After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 788495 - make check fails on 32bit x86 and armhf with musl libc (Stable component GUIDs)
make check fails on 32bit x86 and armhf with musl libc (Stable component GUIDs)
Status: RESOLVED FIXED
Product: msitools
Classification: Other
Component: tools
0.97
Other Linux
: Normal normal
: 1.0
Assigned To: msitools maintainer(s)
msitools maintainer(s)
Depends on:
Blocks:
 
 
Reported: 2017-10-04 08:06 UTC by ncopa
Modified: 2020-11-17 13:09 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
testsuite.log (81.82 KB, text/x-log)
2017-10-04 08:06 UTC, ncopa 		  Details
0001-msiinfo-fix-buffer-overflow-segfault.patch (1.96 KB, patch)
2017-10-04 15:34 UTC, ncopa 		none Details | Review

Description ncopa 2017-10-04 08:06:24 UTC 
Created attachment 360893 [details]
testsuite.log

## ------------------------- ##
## msitools 0.97 test suite. ##
## ------------------------- ##

...

wixl

 16: Invalid command line                            ok
 17: WiX tutorial SampleFirst                        ok
 18: SampleUser                                      ok
 19: SampleMachine                                   ok
 20: Stable component GUIDs                          FAILED (wixl.at:55)
 21: WiX tutorial SampleFragment                     ok
 22: Preprocessor variables                          ok
 23: Preprocessor include & condition                ok
 24: System include directory                        ok
 25: ARP example                                     ok
 26: Binary/CustomAction                             ok


Similar happens with armhf.
Does not happen on x86_64, ppc64le and s390x, so it seems to only affect 32 bit systems.
Comment 1 ncopa 2017-10-04 14:05:27 UTC 
seems like msiinfo crashes. I was able to get a core dump. Here is the backtrace:

Core was generated by `/home/ncopa/aports/testing/msitools/src/msitools-0.97/.libs/lt-msiinfo export -'.
Program terminated with signal SIGSEGV, Segmentation fault.

+ Trace 238017

  • #0 a_crash
    at ./arch/i386/atomic_arch.h line 83
  • #0 a_crash
    at ./arch/i386/atomic_arch.h line 83
  • #1 free
    at src/malloc/malloc.c line 476
  • #2 g_free
    at gmem.c line 189
  • #3 export_create_table
    at tools/msiinfo.c line 478
  • #4 export_sql
    at tools/msiinfo.c line 609
  • #5 cmd_export
    at tools/msiinfo.c line 656
  • #6 main
    at tools/msiinfo.c line 770 






Comment 2


ncopa





          2017-10-04 14:27:17 UTC
        



Here is the problem, when type="i2":

...
        type = libmsi_record_get_string(types, i);  // type="i2"

// the buffer allocated for type is only 3 bytes. ('i','2','\0').

...
        switch (type[0])
        {
            case 'l': case 'L':
                strcat(extra, " LOCALIZABLE");
                /* fall through */
            case 's': case 'S':
                strcpy(size, type+1);
                sprintf(type, "CHAR(%s)", size);
                break;
            case 'i': case 'I':
                len = atol(type + 1);
                if (len <= 2)
                    strcpy(type, "INT");

// here you try write 4 bytes ('I','N', 'T', '\0') to the 3 byte allocated buffer.

                else if (len == 4)
                    strcpy(type, "LONG");
                else
                    abort();
                break;
            case 'v': case 'V':
                strcpy(type, "OBJECT");
                break;
            default:
                abort();
        }

        printf("`%s` %s%s", name, type, extra);
        g_free(name);
        g_free(type); // since the buffer is overflowed above, the musl free() goes boom here.






Comment 3


ncopa





          2017-10-04 15:34:52 UTC
        



Created attachment 360914 [details] [review]
0001-msiinfo-fix-buffer-overflow-segfault.patch

This fixes the issue on alpine linux x86 and armhf.






Comment 4


Marc-Andre Lureau





          2020-11-17 13:09:33 UTC
        



Thanks, pushed with some changes:

https://gitlab.gnome.org/GNOME/msitools/-/commit/1e30d26baaede98c9be8754bf2b88afff4d9d1e3