Bug 237263 - [patch] hexdump(1) crashes on invalid format strings without a conversion character after "%"
Summary: [patch] hexdump(1) crashes on invalid format strings without a conversion cha...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: Conrad Meyer
URL:
Keywords: patch-ready
Depends on:
Blocks:
 
Reported: 2019-04-13 15:50 UTC by Bojan Petrovic
Modified: 2019-04-13 16:52 UTC (History)
0 users

See Also:

Attachments
hexdump patch fixing missing conversion char crashes (2.14 KB, patch)
2019-04-13 15:50 UTC, Bojan Petrovic 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Bojan Petrovic 2019-04-13 15:50:42 UTC 
Created attachment 203645 [details]
hexdump patch fixing missing conversion char crashes

Hexdump can segfault if format contains a '%' at the end, without a
conversion specifier. 

Examples:

  hexdump -e '"%"'
  hexdump -e '4/2 "%"'
  hexdump -e '"%53"'


I believe this happens because the behavior of "strchr" on '\0' is not
handled when a conversion specifier is scanned: "The terminating null
byte is considered part of the string, so that if c is specified  as
'\0', these functions return a pointer to the terminator."

I've attached a possible fix (with a test) which treats missing
conversion characters as a format errors.
Comment 1 Conrad Meyer freebsd_committer freebsd_triage 2019-04-13 16:52:06 UTC 
Thanks, Bojan!
Comment 2 commit-hook freebsd_committer freebsd_triage 2019-04-13 16:52:13 UTC 
A commit references this bug:

Author: cem
Date: Sat Apr 13 16:51:49 UTC 2019
New revision: 346187
URL: https://svnweb.freebsd.org/changeset/base/346187

Log:
  hexdump(1): Exit gracefully on format strings missing conversion

  PR:		237263
  Submitted by:	Bojan Petrovic <bojan_petrovic AT fastmail.fm>

Changes:
  head/usr.bin/hexdump/hexdump.h
  head/usr.bin/hexdump/parse.c
  head/usr.bin/hexdump/tests/hexdump_test.sh