Buffer overflow

[Baruch Even ba...@ev-en.org]

Hi,

I just thought I'll do a trivial check of trivial bugs, in this case
giving a bit too long parameters. These actually look like bugs in the apr
library.

gdb --args svn export \
        file:///home/svn/debian/`perl -e 'print A x 20000'`

Results in:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 19831)]
0x401c865a in apr_allocator_set_mutex () from /usr/lib/libapr.so.0
(gdb) bt
#0  0x401c865a in apr_allocator_set_mutex () from /usr/lib/libapr.so.0
#1  0x401c7957 in apr_pvsprintf () from /usr/lib/libapr.so.0
#2  0x40156c48 in svn_error_createf () from /usr/lib/libsvn_subr-1.so.0
#3  0x40075163 in svn_repos_create () from /usr/lib/libsvn_repos-1.so.0
#4  0x400751f0 in svn_repos_create () from /usr/lib/libsvn_repos-1.so.0
#5  0x40075458 in svn_repos_open () from /usr/lib/libsvn_repos-1.so.0
#6  0x40065fd4 in svn_ra_local__split_URL () from /usr/lib/libsvn_ra_local-1.so.0
#7  0x40064b0c in _init () from /usr/lib/libsvn_ra_local-1.so.0
#8  0x40034891 in svn_client__open_ra_session () from /usr/lib/libsvn_client-1.so.0
#9  0x40026eef in svn_client_checkout () from /usr/lib/libsvn_client-1.so.0
#10 0x40030877 in svn_client_export () from /usr/lib/libsvn_client-1.so.0
#11 0x0804bf58 in svn_handle_warning ()
#12 0x0804e99d in svn_handle_warning ()
#13 0x404599f1 in __libc_start_main () from /lib/libc.so.6
(gdb) quit

And:

gdb --args  svn  export file:///home/svn/debian/`perl -e 'print a x 16300'`

Resulted in:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 19872)]
0x404ae16d in mallopt () from /lib/libc.so.6
(gdb) bt
#0  0x404ae16d in mallopt () from /lib/libc.so.6
#1  0x404ad172 in free () from /lib/libc.so.6
#2  0x401c6cbb in apr_allocator_destroy () from /usr/lib/libapr.so.0
#3  0x401c743e in apr_pool_destroy () from /usr/lib/libapr.so.0
#4  0x401c6fa6 in apr_pool_terminate () from /usr/lib/libapr.so.0
#5  0x401c2f25 in apr_terminate () from /usr/lib/libapr.so.0
#6  0x4046c744 in exit () from /lib/libc.so.6
#7  0x404599f9 in __libc_start_main () from /lib/libc.so.6
(gdb) q

-- 
Baruch Even
http://baruch.ev-en.org/

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org