Ubuntu
tcl8.4 package

buffer overflow detected

Bug #683546 reported by David Kastrup
22
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Tcl
Unknown
Unknown
tcl8.4 (Ubuntu)
Fix Released
Medium
Unassigned

Bug Description

Binary package hint: git

*** buffer overflow detected ***: wish terminated
======= Backtrace: =========
/lib/libc.so.6(__fortify_fail+0x50)[0xf30990]
/lib/libc.so.6(+0xe488a)[0xf2f88a]
/lib/libc.so.6(__strcpy_chk+0x44)[0xf2ec04]
/usr/lib/libtcl8.4.so.0(TclTraceVariableObjCmd+0x420)[0x670b60]
/usr/lib/libtcl8.4.so.0(Tcl_TraceObjCmd+0x1ae)[0x66f83e]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(+0x4a2be)[0x6892be]
/usr/lib/libtcl8.4.so.0(TclCompEvalObj+0xed)[0x68699d]
/usr/lib/libtcl8.4.so.0(Tcl_EvalObjEx+0xb5)[0x65e635]
/usr/lib/libtcl8.4.so.0(Tcl_SwitchObjCmd+0x369)[0x66f269]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(Tcl_EvalEx+0x419)[0x65e179]
/usr/lib/libtcl8.4.so.0(Tcl_FSEvalFile+0x233)[0x6a5543]
/usr/lib/libtcl8.4.so.0(Tcl_SourceObjCmd+0x57)[0x66c487]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(Tcl_EvalObjv+0x122)[0x65d632]
/usr/lib/libtcl8.4.so.0(Tcl_EvalObjEx+0x1c0)[0x65e740]
/usr/lib/libtcl8.4.so.0(Tcl_UplevelObjCmd+0x116)[0x6bca16]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(+0x4a2be)[0x6892be]
/usr/lib/libtcl8.4.so.0(TclCompEvalObj+0xed)[0x68699d]
/usr/lib/libtcl8.4.so.0(TclObjInterpProc+0x29c)[0x6bcf9c]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(Tcl_EvalObjv+0x122)[0x65d632]
/usr/lib/libtcl8.4.so.0(Tcl_EvalObjEx+0x1c0)[0x65e740]
/usr/lib/libtcl8.4.so.0(Tcl_UplevelObjCmd+0x116)[0x6bca16]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(+0x4a2be)[0x6892be]
/usr/lib/libtcl8.4.so.0(TclCompEvalObj+0xed)[0x68699d]
/usr/lib/libtcl8.4.so.0(TclObjInterpProc+0x29c)[0x6bcf9c]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x419)[0x65d469]
/usr/lib/libtcl8.4.so.0(+0x4a2be)[0x6892be]
/usr/lib/libtcl8.4.so.0(TclCompEvalObj+0xed)[0x68699d]
/usr/lib/libtcl8.4.so.0(TclObjInterpProc+0x29c)[0x6bcf9c]
/usr/lib/libtcl8.4.so.0(TclEvalObjvInternal+0x37b)[0x65d3cb]
/usr/lib/libtcl8.4.so.0(Tcl_EvalEx+0x419)[0x65e179]
/usr/lib/libtcl8.4.so.0(Tcl_Eval+0x3c)[0x65e49c]
/usr/lib/libtk8.4.so.0(TkpInit+0x35)[0xb26eb5]
/usr/lib/libtk8.4.so.0(+0x45b4c)[0xab7b4c]
wish(Tcl_AppInit+0x2f)[0x804885f]
/usr/lib/libtk8.4.so.0(Tk_MainEx+0x3d0)[0xaa6400]
wish(main+0x3a)[0x804881a]
/lib/libc.so.6(__libc_start_main+0xe7)[0xe61ce7]
wish[0x8048741]
======= Memory map: ========
00110000-00224000 r-xp 00000000 08:06 29807 /usr/lib/libX11.so.6.3.0
00224000-00225000 r--p 00113000 08:06 29807 /usr/lib/libX11.so.6.3.0
00225000-00227000 rw-p 00114000 08:06 29807 /usr/lib/libX11.so.6.3.0
00227000-00228000 rw-p 00000000 00:00 0
00228000-0022a000 r-xp 00000000 08:06 13562 /lib/libdl-2.12.1.so
0022a000-0022b000 r--p 00001000 08:06 13562 /lib/libdl-2.12.1.so
0022b000-0022c000 rw-p 00002000 08:06 13562 /lib/libdl-2.12.1.so
0022c000-00244000 r-xp 00000000 08:06 22602 /usr/lib/libxcb.so.1.1.0
