$Id: fish-wcsncpy.md 810 2006-05-09 02:02:28Z sakurai $

､ｳ､ﾎﾊｸｾﾏ､ﾏ?

fish､ﾎ･ﾐ･ｰ､�ｽ､ﾀｵ､ｷ､ｿｻ�､ﾎｵｭﾏｿ､ﾇ､ｹ｡｣ ･ﾐ･ｰｽ､ﾀｵ､ﾎ･ｱ｡ｼ･ｹ･ｹ･ｿ･ﾇ･｣､ﾈ､ｷ､ﾆｽ�､ｭ､ﾞ､ｷ､ｿ｡｣

ｸｽｾﾝ

fish､ﾇ･ｿ･ﾖﾊ莇ｰ､�ｹﾔ､ｦ､ﾈ｡｢SIGSEGV､ﾇﾍ�､ﾁ､�ｻ�､ｬ､｢､�｡｣

ｷ�ﾏﾀ

NetBSD-3.0､ﾎlibc､ﾋﾆ�､ﾃ､ﾆ､､､�wcsncpy､ﾏbuffer overflow､ﾎ･ﾐ･ｰ､ｬ､｢､�｡｣ current､ﾇ､ﾏ､ｳ､ﾎ･ﾐ･ｰ､ﾏﾄｾ､ﾃ､ﾆ､､､�､隍ｦ､ﾀ｡｣

･ﾐ･ｰ､ﾎﾈｯｸｫﾊ�ﾋ｡

gdb､ﾇﾍ�､ﾁ､�ｸｶｰ�､�ｸｫ､ﾄ､ｱ､�

SIGSEGV､ﾇﾍ�､ﾁ､�､ﾎ､ﾏ｡｢ﾂ酘�､ｽ､ﾎ･｢･ﾗ･熙ｬﾉﾔﾀｵ､ﾊ･皈筵�ﾁ犲�(ｼ遉ﾋ･ﾌ･�･ﾝ･､･�･ｿ･｢･ｯ･ｻ･ｹ)､�ｹﾔ､ﾃ､ﾆ､､､�ｻ�､ﾇ､｢､�｡｣ ｹ･ｱｿ､ﾋ､簣�､ﾁ､�､ﾎ､�ｺﾆｸｽ､ｹ､�ｻ�､ｬ､ﾇ､ｭ､�､ﾎ､ﾇ｡｢gdbｾ螟ﾇfish､�ﾍ�､ﾈ､ｷ､ﾆ､荀�ｻ�､ﾇ｡｢･ｽ｡ｼ･ｹ､ﾎ､ﾉ､ﾎｹﾔ､ﾇﾍ�､ﾁ､ﾆ､､､�､ｫ､�ﾃﾎ､�ｻ�､ｬ､ﾇ､ｭ､�｡｣

､ﾞ､ｺ｡｢Makefile､ﾎCFLAGS､ﾋ-g､�ｻﾘﾄ熙ｷ｡｢･ﾇ･ﾐ･ﾃ･ｰ･ｷ･�･ﾜ･�ﾉﾕ､ｭ､ﾇfish､�･ｳ･�･ﾑ･､･�､ｹ､�｡｣

ﾊﾑｹｹﾁｰ
    CFLAGS:= -I/usr/pkg/include/ -std=c99 -fno-optimize-sibling-calls -Wall 
ﾊﾑｹｹｸ�
    CFLAGS:= -I/usr/pkg/include/ -std=c99 -fno-optimize-sibling-calls -Wall -g

fish､�gdbｾ螟ﾇｼﾂｹﾔ､ｷ｡｢fish､�ﾍ�､ﾈ､ｷ､ﾆ､荀�｡｣

$ gdb /usr/local/bin/fish
(gdb) run
fish> (､ｳ､ｳ､ﾇ｡｢fish､�ﾍ�､ﾈ､ｹ)
Program received signal SIGSEGV, Segmentation fault.
0x0806ddee in hash_search (h=0x80ada20, key=0x80b4780) at util.c:225
225                     if( (h->arr[pos].key == 0 ) ||
(gdb)

l･ｳ･ﾞ･�･ﾉ､ﾇ｡｢､ﾞ､�､熙ﾎｹﾔ､�ﾉｽｼｨ､ｹ､�ｻ�､筅ﾇ､ｭ､�｡｣

220
221             hv = h->hash_func( key );
222             pos = abs(hv) % h->size;
223             while(1)
224             {
225                     if( (h->arr[pos].key == 0 ) ||
226                             ( h->compare_func( h->arr[pos].key, key ) ) )
227                     {
228                             return pos;
229                     }
(gdb)

