bug on chmod command

[Stavros Passas]

Hello,

I'm not 100% sure if it a actual bug or not,
but if someone use chmod with wrong arguments,
he can take a sagmentation fault.

Further Informations:
System: i386,Linux 2.6.12
shell: bash 3.00.16

Version of coreutils: 5.2.1
Tested on Fedora3,Fedora4,Slackware

Command to take the bug:
to a common directory with our ownerchip and at least one file,
run:
$ chmod 600 `find ./`

chmod: fts_read failed: Permission denied
Segmentation fault

more,on coreutils 5.93 the output on the same command is:

chmod: fts_read failed: Permission denied
*** glibc detected *** chmod: double free or corruption (fasttop):
0x08dd9a90 ***
======= Backtrace: =========
/lib/libc.so.6[0x324124]
/lib/libc.so.6(__libc_free+0x77)[0x32465f]
chmod(fts_close+0x55)[0x804bc3a]
chmod[0x80495a1]
chmod[0x8049ca4]
/lib/libc.so.6(__libc_start_main+0xdf)[0x2d5d5f]
chmod(free+0xb1)[0x8048e9d]
======= Memory map: ========
002a3000-002bd000 r-xp 00000000 03:02 2345601    /lib/ld-2.3.5.so
002bd000-002be000 r-xp 00019000 03:02 2345601    /lib/ld-2.3.5.so
002be000-002bf000 rwxp 0001a000 03:02 2345601    /lib/ld-2.3.5.so
002c1000-003e4000 r-xp 00000000 03:02 2346621    /lib/libc-2.3.5.so
003e4000-003e6000 r-xp 00123000 03:02 2346621    /lib/libc-2.3.5.so
003e6000-003e8000 rwxp 00125000 03:02 2346621    /lib/libc-2.3.5.so
003e8000-003ea000 rwxp 003e8000 00:00 0
00616000-0061f000 r-xp 00000000 03:02
2345656    /lib/libgcc_s-4.0.2-20051126.so.1
0061f000-00620000 rwxp 00009000 03:02
2345656    /lib/libgcc_s-4.0.2-20051126.so.1
006be000-006bf000 r-xp 006be000 00:00 0
08048000-08050000 r-xp 00000000 03:08 2350699    /bin/chmod
08050000-08051000 rw-p 00008000 03:08 2350699    /bin/chmod
08dd8000-08df9000 rw-p 08dd8000 00:00 0          [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0
b7c21000-b7d00000 ---p b7c21000 00:00 0
b7d61000-b7f61000 r--p 00000000 03:05
1212377    /usr/lib/locale/locale-archive
b7f61000-b7f62000 rw-p b7f61000 00:00 0
b7f79000-b7f7a000 rw-p b7f79000 00:00 0
bfa65000-bfa7a000 rw-p bfa65000 00:00 0          [stack]
Aborted

Possibly is wrong(or not checked) use of fts_close.

Thanks

Stavros Passas,

Computer Architecture and VLSI Systems Laboratory
Institute of Computer Science
Foundation for Research & Technology - Hellas