00244000-00245000 r--p 00017000 08:06 22602 /usr/lib/libxcb.so.1.1.0
00245000-00246000 rw-p 00018000 08:06 22602 /usr/lib/libxcb.so.1.1.0
00246000-00260000 r-xp 00000000 08:06 4687 /lib/libgcc_s.so.1
00260000-00261000 r--p 00019000 08:06 4687 /lib/libgcc_s.so.1
00261000-00262000 rw-p 0001a000 08:06 4687 /lib/libgcc_s.so.1
00317000-00319000 r-xp 00000000 08:06 5485 /usr/lib/libXau.so.6.0.0
00319000-0031a000 r--p 00001000 08:06 5485 /usr/lib/libXau.so.6.0.0
0031a000-0031b000 rw-p 00002000 08:06 5485 /usr/lib/libXau.so.6.0.0
003fc000-003fd000 r-xp 00000000 00:00 0 [vdso]
004a3000-004b8000 r-xp 00000000 08:06 13587 /lib/libpthread-2.12.1.so
004b8000-004b9000 ---p 00015000 08:06 13587 /lib/libpthread-2.12.1.so
004b9000-004ba000 r--p 00015000 08:06 13587 /lib/libpthread-2.12.1.so
004ba000-004bb000 rw-p 00016000 08:06 13587 /lib/libpthread-2.12.1.so
004bb000-004bd000 rw-p 00000000 00:00 0
00507000-0050b000 r-xp 00000000 08:06 29834 /usr/lib/libXdmcp.so.6.0.0
0050b000-0050c000 r--p 00003000 08:06 29834 /usr/lib/libXdmcp.so.6.0.0
0050c000-0050d000 rw-p 00004000 08:06 29834 /usr/lib/libXdmcp.so.6.0.0
0063f000-006ec000 r-xp 00000000 08:06 43491 /usr/lib/libtcl8.4.so.0
006ec000-006ed000 r--p 000ac000 08:06 43491 /usr/lib/libtcl8.4.so.0
006ed000-006f1000 rw-p 000ad000 08:06 43491 /usr/lib/libtcl8.4.so.0
006f1000-006f2000 rw-p 00000000 00:00 0
0070a000-00726000 r-xp 00000000 08:06 11676 /lib/ld-2.12.1.so
00726000-00727000 r--p 0001b000 08:06 11676 /lib/ld-2.12.1.so
00727000-00728000 rw-p 0001c000 08:06 11676 /lib/ld-2.12.1.so
008f8000-0091c000 r-xp 00000000 08:06 13563 /lib/libm-2.12.1.so
0091c000-0091d000 r--p 00023000 08:06 13563 /lib/libm-2.12.1.so
0091d000-0091e000 rw-p 00024000 08:06 13563 /lib/libm-2.12.1.so
00a72000-00b47000 r-xp 00000000 08:06 22470 /usr/lib/libtk8.4.so.0
00b47000-00b48000 r--p 000d4000 08:06 22470 /usr/lib/libtk8.4.so.0
00b48000-00b53000 rw-p 000d5000 08:06 22470 /usr/lib/libtk8.4.so.0
00b53000-00b54000 rw-p 00000000 00:00 0
00e4b000-00fa2000 r-xp 00000000 08:06 13549 /lib/libc-2.12.1.so
00fa2000-00fa3000 ---p 00157000 08:06 13549 /lib/libc-2.12.1.so
00fa3000-00fa5000 r--p 00157000 08:06 13549 /lib/libc-2.12.1.so
00fa5000-00fa6000 rw-p 00159000 08:06 13549 /lib/libc-2.12.1.so
00fa6000-00fa9000 rw-p 00000000 00:00 0
08048000-08049000 r-xp 00000000 08:06 22469 /usr/bin/wish8.4
08049000-0804a000 r--p 00000000 08:06 22469 /usr/bin/wish8.4
0804a000-0804b000 rw-p 00001000 08:06 22469 /usr/bin/wish8.4
09984000-09a75000 rw-p 00000000 00:00 0 [heap]
b6c25000-b6c5f000 rw-p 00000000 00:00 0
b6cfd000-b6d04000 r--s 00000000 08:06 20092 /usr/lib/gconv/gconv-modules.cache
b6d04000-b6d05000 r--p 00404000 08:06 5960 /usr/lib/locale/locale-archive
b6d05000-b6d45000 r--p 00299000 08:06 5960 /usr/lib/locale/locale-archive
b6d45000-b6f45000 r--p 00000000 08:06 5960 /usr/lib/locale/locale-archive
b6f45000-b6f46000 ---p 00000000 00:00 0
b6f46000-b774a000 rw-p 00000000 00:00 0
b7765000-b7767000 rw-p 00000000 00:00 0
bfe97000-bfeb8000 rw-p 00000000 00:00 0 [stack]
Aborted