SIGSEGV､ﾏﾂ酘�･ﾌ･�･ﾝ･､･�･ｿ･｢･ｯ･ｻ･ｹ､ﾇﾈｯﾀｸ､ｹ､�､ﾎ､ﾇ｡｢h､ｫh->arr､ｬ0､ﾋ､ﾊ､ﾃ､ﾆ､､､�､ﾎ､ﾀ､�､ｦ｡｣

(gdb) print h
$3 = (hash_table_t *) 0x80ada20
(gdb) print h->arr
$4 = (hash_struct_t *) 0x0
(gdb)

･ﾓ･�･ｴ｡｣h->arr､ｬ0､ﾋ､ﾊ､ﾃ､ﾆ､､､�｡｣ h->arr､ｬ0､ﾈ､､､ｦｻ�､ﾏ｡｢h->arr､ﾏﾇﾛﾎ�､ﾇ､ﾏ､ﾊ､ｯ｡｢･ﾝ･､･�･ｿ､ﾈ､､､ｦｻ�､ﾀ｡｣ ･ｨ･ﾇ･｣･ｿ､ﾇhash_struct_t､ﾎﾄ�ｵﾁ､�ｸｫ､�､ﾈ｡｢

typedef struct hash_table
{
        /** The array containing the data */
        hash_struct_t *arr;

､ﾈ､｢､遙｢､荀ﾃ､ﾑ､鸞rr､ﾏ･ﾝ･､･�･ｿ､ﾇ､｢､ﾃ､ｿ｡｣ ､ｳ､�､ｬ0､ﾋ､ﾊ､ﾃ､ﾆ､､､�､ﾈ､､､ｦｻ�､ﾏ｡｢malloc､ｷﾋｺ､�､ﾆ､､､�､ｫ｡｢､ﾉ､ｳ､ｫ､ﾇ0､�･ｻ･ﾃ･ﾈ､ｷ､ﾆ､ｷ､ﾞ､ﾃ､ﾆ､､､�､ﾎ､ﾀ､�､ｦ｡｣

･ﾝ･､･�･ｿ､�･ﾌ･�､ﾋ､ｷ､ﾆ､､､�ｲﾕｽ熙�ﾃｵ､ｹ

h->arr､ﾋﾃﾍ､�･ｻ･ﾃ･ﾈ､ｷ､ﾆ､､､�ｲﾕｽ熙�ﾃｵ､ｹ｡｣

$ grep 'h->arr' *
util.c: h->arr = malloc( sizeof(hash_struct_t)*sz );
util.c:         h->arr[i].key = 0;
util.c: h->arr = 0;
util.c: free( h->arr );
  ...
util.c:                 func( h->arr[i].key, h->arr[i].data, aux );
$

､｢､熙ｬ､ｿ､､ｻ�､ﾋ｡｢h->arr､ﾋ･｢･ｯ･ｻ･ｹ､ｷ､ﾆ､､､�､ﾎ､ﾏ｡｢util.c､ﾀ､ｱ､ﾎ､隍ｦ､ﾀ｡｣ util.c､�ｸｫ､�､ﾈ｡｢h->arr､ﾋﾃﾍ､�･ｻ･ﾃ･ﾈ､ｷ､ﾆ､､､�､ﾎ､ﾏ｡｢hash_init2()､ﾈhash_init(), hash_realloc()､ﾀ､ｱ､ﾈ､､､ｦｻ�､ｬ､�､ｫ､ﾃ､ｿ｡｣ ､ｦ｡ｼ､爍｣ﾆﾃ､ﾋ､ｪ､ｫ､ｷ､､ｽ熙ﾏｸｫ､ﾄ､ｫ､鬢ﾊ､､｡｣

