bug#21213: Fwd: crash in colcrt util-linux

[Alaa Mubaied]

Hi,

I found a crash in colcrt, (filter nroff output for CRT previewing) . - The colcrt command is part of the util-linux package and is available from Linux Kernel Archive

http://man7.org/linux/man-pages/man1/colcrt.1.html

https://www.kernel.org/pub/linux/utils/util-linux/v2.27/

Details:

platform: Linux x86/x64

Version: colcrt from util-linux-2.27

colcrt from util-linux-2.27 and below crashed by the use of colcrt command line. the crash caused in colcrt.

when running colcrt with the following file (attached), it crashes because i believe when colcrt.c:213 is called in colcrt.c, c returned it will dereferencing pointer "cp" because "cp = &page[outline][outcol];" at line 205 where "cp" may point to element beyond "page" as buffer overrun. here is the backtrace from gdb:

-bash-4.2$ gdb /opt/linuxtools/bin/colcrt 

GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-51.el7

Copyright (C) 2013 Free Software Foundation, Inc.

License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>

This is free software: you are free to change and redistribute it.

There is NO WARRANTY, to the extent permitted by law.  Type "show copying"

and "show warranty" for details.

This GDB was configured as "x86_64-redhat-linux-gnu".

For bug reporting instructions, please see:

<http://www.gnu.org/software/gdb/bugs/>...

Reading symbols from /opt/linuxtools/bin/colcrt...done.

(gdb) r file

Starting program: /opt/linuxtools/bin/colcrt file

Program received signal SIGSEGV, Segmentation fault.

216 cp[i] = c;

colcrt (f=0x62b060) at text-utils/colcrt.c:216

Missing separate debuginfos, use: debuginfo-install glibc-2.17-55.el7_0.5.x86_64

(gdb) bt full

#0  colcrt (f=0x62b060) at text-utils/colcrt.c:216

        c = <optimized out>

        cp = 0x606fe8 L""

        dp = <optimized out>

        i = 0

        w = 1

#1  0x00000000004015bc in main (argc=0, argv=0x7fffffffe5f8) at text-utils/colcrt.c:139

        f = 0x62b060

        i = <optimized out>

        opt = <optimized out>

        longopts = {{name = 0x405d67 "no-underlining", has_arg = 0, flag = 0x0, val = 128}, {name = 0x405d76 "half-lines", has_arg = 0, flag = 0x0, val = 50}, {

            name = 0x405d81 "version", has_arg = 0, flag = 0x0, val = 86}, {name = 0x405d89 "help", has_arg = 0, flag = 0x0, val = 104}, {name = 0x0, has_arg = 0, flag = 0x0, val = 0}}

Thanks 

Ala'a

file
Description: Binary data