ProblemType: Bug
DistroRelease: Ubuntu 11.04
Package: gitk 1:1.7.2.3-2.1
ProcVersionSignature: Ubuntu 2.6.37-7.18-generic 2.6.37-rc3
Uname: Linux 2.6.37-7-generic i686
Architecture: i386
Date: Wed Dec 1 10:51:23 2010
PackageArchitecture: all
ProcEnviron:
 PATH=(custom, user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: git

Related branches

lp:ubuntu/natty/tcl8.4
Revision history for this message
David Kastrup (dak) wrote :
Revision history for this message
David Kastrup (dak) wrote :

Seems this info got lost in the report:

gitk crashes on startup in a directory with a git repository.

Revision history for this message
David Kastrup (dak) wrote :

Just figured out that merely starting

wish

without further command line arguments triggers a similar bug. So this is likely a bug in wish (likely provided by tk).

Loïc Minier (lool)
Changed in git (Ubuntu):
status: New → Confirmed
importance: Undecided → High
Revision history for this message
Loïc Minier (lool) wrote :

(I think this is rather a tcl bug)

wish8.4 crashes but wish8.5 doesn't; the error seems to be exposed by a recent rebuild with the latest toolchain which has "stack protector" enabled by default.

tcl8.4's latest release was in 2008, so I'm not sure how sensible it is to invest in fixing it. Instead we should rather move to 8.5 (in fact, tcl8.6 betas are available upstream), but there are 96 source packages build-depending on tcl8.4 explicitly. :-/

I guess we still need to fix tcl8.4.

Revision history for this message
Loïc Minier (lool) wrote :

Problem is this struct in generic/tclCmdMZ.c:
typedef struct {
    int flags; /* Operations for which Tcl command is
                                 * to be invoked. */
    size_t length; /* Number of non-NULL chars. in command. */
    char command[4]; /* Space for Tcl command to invoke. Actual
                                 * size will be as large as necessary to
                                 * hold command. This field must be the
                                 * last in the structure, so that it can
                                 * be larger than 4 bytes. */
} TraceVarInfo;

it defines command with length 4, but in reality more bytes are allocated:
typedef struct {
    VarTrace trace;
    TraceVarInfo tvar;
} CompoundVarTrace;
[...]
                CompoundVarTrace *compTracePtr;
[...]
                compTracePtr = (CompoundVarTrace *) ckalloc((unsigned)
                        (sizeof(CompoundVarTrace) - sizeof(tvarPtr->command)
                                + length + 1));

but the strcpy() call doesn't know about that:
                tvarPtr = &(compTracePtr->tvar);
[...]
                strcpy(tvarPtr->command, command);

so strcpy_chk thinks that the destination buffers is 4 bytes long, but it's called with larger source strings at runtime, e.g. "::tk::EventMotifBindings".

One way to avoid this would be to declare command[] with the maximum size a variable name can have, but I couldn't find this limit in the tcl source code.

For now, I'm going to patch the build to pass -U_FORTIFY_SOURCE.

This doesn't happen in tcl8.5, and it's a false positive, not sure how useful it is to chase this down.

Loïc Minier (lool)
affects: git (Ubuntu) → tcl8.4 (Ubuntu)
summary: - gitk crashes on start
+ buffer overflow detected
Revision history for this message
Loïc Minier (lool) wrote :

Lowering severity as I've uploaded a workaround, but keeping the bug open in case we have a real fix.

Changed in tcl8.4 (Ubuntu):
importance: High → Medium
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package tcl8.4 - 8.4.19-4ubuntu2

---------------
tcl8.4 (8.4.19-4ubuntu2) natty; urgency=low

  * Update patch fortify-source to use a cleaner fix from upstream (use memcpy
    instead of strcpy); see SF #3127687; LP: #683546.
 -- Loic Minier <email address hidden> Mon, 06 Dec 2010 01:27:25 +0100

Changed in tcl8.4 (Ubuntu):
status: Confirmed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.