backtrace

bt(backtrace)･ｳ･ﾞ･�･ﾉ､ﾇ｡｢ｴﾘｿ�､ﾎｸﾆ､ﾓｽﾐ､ｷﾍ�ﾎ�､�ﾉｽｼｨ､ｷ､ﾆ､ﾟ､�｡｣

(gdb) bt
#0  0x0806ddee in hash_search (h=0x80ada20, key=0x80b4780) at util.c:225
#1  0x0806e083 in hash_get (h=0x80ada20, key=0x80b4780) at util.c:311
#2  0x080502b2 in complete_get_desc_suffix (suff_orig=0x80b46d4) at complete.c:857
#3  0x08050778 in complete_get_desc (filename=0x80b4680) at complete.c:993
#4  0x08064d46 in get_desc (fn=0x80b4680, sb=0xbfbfdc20, is_cmd=0) at wildcard.c:330
#5  0x0806534c in wildcard_expand (wc=0x80b45b8, base_dir=0x80bb000, flags=9, out=0xbfbfdeb0)
    at wildcard.c:558
#6  0x08065647 in wildcard_expand (wc=0x80b4598, base_dir=0x80b6000, flags=9, out=0xbfbfdeb0)
        at wildcard.c:703
#7  0x08065647 in wildcard_expand (wc=0x80b4584, base_dir=0x807e658, flags=9, out=0xbfbfdeb0)
            at wildcard.c:703
#8  0x08057d72 in expand_string (context=0x0, str=0x80ad880, end_out=0xbfbfe430, flags=9)
                at expand.c:1614
#9  0x080518e5 in complete_param_expand (str=0x80ad820, comp_out=0xbfbfe430, do_file=1)
                    at complete.c:1732
#10 0x08052006 in complete (cmd=0x80b2ac0, comp=0xbfbfe430) at complete.c:2049
#11 0x08062ef5 in reader_readline () at reader.c:2477
#12 0x0806274d in read_i () at reader.c:2259
#13 0x08063a35 in reader_read (fd=0) at reader.c:2965
#14 0x08075bc1 in main (argc=1, argv=0xbfbfe59c) at main.c:283
#15 0x0804a1d6 in ___start ()
(gdb)

backtrace､ﾈcomplete.c､�ﾆﾉ､爨ﾈ｡｢ｰﾊｲｼ､ﾎｻ�､ｬ､�､ｫ､ﾃ､ｿ｡｣

• 'h'､ﾏcomplete.cﾆ筅ﾎhash_suffix､ﾈ､､､ｦglobalﾊﾑｿ�｡｣､ｳ､�､ｬhash_search()､ﾋﾅﾏ､ﾃ､ﾆ､ｯ､�
• complete_get_desc_suffix()､ﾎｽ魎�､ﾎｸﾆ､ﾓｽﾐ､ｷｻ�､ﾋ｡｢hash_suffix､ﾎmalloc､ﾈｽ魘�ｲｽ､ｬｹﾔ､�､�､�
• hash_put､ﾋｻ�･ｵ･､･ｺ､ｬﾂｭ､熙ﾊ､､ｻ�､ﾋ｡｢realloc､ｬｹﾔ､�､�､�｡｣

､ｳ､ﾎｸ螂ｽ｡ｼ･ｹ､�､隍ｯﾆﾉ､�､ﾇ､ﾟ､ｿ､ﾎ､ﾀ､ｬ｡｢､ｪ､ｫ､ｷ､､ｽ熙ﾏｸｫ､｢､ｿ､鬢ﾊ､ｫ､ﾃ､ｿ｡｣ ､ﾁ､遉ﾃ､ﾈ､ｪｼ�ｾ螟ｲ｡｣

watch point､�ｻﾈ､ｦ

､ｳ､ｦ､ﾊ､ﾃ､ｿ､鮗ﾇｸ螟ﾎｼ�ﾃﾊ｡｣watch point､�ｻﾈ､ｪ､ｦ｡｣ watch point､�ｻﾈ､ｦ､ﾈ｡｢ﾊﾑｿ�､ﾎﾃﾍ､ｬﾊﾑ､�､�･ｿ･､･ﾟ･�･ｰ､ﾇ･ﾖ･�｡ｼ･ｯ､�､ｫ､ｱ､�ｻ�､ｬ､ﾇ､ｭ､�｡｣ ､ｿ､ﾀ､ｷ｡｢watch point､�ｻﾈ､ｦ､ﾈ･ﾗ･�･ｰ･鬣爨ﾎｼﾂｹﾔ､ﾏｻ爨ﾌ､ﾛ､ﾉﾃﾙ､ｯ､ﾊ､�｡｣

suffix_hash->arr､ｬ､ﾉ､ｳ､ｫ､ﾇ0､ﾋ､ｵ､�､ﾆ､､､�､ﾎ､ﾇ｡｢､ｽ､�､�ｸｫ､ﾄ､ｱ､�｡｣

fish> (ctrl-C､ﾇgdb､ﾘ)
Program received signal SIGINT, Interrupt.
0xbdb04f2f in select () from /usr/lib/libc.so.12
(gdb) watch suffix_hash->arr (watch point､ﾎ･ｻ･ﾃ･ﾈ)
Watchpoint 1: suffix_hash->arr
(gdb) c (fish､ﾎｼﾂｹﾔ､�ｺﾆｳｫ)
Continuing.
(fish､�ﾍ�､ﾈ､ｹ)

