summaryrefslogtreecommitdiff
path: root/gnu/packages/patches/mailutils-uninitialized-memory.patch
blob: ef4daf94cbbece50b2a68e743d96fdc4af7305e6 (about) (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
Without this patch, the MH test suite would fail when building with
glibc 2.26, with 'ali' segfaulting like this:

  Core was generated by `/tmp/guix-build-mailutils-3.4.drv-0/mailutils-3.4/mh/.libs/ali -a ./Mail/mh_ali'.
  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  0x00007f8eac263a14 in hash (
      name=0x72642e342e332d73 <error: Cannot access memory at address 0x72642e342e332d73>, hash_num=0) at assoc.c:102
  102	  for (i = 0; *name; name++)
  (gdb) bt
  #0  0x00007f8eac263a14 in hash (
      name=0x72642e342e332d73 <error: Cannot access memory at address 0x72642e342e332d73>, hash_num=0) at assoc.c:102
  #1  0x00007f8eac263e6b in assoc_find_slot (assoc=0xaa59e0, 
      name=0x72642e342e332d73 <error: Cannot access memory at address 0x72642e342e332d73>, install=0x0, slot=0x7ffcddcbf2b8) at assoc.c:219
  #2  0x00007f8eac264124 in mu_assoc_lookup (assoc=0xaa59e0, 
      name=0x72642e342e332d73 <error: Cannot access memory at address 0x72642e342e332d73>, dataptr=0x7ffcddcbf2e0) at assoc.c:308
  #3  0x00007f8eac29e8ac in mu_ident_deref (
      name=0x72642e342e332d73 <error: Cannot access memory at address 0x72642e342e332d73>) at ident.c:98
  #4  0x00007f8eac29f8a6 in mu_locus_point_deinit (pt=0xaa5718) at locus.c:48
  #5  0x00007f8eac29fa1b in mu_locus_range_deinit (lr=0xaa5718) at locus.c:99
  #6  0x00007f8eac29f9db in mu_locus_range_copy (dest=0xaa5718, 
      src=0x622be0 <ali_yylloc>) at locus.c:89
  #7  0x0000000000408a2a in push_source (name=0xaa74bc "mh_aliases2", fail=1)
      at mh_alias_lex.l:170

commit b330af9008e4c9168b379867b854f5900a539ad7
Author: Sergey Poznyakoff <gray@gnu.org>
Date:   Sat Nov 18 10:15:48 2017 +0200

    Fix the use of uninitialized memory
    
    * mh/mh_alias_lex.l (push_source): Initialize locus range prior to copying
    to it.
    * libmailutils/cfg/parser.y (mu_cfg_tree_create_node): Likewise.
    * libmu_sieve/util.c: (mu_sieve_value_create): Likewise.

diff --git a/libmailutils/cfg/parser.y b/libmailutils/cfg/parser.y
index 4503c7781..3436b8d90 100644
--- a/libmailutils/cfg/parser.y
+++ b/libmailutils/cfg/parser.y
@@ -1134,10 +1134,9 @@ mu_cfg_tree_create_node (struct mu_cfg_tree *tree,
   
   np = mu_alloc (size);
   np->type = type;
+  mu_locus_range_init (&np->locus);
   if (loc)
     mu_locus_range_copy (&np->locus, loc);
-  else
-    memset (&np->locus, 0, sizeof np->locus);
   p = (char*) (np + 1);
   np->tag = p;
   strcpy (p, tag);
diff --git a/libmu_sieve/sieve-lex.l b/libmu_sieve/sieve-lex.l
index fd145bfe1..f14e80194 100644
--- a/libmu_sieve/sieve-lex.l
+++ b/libmu_sieve/sieve-lex.l
@@ -190,6 +190,7 @@ push_source (const char *name)
     {
       ctx = mu_sieve_malloc (mu_sieve_machine, sizeof (*ctx));
       ctx->trk = trk;
+      mu_locus_range_init (&ctx->incl_range);
       mu_locus_range_copy (&ctx->incl_range, &yylloc);
       ctx->i_node = sieve_source_inode;
       ctx->input = input_stream;
diff --git a/libmu_sieve/util.c b/libmu_sieve/util.c
index 8d62a60c2..7d71b5509 100644
--- a/libmu_sieve/util.c
+++ b/libmu_sieve/util.c
@@ -55,6 +55,7 @@ mu_sieve_value_create (mu_sieve_machine_t mach, mu_sieve_data_type type,
   val->locus.end.mu_line = locus->end.mu_line;
   val->locus.end.mu_col = locus->end.mu_col;
   
+  mu_locus_range_init (&val->locus);
   mu_locus_range_copy (&val->locus, locus);
   switch (type)
     {
diff --git a/mh/mh_alias_lex.l b/mh/mh_alias_lex.l
index 371353ed3..b97264b38 100644
--- a/mh/mh_alias_lex.l
+++ b/mh/mh_alias_lex.l
@@ -167,6 +167,7 @@ push_source (const char *name, int fail)
     {
       ctx = mu_alloc (sizeof (*ctx));
       ctx->trk = trk;
+      mu_locus_range_init (&ctx->incl_range);
       mu_locus_range_copy (&ctx->incl_range, &yylloc);
       ctx->exec_p = exec_p;
       ctx->i_node = ali_source_inode;