Menu ▾ ▴

#6 bad getopt optstring leads to crash with "-r 150"

open
nobody
None
5
2015-08-26
2011-06-21
No

Running "sjinn -r 150" leads to a SIGSEGV, but "sjinn -r150" does not.

https://bugzilla.redhat.com/show_bug.cgi?id=714146

The optstring argument used to process the command line has two colons after the r character. From the man page:

Two colons mean an option takes an optional arg; if there is text in
the current argv-element (i.e., in the same word as the option name
itself, for example, "-oarg"), then it is returned in optarg, otherwise
optarg is set to zero.

As a result, the ck_range->ck_atof call leads to a null pointer dereference. Maybe ck_atof should be more robust with checking it's arguments, but going back to a single colon in the optstring seems to resolve the issue.

Discussion

  • John Linville

    John Linville - 2011-06-21

    sjinn-optarg-r-fix.patch

     
  • Matt Vona

    Matt Vona - 2015-08-26

    Seems like a nice fix :) When brian gets on maybe he'll commit it. We already wrote a script to handel this on our copy of sjinn.

     

Log in to post a comment.