Watchpoint 1: suffix_hash->arr

Old value = (hash_struct_t *) 0x80bde00
New value = (hash_struct_t *) 0x0
0xbdb07df6 in wcsncpy () from /usr/lib/libc.so.12
(gdb)

libc､ﾎwcsncpy()､ﾎﾃ讀ﾇsuffix_hash->arr､ｬ0､ﾋ､ﾊ､ﾃ､ﾆ､�ｻ�､ｬ､�､ｫ､ﾃ､ｿ｡｣ ､ｪ､ｽ､鬢ｯ｡｢wcsncpy､ﾋﾅﾏ､ｹｰ�ｿ�､ｬﾉﾔﾀｵ､ﾊﾊｪ､ﾋ､ﾊ､ﾃ､ﾆ､､､�､ﾎ､ﾀ､�､ｦ｡｣ bt､ﾇ｡｢wcsncpy､ｬ､ﾉ､ｳ､ｫ､鮑ﾆ､ﾐ､�､ﾆ､､､�､ﾎ､ｫ､�ﾄｴ､ﾙ､�｡｣

(gdb) bt
#0  0xbdb07df6 in wcsncpy () from /usr/lib/libc.so.12
#1  0x080726a5 in wcsndup (in=0x80b4598, c=7) at fallback.c:821
#2  0x0806544b in wildcard_expand (wc=0x80b4598, base_dir=0x80b6000, flags=9, out=0xbfbfdeb0)
    at wildcard.c:628
    ...

wcsncpy()､ﾏ｡｢fallback.c､ﾎwcsndup()､ｫ､鮑ﾆ､ﾐ､�､ﾆ､､､�｡｣ wcsndup()､ﾎ･ｽ｡ｼ･ｹ､�ｸｫ､ﾆ､ﾟ､�｡｣

(gdb) l fallback.c:819
814     wchar_t *wcsndup( const wchar_t *in, int c )
815     {
816             wchar_t *res = malloc( sizeof(wchar_t)*(c+1) );
817             if( res == 0 )
818             {
819                     return 0;
820             }
821             wcsncpy( res, in, c+1 );
822             res[c] = L'\0';
823             return res;
(gdb)

､｢､�?malloc､ｷ､ﾆ､ｽ､ｳ､ﾋﾊｸｻ�ﾎ�､�･ｳ･ﾔ｡ｼ､ｷ､ﾆ､､､�､ﾀ､ｱ､ﾊ､ﾎ､ﾇ｡｢ｰ�ｸｫ､ｷ､ﾆ､ｪ､ｫ､ｷ､､ｽ熙ﾏｲｿ､篋ｫ､ﾄ､ｫ､鬢ﾊ､､｡｣ wcsncpy､ﾏwide charﾈﾇ､ﾎstrncpy､ﾊ､ﾎ､ﾇ｡｢ﾂ霆ｰｰ�ｿ�(c+1)ｰﾊｾ螟ﾎﾎﾎｰ隍ﾋ､ﾏｽ�､ｭｹ�､ﾟ､ｷ､ﾊ､､､ﾏ､ｺ｡｣

､ｦ｡ｼ､爍｣

､ﾈ､熙｢､ｨ､ｺ｡｢ﾊﾑｿ�､ﾎﾃﾍ､�ｸｫ､ﾆ､ﾟ､隍ｦ｡｣

(gdb) print in
$1 = (const wchar_t *) 0x80b4598
(gdb) print c
$2 = 7
(gdb) print res
$3 = (wchar_t *) 0x80ada00
(gdb) print sizeof(wchar_t)
$4 = 4

malloc､ｷ､ｿﾎﾎｰ隍ﾋｽ�､ｭｹ�､爨ﾈsuffix_hash->arr､ｬ0､ﾋ､ﾊ､ﾃ､ﾆ､ｷ､ﾞ､ｦ､ﾃ､ﾆｻ�､ﾏ｡｢ res､ﾈsuffix_hash､ﾎ･｢･ﾉ･�･ｹ､ﾏｶ皃､､ﾎ､ﾀ､�､ｦ､ｫ｡｣ suffix_hash､ﾎ･｢･ﾉ･�･ｹ､�ｸｫ､ﾆ､ﾟ､�｡｣

