> Do you have a distilled minimal C example that shows the crash?
> 
> I just want to make sure we understand exactly what dvbv5-scan
> is doing with the API.
> 
>> Fix this by creating a dummy argp_state structure on the stack, and fill in the used arguments.
>>
>> I hope my fix is right. At least it fixes the issue for me.
>   
> In glibc we have:
> 
> 1164       const char *tstr = real->doc ? dgettext (state == NULL ? NULL
> 1165                                                : state->root_argp->argp_domain,
> 1166                                                real->doc) : 0;
> 
> We are constantly checking for a NULL state and not using it.
> 
> It comes from this commit:
> 
> commit 400cc70af5972a50618702da02d18aee845ce542
> Author: Ulrich Drepper <drepper@redhat.com>
> Date:   Wed May 10 06:39:15 2006 +0000
> 
>      * io/ftw.c (open_dir_stream): Return right away if REALLOC fails.
>      
>              [Coverity CID 229, 230]
>      
>              * argp/argp-help.c (hol_entry_help): Handle STATE==NULL in ARG and
>              DGETTEXT calls.
>              (hol_help): Likewise.  [Coverity CID 226, 227]
>      
>              * string/argz-replace.c (__argz_replace): Unconditionally call
>              free on SRC.  [Coverity CID 225]
>      
>              * nis/nis_creategroup.c (nis_creategroup): No need to duplicate
>              the return value of __nis_default_owner and __nis_default_group,
>              it has been especially allocated.  [Coverity CID 224]
> 
> The STATE=NULL part looks relevant.
> 
> Do you have this fix?

Likely not.

Can you point me at the repository which holds the latest argp code?

--HPS

Re: argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Florian Weimer]

* Hans Petter Selasky:

> Can you point me at the repository which holds the latest argp code?

The glibc code is here:

<https://sourceware.org/git/?p=glibc.git;a=tree;f=argp;h=88f966f49ba40157539e6158cc62d482635d3dfe;hb=HEAD>

Note that this link is stuck at a fixed version, it will not be
updated with future tree changes.

The code should be LGPLv2+, so perhaps you can look at it even for
FreeBSD's purposes.