Bug 28221
| Summary: | dialog(1) segfaults (due to the bug in libdialog?) | ||
|---|---|---|---|
| Product: | Base System | Reporter: | Eugene Grosbein <ports> |
| Component: | bin | Assignee: | Eric Melville <eric> |
| Status: | Closed FIXED | ||
| Severity: | Affects Only Me | ||
| Priority: | Normal | ||
| Version: | 4.3-STABLE | ||
| Hardware: | Any | ||
| OS: | Any | ||
Responsible Changed From-To: freebsd-bugs->eric Eric was working on this code recently. Perhaps he can add in a simple check? Hi! It still segfaults in 4.7-STABLE. Any ideas? Eugene Grosbein > It still segfaults in 4.7-STABLE.
> Any ideas?
Yes, I can easily fix this. The reason it hasn't been fixed and this
report has been going stale is because it's really a reminder of a much
larger problem. That is, libdialog is chock full of these things, and
some of them are security concerns.
I can fix this one problem and close this one bug, but we're really
just playing whack-a-mole with the thing.
It's probably a lost cause, but has anyone else got any better ideas?
State Changed From-To: open->closed A simple check was added, ignoring other similar problems in libdialog. |
dialog(1) segfaults with incorrect parameters due to the lack of checks in it or /usr/src/gnu/lib/libdialog/menubox.c. Precisely, there is a code about line 450 of menubox.c: /* * Print menu item */ static void print_item(WINDOW *win, unsigned char *tag, unsigned char *item, int choice, int selected, dialogMenuItem *me, int menu_width, int tag_x, int item_x) { int i; /* Clear 'residue' of last item */ wattrset(win, menubox_attr); wmove(win, choice, 0); for (i = 0; i < menu_width; i++) waddch(win, ' '); wmove(win, choice, tag_x); wattrset(win, selected ? tag_key_selected_attr : tag_key_attr); waddch(win, tag[0]); ^^^^^^ when tag==NULL, dialog(1) segfaults Fix: Perhaps, add some checks? I have no experience with ncurses. How-To-Repeat: Type: dialog --menu "" 15 40 "" "" off Now press 'Down' arrow key and dialog segfaults Here is gdb(1) output: # gdb `which dialog` dialog.core GNU gdb 4.18 Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"... Core was generated by Wialog'. Program terminated with signal 11, Segmentation fault. Reading symbols from /usr/lib/libdialog.so.4...done. Reading symbols from /usr/lib/libncurses.so.5...done. Reading symbols from /usr/lib/libc.so.4...done. Reading symbols from /usr/libexec/ld-elf.so.1...done. #0 0x28070ce6 in print_item (win=0x8050400, tag=0x0, item=0xbfbffc6f "MACHTYPE=i386", choice=1, selected=1, me=0x0, menu_width=34, tag_x=14, item_x=16) at /usr/src/gnu/lib/libdialog/menubox.c:450 450 waddch(win, tag[0]); (gdb) bt #0 0x28070ce6 in print_item (win=0x8050400, tag=0x0, item=0xbfbffc6f "MACHTYPE=i386", choice=1, selected=1, me=0x0, menu_width=34, tag_x=14, item_x=16) at /usr/src/gnu/lib/libdialog/menubox.c:450 #1 0x28070762 in dialog_menu (title=0x0, prompt=0xbfbffc62 "", height=15, width=40, menu_height=0, cnt=1, it=0xbfbffb68, result=0xbfbff2fc "", ch=0x0, sc=0x0) at /usr/src/gnu/lib/libdialog/menubox.c:300 #2 0x80490d6 in main (argc=8, argv=0xbfbffb50) at /usr/src/gnu/usr.bin/dialog/dialog.c:262 #3 0x80489ed in _start ()