Ubuntu
mmv package

[SRU] mmv aborts with realloc(): invalid pointer

Bug #2044264 reported by Jacopo Corbetta on 2023-11-22

This bug affects 1 person

	Status	Importance	Assigned to
mmv (Debian)	Fix Released	Unknown	debbugs #1042020
mmv (Ubuntu)	Fix Released	Undecided	Unassigned
Mantic	Fix Released	Undecided	Unassigned

Bug Description

[ Impact ]

mmv is completely unusable if the user tries to use mmv with more than 9 files. It will result in a coredump as it will try to use an invalid pointer.

[ Test Plan ]

The following commands will use mmv to rename files.

* mkdir -p test
* cd test
* touch `seq 1 10`
* mmv '*' '#1.o'

If the package is not fixed then the above commands will result in a coredump with the error:

realloc(): invalid pointer
Aborted (core dumped)

With the fixed package the above command will rename the files with .o extension.

[ Where problems could occur ]

The latest version of gnulib is using realloc() after the multiplication overflow check which has been backported here, so there should not be any regression here.
The realloc part of the code will only be used if the number of files is more than 9 and mmv is already unusable in that scenario.

[ Other Info ]

* upstream has already reverted the change and is using an older version of gnulib, so the next mmv versions are not affected.
* The patch has not been sent upsteam as the gnulib code is correct, the problem was in the way mmv upstream has configured gnulib.

[ Original Bug Description ]

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1042020

Can you please import the fix?

See original description

Tags:

Revision history for this message

Sudip Mukherjee (sudipmuk) wrote on 2024-01-16:

This has been fixed in 2.5.1-1, so Noble is unaffected. I have tested Noble and confirmed that the issue is not seen. I can reproduce the issue in Mantic.
Have also tested Lunar and confirmed that the issue is not seen.

tags:

added: mantic

Sudip Mukherjee (sudipmuk) on 2024-01-16

Changed in mmv (Ubuntu):
status:	New → Fix Released
Changed in mmv (Ubuntu Mantic):
status:	New → In Progress
assignee:	nobody → Sudip Mukherjee (sudipmuk)

Bug Watch Updater (bug-watch-updater) on 2024-01-16

Changed in mmv (Debian):
status:	Unknown → Fix Released

Revision history for this message

Sudip Mukherjee (sudipmuk) wrote on 2024-01-17 (last edit on 2024-01-17):

I had a look at this today and upstream fix for this issue is https://github.com/rrthomas/mmv/commit/5b13bd738cb1e02fcf2ceb7a18418adfb72c1e2c and that was the only change which went in 2.5.1. The mmv package has its own copy of gnulib library and the commit resulted in a huge diff stat betwen Debian packages 2.5-1 and 2.5.1-1 as the embedded copy of gnulib in "lib" folder was reverted to old version.

imho, that big change is not suitable for SRU and Mantic not being a LTS release, a backport of 2.5.1-1 is also not possible.

Changed in mmv (Ubuntu Mantic):
assignee:	Sudip Mukherjee (sudipmuk) → nobody
status:	In Progress → Confirmed

Revision history for this message

Sudip Mukherjee (sudipmuk) wrote on 2024-01-17:

diffstat Edit (16.2 KiB, text/plain)

diffstat attached for reference,

Sudip Mukherjee (sudipmuk) on 2024-01-19

Changed in mmv (Ubuntu Mantic):
status:	Confirmed → In Progress
assignee:	nobody → Sudip Mukherjee (sudipmuk)

Revision history for this message

Sudip Mukherjee (sudipmuk) wrote on 2024-01-19:

mmv_mantic.debdiff Edit (2.0 KiB, text/plain)

debdiff for Mantic attached.

summary:	- mmv aborts with realloc(): invalid pointer + [SRU] mmv aborts with realloc(): invalid pointer
description:	updated
Changed in mmv (Ubuntu Mantic):
status:	In Progress → Confirmed
assignee:	Sudip Mukherjee (sudipmuk) → nobody

Revision history for this message

Dave Jones (waveform) wrote on 2024-01-22:

Confirmed issue on mantic only, and I agree the gnulib fix is overly complex for a mantic SRU. The proposed fix looks minimal and reasonable (and is nicely in keeping with the rest of the unit, using the ckd_ function for mul). Sponsoring for mantic (with minor change for maintainer address in d/control now there's an ubuntu component in the version).

Revision history for this message

Chris Halse Rogers (raof) wrote on 2024-01-24: Please test proposed package

Hello Jacopo, or anyone else affected,

Accepted mmv into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/mmv/2.5-1ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in mmv (Ubuntu Mantic):
status:	Confirmed → Fix Committed
tags:	added: verification-needed verification-needed-mantic

Revision history for this message

Jacopo Corbetta (jacopo-arc) wrote on 2024-01-24:

I tried it, looks good to me! Thanks for porting the fix.

tags:

added: verification-done-mantic
removed: verification-needed-mantic

Revision history for this message

Robie Basak (racb) wrote on 2024-01-31:

Thank you for your report!

But please could someone verify that they followed the Test Plan specifically, report whether that passes or not and the version tested? Otherwise I don't if I'm releasing something that might have a problem that would be revealed by the agreed Test Plan. Once done, please flip the tags back. Thanks!

tags:

added: verification-needed-mantic
removed: verification-done-mantic

Revision history for this message

Jacopo Corbetta (jacopo-arc) wrote on 2024-01-31:

Hello Robie,

I can confirm I followed the test plan above and that it worked correctly.

Version: 2.5-1ubuntu0.1

$ sha256sum /usr/bin/mmv
12ca27c233194b3a754fbc41d99de7672d2847fb604e7f77e88eff76359ac8ce /usr/bin/mmv

Hope it helps, let me know if I should do something else. I'll flip the tags again, but please let me know if someone else should do it.

tags:

added: verification-done-mantic
removed: verification-needed-mantic

Revision history for this message

Launchpad Janitor (janitor) wrote on 2024-02-01:

#10

This bug was fixed in the package mmv - 2.5-1ubuntu0.1

---------------
mmv (2.5-1ubuntu0.1) mantic; urgency=medium

* Add changes from gnulib reallocarray to fix an invalid pointer when
using mmv with more than 9 files. (LP: #2044264)

-- Sudip Mukherjee <email address hidden> Fri, 19 Jan 2024 21:16:45 +0000

Changed in mmv (Ubuntu Mantic):
status:	Fix Committed → Fix Released

Revision history for this message

Andreas Hasenack (ahasenack) wrote on 2024-02-01: Update Released

#11

The verification of the Stable Release Update for mmv has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.