NetBSD Problem Report #56897

From www@netbsd.org  Tue Jun 21 08:22:50 2022
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 1EBEB1A921F
	for <gnats-bugs@gnats.NetBSD.org>; Tue, 21 Jun 2022 08:22:50 +0000 (UTC)
Message-Id: <20220621082248.AEB131A923A@mollari.NetBSD.org>
Date: Tue, 21 Jun 2022 08:22:48 +0000 (UTC)
From: rvp@SDF.ORG
Reply-To: rvp@SDF.ORG
To: gnats-bugs@NetBSD.org
Subject: cksum(1): hash functions dump core if a directory is fed in `-c' input
X-Send-Pr-Version: www-1.0

>Number:         56897
>Category:       bin
>Synopsis:       cksum(1): hash functions dump core if a directory is fed in `-c' input
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    gutteridge
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jun 21 08:25:00 +0000 2022
>Closed-Date:    Sat Jun 25 02:32:38 +0000 2022
>Last-Modified:  Sat Jun 25 02:32:38 +0000 2022
>Originator:     RVP
>Release:        NetBSD/amd64 9.99.97
>Organization:
>Environment:
NetBSD  9.99.97 NetBSD 9.99.97 (GENERIC) #0: Thu Jun  9 07:01:27 UTC 2022  mkrepro@mkrepro.NetBSD.org:/usr/src/sys/arch/amd64/compile/GENERIC amd64
>Description:
I accidentally fed a directory name instead for a filename to sha256(1)
and it dumped core on me:

$ echo "0 /tmp" | sha256 -c
Segmentation fault (core dumped)
$ 

The other "hash" functions do the same.
>How-To-Repeat:
As above.
>Fix:
This fixes it for me:

---START---
diff -urN usr.bin/cksum.orig/cksum.c usr.bin/cksum/cksum.c
--- usr.bin/cksum.orig/cksum.c	2021-08-25 23:03:01.000000000 +0000
+++ usr.bin/cksum/cksum.c	2022-06-21 07:41:27.347025576 +0000
@@ -421,8 +421,10 @@
 			strlcpy(cksum, p_cksum, l_cksum+1);

 			if (hash) {
-				if (access(filename, R_OK) == 0
-				    && strcmp(cksum, hash->filefunc(filename, NULL)) == 0)
+				char* h;
+				if (access(filename, R_OK) == 0 
+				    && (h = hash->filefunc(filename, NULL)) != NULL
+				    && strcmp(cksum, h) == 0)
 					ok = 1;
 				else
 					ok = 0;

---END---

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: bin-bug-people->gutteridge
Responsible-Changed-By: gutteridge@NetBSD.org
Responsible-Changed-When: Sat, 25 Jun 2022 02:18:27 +0000
Responsible-Changed-Why:
I'll handle this.

From: "David H. Gutteridge" <gutteridge@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/56897 CVS commit: src/usr.bin/cksum
Date: Sat, 25 Jun 2022 02:22:42 +0000

 Module Name:	src
 Committed By:	gutteridge
 Date:		Sat Jun 25 02:22:42 UTC 2022

 Modified Files:
 	src/usr.bin/cksum: cksum.c

 Log Message:
 cksum.c: don't fault if the hash algorithm is fed invalid data

 Addresses PR bin/56897 from RVP, who provided the patch.


 To generate a diff of this commit:
 cvs rdiff -u -r1.51 -r1.52 src/usr.bin/cksum/cksum.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: gutteridge@NetBSD.org
State-Changed-When: Sat, 25 Jun 2022 02:32:38 +0000
State-Changed-Why:
Patch applied. Thanks for the PR!

>Unformatted:

Home	PR Database Search