Tested the new version in cosmic-proposed on an up-to-date cosmic VM by
inserting a USB drive with the attached autorun.inf and it passes.
Steps to test locally as follows:
1. Enabled cosmic-proposed
2. sudo apt-get dist-upgrade
3. sudo reboot
On next boot with the autorun.inf on a local USB drive:
$ dmesg | grep gvfs
$ apt-cache policy gvfs
gvfs:
Installed: 1.38.1-0ubuntu1.1
Candidate: 1.38.1-0ubuntu1.1
Version table:
*** 1.38.1-0ubuntu1.1 500
500 http://archive.ubuntu.com/ubuntu cosmic-proposed/main amd64 Packages
100 /var/lib/dpkg/status
1.38.0-2ubuntu2 500
500 http://archive.ubuntu.com/ubuntu cosmic/main amd64 Packages
** Tags removed: verification-needed-cosmic
** Tags added: verification-done-cosmic
--
You received this bug notification because you are a member of Desktop
Packages, which is subscribed to gvfs in Ubuntu.
https://bugs.launchpad.net/bugs/1798725
Title:
gvfs may crash when parsing non-valid UTF8 in autorun.inf
Status in gvfs package in Ubuntu:
Fix Released
Status in gvfs source package in Bionic:
Fix Committed
Status in gvfs source package in Cosmic:
Fix Committed
Bug description:
* Impact
gvfs can be made to segfault by being provided an invalid autorun.inf
* Test Case
Use the proof of concept from bellow to generate an invalid
autorun.inf and place it on an usb drive, connect the drive to the
computer, gvfs shouldn't hit a segfault
* Regression potential
Check that the autorun feature keeps working
-----------------------
Reported upstream at https://bugs.exim.org/show_bug.cgi?id=2330 -
libpcre3 can be made to crash when matching the pattern \s*= when the
context is n\xff=
Able to reproduce on current Bionic using the PoC attached (which is
copied directly from the upstream bug report) - in a fresh Bionic VM:
$ sudo apt install build-essential libgtk2.0-dev
$ cd PCRE_PoC
$ ./compilePoC.sh
$ ./PoC
Content:
-------------------
n�=
-------------------
Pattern:
-------------------
\s*=
---------------------
Segmentation fault (core dumped)
Haven't yet tested the second PoC via an external disk autorun.inf and
gvfs-udisks2-volume-monitor.
Also haven't tested in Cosmic / older releases
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/gvfs/+bug/1798725/+subscriptions
--
Mailing list: https://launchpad.net/~desktop-packages
Post to : desktop-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~desktop-packages
More help : https://help.launchpad.net/ListHelp
