Re: Fix invalid free

[Jim Meyering]

Andreas Schwab <address@hidden> wrote:
> 2007-07-20  Andreas Schwab  <address@hidden>
>
>       * src/sort.c (main): Don't free non-heap object.

Thanks!
I applied that, and added a test:

2007-07-20  Jim Meyering  <address@hidden>

        Document and add a test for today's sort bug fix.
        * NEWS: Describe the bug fix.
        * tests/sort/Test.pm (obs-inval): Add a test for today's fix.

2007-07-20  Andreas Schwab  <address@hidden>

        * src/sort.c (main): Don't free a pointer to non-malloc'd memory.

>From 366aaf59dcde9d3700346a94562151db6afb3be4 Mon Sep 17 00:00:00 2001
From: Jim Meyering <address@hidden>
Date: Fri, 20 Jul 2007 18:42:23 +0200
Subject: [PATCH] Document and add a test for today's sort bug fix.
 * NEWS: Describe the bug fix.
 * tests/sort/Test.pm (obs-inval): Add a test for today's fix.


Signed-off-by: Jim Meyering <address@hidden>
---
 ChangeLog          |    6 ++++++
 NEWS               |    3 +++
 tests/sort/Test.pm |    8 ++++++--
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index ee81676..c7ba831 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2007-07-20  Jim Meyering  <address@hidden>
+
+       Document and add a test for today's sort bug fix.
+       * NEWS: Describe the bug fix.
+       * tests/sort/Test.pm (obs-inval): Add a test for today's fix.
+
 2007-07-20  Andreas Schwab  <address@hidden>

        * src/sort.c (main): Don't free a pointer to non-malloc'd memory.
diff --git a/NEWS b/NEWS
index 423cf49..dff643f 100644
--- a/NEWS
+++ b/NEWS
@@ -115,6 +115,9 @@ GNU coreutils NEWS                                    -*- 
outline -*-
   Using pr -m -s (i.e. merging files, with TAB as the output separator)
   no longer inserts extraneous spaces between output columns.

+  Obsolete sort usage with an invalid ordering-option character, e.g.,
+  "env _POSIX2_VERSION=199209 sort +1x" no longer makes sort free an
+  invalid pointer [introduced in coreutils-6.5]

 * Noteworthy changes in release 6.8 (2007-02-24) [not-unstable]

diff --git a/tests/sort/Test.pm b/tests/sort/Test.pm
index 8b160bd..22e1ea4 100755
--- a/tests/sort/Test.pm
+++ b/tests/sort/Test.pm
@@ -1,8 +1,7 @@
 # -*-perl-*-
 # Test "sort".

-# Copyright (C) 1996, 1997, 1998, 1999, 2001, 2002, 2003, 2004, 2005,
-# 2006 Free Software Foundation, Inc.
+# Copyright (C) 1996-1999, 2001-2007 Free Software Foundation, Inc.

 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -282,6 +281,11 @@ my @tv = (

 ["bigfield", '-k 340282366920938463463374607431768211456',
  "2\n1\n", "1\n2\n", 0],
+
+# Using an old-style key-specifying option like +1 with an invalid
+# ordering-option character would cause sort to try to free an invalid
+# (non-malloc'd) pointer.  This bug affects coreutils-6.5 through 6.9.
+['obs-inval', '+1x', '', '', 2]
 );

 sub test_vector
--
1.5.3.rc1.27.ga5e40