Bug 202022 - bsdgrep -f crash with null pattern
Summary: bsdgrep -f crash with null pattern
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Kyle Evans
URL:
Keywords: patch
Depends on:
Blocks:
 
Reported: 2015-08-01 12:49 UTC by kcwu
Modified: 2017-08-24 14:18 UTC (History)
2 users (show)

See Also:
kevans: mfc-stable11+
emaste: mfc-stable10?
emaste: mfc-stable9-


Attachments
Proposed patch to fix -f issue with single null byte for pattern (457 bytes, patch)
2017-01-20 04:06 UTC, Kyle Evans
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description kcwu 2015-08-01 12:49:44 UTC
How to repeat:
$ printf "\0" > nul
$ bsdgrep -f nul /COPYRIGHT
Segmentation fault (core dumped)

According to
http://pubs.opengroup.org/onlinepubs/9699919799/functions/getdelim.html
"Although a NUL terminator is always supplied after the line, note that strlen(*lineptr) will be smaller than the return value if the line contains embedded NUL characters."

bsdgrep didn't handle embedded NULL characters inside the pattern.
Comment 1 Ed Maste freebsd_committer freebsd_triage 2016-03-14 15:29:10 UTC
Confirmed at r296724
Comment 2 Kyle Evans freebsd_committer freebsd_triage 2017-01-20 04:06:24 UTC
Created attachment 179122 [details]
Proposed patch to fix -f issue with single null byte for pattern

Hi,

I'm attaching a patch that theoretically addresses this in line with how we otherwise treat null bytes as early terminators of the pattern -- thus matching everything if appearing on a line of its own.

I've not been able to break it when treated this way.
Comment 3 commit-hook freebsd_committer freebsd_triage 2017-04-05 18:42:06 UTC
A commit references this bug:

Author: emaste
Date: Wed Apr  5 18:41:46 UTC 2017
New revision: 316536
URL: https://svnweb.freebsd.org/changeset/base/316536

Log:
  bsdgrep: create additional tests for coverage on recent fixes

  Create additional tests to cover regressions that were discovered by
  PRs linked to reviews D10098, D10102, and D10104.

  It is worth noting that neither bsdgrep(1) nor gnugrep(1) in the base
  system currently pass all of these tests, and gnugrep(1) not quite being
  up to snuff was also noted in at least one of the PRs.

  PR:		175314 202022 195763 180990 197555 197531 181263 209116
  Submitted by:	Kyle Evans <kevans91@ksu.edu>
  Reviewed by:	cem, ngie, emaste
  MFC after:	1 month
  Differential Revision:	https://reviews.freebsd.org/D10112

Changes:
  head/contrib/netbsd-tests/usr.bin/grep/d_color_a.in
  head/contrib/netbsd-tests/usr.bin/grep/d_color_a.out
  head/contrib/netbsd-tests/usr.bin/grep/d_color_b.in
  head/contrib/netbsd-tests/usr.bin/grep/d_color_b.out
  head/contrib/netbsd-tests/usr.bin/grep/d_color_c.out
  head/contrib/netbsd-tests/usr.bin/grep/d_escmap.in
  head/contrib/netbsd-tests/usr.bin/grep/d_f_file_empty.in
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_a.in
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_a.out
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_b.in
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_b.out
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_c.in
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_c.out
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_d.in
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_e.in
  head/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_e.out
  head/contrib/netbsd-tests/usr.bin/grep/t_grep.sh
  head/usr.bin/grep/tests/Makefile
Comment 4 commit-hook freebsd_committer freebsd_triage 2017-04-05 20:11:35 UTC
A commit references this bug:

Author: emaste
Date: Wed Apr  5 20:11:05 UTC 2017
New revision: 316542
URL: https://svnweb.freebsd.org/changeset/base/316542

Log:
  bsdgrep: Handle special case of single-byte NUL pattern

  PR:		202022
  Submitted by:	Kyle Evans <kevans91 at ksu.edu>
  MFC after:	1 month
  Differential Revision:	https://reviews.freebsd.org/D10102

Changes:
  head/usr.bin/grep/grep.c
Comment 5 commit-hook freebsd_committer freebsd_triage 2017-08-16 00:13:49 UTC
A commit references this bug:

Author: kevans
Date: Wed Aug 16 00:12:25 UTC 2017
New revision: 322555
URL: https://svnweb.freebsd.org/changeset/base/322555

Log:
  bsdgrep: Fix matching behavior and add regression tests

  MFC r316477: bsdgrep: fix matching behaviour

  - Set REG_NOTBOL if we've already matched beginning of line and we're
    examining later parts

  - For each pattern we examine, apply it to the remaining bits of the
    line rather than (potentially) smaller subsets

  - Check for REG_NOSUB after we've looked at all patterns initially
    matching the line

  - Keep track of the last match we made to later determine if we're
    simply not matching any longer or if we need to proceed another byte
    because we hit a zero-length match

  - Match the earliest and longest bit of each line before moving the
    beginning of what we match to further in the line, past the end of the
    longest match; this generally matches how gnugrep(1) seems to behave,
    and seems like pretty good behavior to me

  - Finally, bail out of printing any matches if we were set to print all
    (empty pattern) but -o (output matches) was set

  MFC r316489: bsdgrep: Initialize vars to avoid a false positive GCC warning

  MFC r316491: bsdgrep: revert color changes from r316477

  r316477 changed the color output to match exactly the in-tree GNU grep,
  but introduces unnecessary escape sequences.

  MFC r316536: bsdgrep: create additional tests for coverage on recent fixes

  Create additional tests to cover regressions that were discovered by
  PRs linked to reviews D10098, D10102, and D10104.

  It is worth noting that neither bsdgrep(1) nor gnugrep(1) in the base
  system currently pass all of these tests, and gnugrep(1) not quite being
  up to snuff was also noted in at least one of the PRs.

  MFC r317052: bsdgrep: fix zero-length matches without the -o flag

  r316477 broke zero-length matches when not using the -o flag, by
  skipping over them entirely.

  Add a regression test so that it doesn't break again in the future.

  PR:		175314, 180990, 181263, 195763, 197531, 197555, 202022, 209116
  Approved by:	emaste (mentor, blanket MFC)
  Relnotes:	yes

Changes:
_U  stable/11/
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_color_a.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_color_a.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_color_b.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_color_b.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_color_c.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_escmap.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_f_file_empty.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_a.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_a.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_b.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_b.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_c.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_c.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_d.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_e.in
  stable/11/contrib/netbsd-tests/usr.bin/grep/d_oflag_zerolen_e.out
  stable/11/contrib/netbsd-tests/usr.bin/grep/t_grep.sh
  stable/11/usr.bin/grep/tests/Makefile
  stable/11/usr.bin/grep/util.c
Comment 6 commit-hook freebsd_committer freebsd_triage 2017-08-16 00:43:14 UTC
A commit references this bug:

Author: kevans
Date: Wed Aug 16 00:42:52 UTC 2017
New revision: 322559
URL: https://svnweb.freebsd.org/changeset/base/322559

Log:
  MFC r316542: bsdgrep: Handle special case of single-byte NUL pattern

  PR:		202022
  Approved by:	emaste (mentor, blanket MFC)

Changes:
_U  stable/11/
  stable/11/usr.bin/grep/grep.c
Comment 7 Mark Linimon freebsd_committer freebsd_triage 2017-08-24 14:18:52 UTC
MFCed Wed Aug 16 00:42:52 UTC 2017.