(gdb) print suffix_hash
$5 = (hash_table_t *) 0x80ada20
(gdb)

res､ﾏsuffix_hash､隍�32･ﾐ･､･ﾈﾁｰ､ﾋｰﾌﾃﾖ､ｷ､ﾆ､､､�｡｣ res､ﾎ･｢･ﾉ･�･ｹ､�char､ﾇ･ﾀ･�･ﾗ､ｷ､ﾆ､ﾟ､�､ﾈ｡｢

(gdb) x/40c res
0x80ada00:      115 's' 0 '\0'  0 '\0'  0 '\0'  97 'a'  0 '\0'  0 '\0'  0 '\0'
0x80ada08:      107 'k' 0 '\0'  0 '\0'  0 '\0'  117 'u' 0 '\0'  0 '\0'  0 '\0'
0x80ada10:      114 'r' 0 '\0'  0 '\0'  0 '\0'  97 'a'  0 '\0'  0 '\0'  0 '\0'
0x80ada18:      105 'i' 0 '\0'  0 '\0'  0 '\0'  47 '/'  0 '\0'  0 '\0'  0 '\0'
0x80ada20:      0 '\0'  0 '\0'  0 '\0'  0 '\0'  2 '\002'        0 '\0'  0 '\0'  0 '\0'
(gdb)

ｸｫｻ�､ﾋsuffix_hash､ﾎﾀ霹ｬ､ｬ0､ﾋ､ﾊ､ﾃ､ﾆ､､､�｡｣

malloc､ﾇ4*(7+1)=32･ﾐ･､･ﾈｳﾎﾊﾝ､ｷ｡｢wcsncpy､ﾇ32･ﾐ･､･ﾈ､ﾞ､ﾇ､ｷ､ｫｽ�､ｭｹ�､ﾟ､ｷ､ﾆ､､､ﾊ､､､ﾏ､ｺ､ﾀ､隍ﾊ､｢｡｣ ､ｽ､ﾎｸ螟�､ﾎsuffix_hash､�ｲ�､ｹ､�､ｱ､ﾏ､ﾊ､､､ﾎ､ﾀ､ｱ､ﾉ｡｣

wcsncpy､ﾎ･ｽ｡ｼ･ｹ､�ｸｫ､ﾆ､ﾟ､�

､ﾒ､遉ﾃ､ﾈ､ｷ､ﾆ｡｢､ﾒ､遉ﾃ､ﾈ､ｹ､�､ﾈ｡ﾄ

wcsncpy､ﾎ･ﾐ･ｰ?

/usr/src/lib/libc/string/wcsncpy.c､�ｸｫ､ﾆ､ﾟ､�｡｣

wchar_t *
wcsncpy(s1, s2, n)
    wchar_t *s1;
    const wchar_t *s2;
    size_t n;
{
    wchar_t *p;
    const wchar_t *q;

    _DIAGASSERT(s1 != NULL);
    _DIAGASSERT(s2 != NULL);

    *s1 = '\0';
    p = s1;
    q = s2;
    while (n && *q) {
        *p++ = *q++;
        n--;
    }
    *p = '\0';

    return s1;
}

､｢､�??

*p = '\0'

､ｬﾉｬ､ｺｼﾂｹﾔ､ｵ､�､ﾆ､､､�｡｣､筅ｷn､ｬ1､ﾊ､鬘｢n+1､ﾎﾎﾎｰ隍ﾎｽ�､ｭｹ�､ﾟ､ｹ､�ｻ�､ﾋ､ﾊ､�｡｣ ､ｳ､�､ﾃ､ﾆ｡｢wcsncpy､ﾎ･ﾐ･ｰ､ﾀ､隍ﾊ､｢｡｣､ｭ､ﾃ､ﾈ｡｣

NetBSD-current､ﾇ､籠ｾ､ﾃ､ﾆ､ﾊ､､､隍ｦ､ﾊ､鬘｢･ﾐ･ｰ･�･ﾝ｡ｼ･ﾈ､�ｽﾐ､ｷ､ﾆ､ｪ､ｯ､ｫ｡｣ CVS､ﾎwcsncpy.c ､�､ﾟ､�､ﾈ｡｢ｺﾇｿｷ･ｽ｡ｼ･ｹ(rev1.3)､ﾇ､ﾏﾄｾ､ﾃ､ﾆ､､､�､ﾟ､ｿ､､｡｣ NetBSD-3.0､ﾋ､ﾏbackport､ｵ､�､ﾊ､､､ﾊ､､､ﾈ､､､ｦｻ�､ｫ｡｣