0004494: segfault in bb_show_usage when using FEATURE_COMPRESS_USAGE on powerpc platform (probable endian unsafety)

BusyBox Bug and Patch Tracking

Viewing Issue Simple Details [ Jump to Notes ]

[ View Advanced ] [ Issue History ] [ Print ]

Category

Severity

Reproducibility

Date Submitted

Last Update

0004494

[BusyBox] Other

major

always

08-07-08 06:00

08-10-08 07:29

Reporter

whitpa

View Status

public

Assigned To

BusyBox

Priority

normal

Resolution

fixed

Status

closed

Product Version

1.11.x

Summary

0004494: segfault in bb_show_usage when using FEATURE_COMPRESS_USAGE on powerpc platform (probable endian unsafety)

Description

On a PowerPC platform using compressed help, whenever any attempt is made to print usage strings (whether volunteered by the applet or requested via --help), archival/libunarchive/decompress_bunzip2.c:start_bunzip() returns RETVAL_NOT_BZIP_DATA, such that libbb/appletlib.c:unpack_usage_messages() returns a NULL pointer and libbb/appletlib.c:bb_show_usage() subsequently dereferences it.

Additional Information

There is clearly an endian issue with help decompression.

In archival/libunarchive/decompress_bunzip2.c:

593 BZh0 = ('B' << 24) + ('Z' << 16) + ('h' << 8) + '0'

... and later:

620 i = get_bits(bd, 32);
621 if ((unsigned)(i - BZh0 - 1) >= 9) return RETVAL_NOT_BZIP_DATA;

.. at which time bd->inbuf is:

$8 = (unsigned char *) 0x100bc6a1 "ZB1hA1&YYS¶\026\002\"\031"

Attached Files

Relationships

Notes
(0010364) vda 08-09-08 11:26 edited on: 08-09-08 11:26	applets/usage_compressed: ... # Extra effort to avoid using "od -t x1": -t is not available # in non-CONFIG_DESKTOPed busybox od "$loc/usage" \| bzip2 -1 \| od -v -x \ \| $SED -e 's/^[^ ]*//' \ \| $SED -e 's/ //g' \ \| grep -v '^$' \ \| $SED -e 's/$..$$..$/0x\2,0x\1,/g' ... Please try this: replace "od -v -x" with "od -v -t x1" and replace last sed's s command with 's/$..$/0x\1,/g'

(0010374) whitpa 08-09-08 16:39	Thanks, the applets/usage_compressed fix resolves the issue - compressed help text is now printing correctly.

(0010384) vda 08-10-08 07:29	Fixed in svn.

Issue History
Date Modified	Username	Field	Change
08-07-08 06:00	whitpa	New Issue
08-07-08 06:00	whitpa	Status	new => assigned
08-07-08 06:00	whitpa	Assigned To	=> BusyBox
08-09-08 11:26	vda	Note Added: 0010364
08-09-08 11:26	vda	Note Edited: 0010364
08-09-08 16:39	whitpa	Note Added: 0010374
08-10-08 07:29	vda	Status	assigned => closed
08-10-08 07:29	vda	Note Added: 0010384
08-10-08 07:29	vda	Resolution	open => fixed
08-10-08 07:29	vda	Fixed in Version	=> svn