[bug #59870] Segmentation Fault on GNU

[Dmitry Goncharov]

Follow-up Comment #1, bug #59870 (project make):

Here is a patch.
i am not adding a test, because there is a commented out test 19 in
targetvars, which expects different behavior.
Thank you for your report and the test case.


diff --git a/src/read.c b/src/read.c
index 545514c..11ef748 100644
--- a/src/read.c
+++ b/src/read.c
@@ -1802,10 +1802,11 @@ record_target_var (struct nameseq *filenames, char
*defn,
   /* Get a reference for this pattern-specific variable struct.  */
   p = create_pattern_var (name, percent);
   p->variable.fileinfo = *flocp;
-  /* I don't think this can fail since we already determined it was
a
- variable definition.  */
+  /* Could be a variable definition or %:define or %:undefine.
+ sv 59870.  */
   v = assign_variable_definition (&p->variable, defn);
-  assert (v != 0);
+  if (!v)
+O (fatal, flocp, _("Malformed pattern-specific variable
definition"));
 
   v->origin = origin;
   if (v->flavor == f_simple)


___

Reply to this item at:

  

___
  Message sent via Savannah
  https://savannah.gnu.org/

src/job.c:... error: too few arguments to function 'find_in_given_path'

[Bjarni Ingi Gislason]

  Error message:

src/job.c: In function 'child_execute_job':
src/job.c:2394:19: error: too few arguments to function 'find_in_given_path'
 2394 | cmd = (char *)find_in_given_path (argv[0], p, 0);
  |   ^~

  The number of arguments was changed to be four in GnuLib file 
"lib/findprog-in.c":

2019-09-09 20:46:44 +0200  75) find_in_given_path (const char *progname, const 
char *path,
2020-12-14 20:56:04 +0100  76) const char *directory, bool 
optimize_for_exec)


Warnings:

In file included from src/job.c:17:
src/makeint.h:512:1: warning: function declaration isn't a prototype 
[-Wstrict-prototypes]
  512 | void out_of_memory () NORETURN;
  | ^~~~
src/makeint.h:678:15: warning: redundant redeclaration of 'environ' 
[-Wredundant-decls]
  678 | extern char **environ;
  |   ^~~
In file included from lib/unistd.h:40,
 from src/makeint.h:124,
 from src/job.c:17:
/usr/include/unistd.h:545:15: note: previous declaration of 'environ' was here
  545 | extern char **environ;
  |   ^~~
src/job.c:218:5: warning: redundant redeclaration of 'getloadavg' 
[-Wredundant-decls]
  218 | int getloadavg (double loadavg[], int nelem);
  | ^~
In file included from lib/stdlib.h:36,
 from src/makeint.h:256,
 from src/job.c:17:
/usr/include/stdlib.h:1003:12: note: previous declaration of 'getloadavg' was 
here
 1003 | extern int getloadavg (double __loadavg[], int __nelem)
  |^~
src/job.c: In function 'child_handler':
src/job.c:599:20: warning: unused parameter 'sig' [-Wunused-parameter]
  599 | child_handler (int sig UNUSED)
  |^~~
src/job.c: In function 'child_execute_job':
src/job.c:2394:19: error: too few arguments to function 'find_in_given_path'
 2394 | cmd = (char *)find_in_given_path (argv[0], p, 0);
  |   ^~
In file included from src/job.c:141:
lib/findprog.h:68:20: note: declared here
   68 | extern const char *find_in_given_path (const char *progname, const char 
*path,
  |^~
src/job.c: In function 'construct_command_argv_internal':
src/job.c:2686:52: warning: unused parameter 'batch_filename' 
[-Wunused-parameter]
 2686 |  int flags, char **batch_filename 
UNUSED)
  | ~~~^~

-- 
Bjarni I. Gislason

[bug #59870] Segmentation Fault on GNU

[Fabian Helfert]

URL:
  

 Summary: Segmentation Fault on GNU
 Project: make
Submitted by: fabse333
Submitted on: Thu 14 Jan 2021 09:45:21 AM UTC
Severity: 3 - Normal
  Item Group: Bug
  Status: None
 Privacy: Public
 Assigned to: None
 Open/Closed: Open
 Discussion Lock: Any
   Component Version: SCM
Operating System: POSIX-Based
   Fixed Release: None
   Triage Status: None

___

Details:

The attached makefile will cause a Segmentation fault on GNU make 4.2 on
Debian and also when building the newest newest version from the GitHub
mirror.

The issue is that in the method "record_target_var" in read.c, the function
"assign_variable_definition" (see
https://github.com/mirror/make/blob/4.2/read.c#L1864  ) returns 0 on this
MAKEFILE. Even when the Comment states "I don't think this can fail,...". ;-)
While this return value is checked with an assert statement, the asserts are
not included on release builds (e.g. the one I have installed on my Debian 10
Buster). Assert can also be disabled by setting the DNDEBUG Cflag on the
./configure command for local testing:
./configure CFLAGS="-g -DNDEBUG"

The segmentation fault is then an exception when this instruction is executed
where RDX is set to 0:
movzx  eax, byte ptr [rdx + 0x2f]
This should correspond to this line where the origin field of v is accessed:
https://github.com/mirror/make/blob/4.2/read.c#L1867

Steps to reproduce:
* make -f MAKEFILE

I don't see any security concerns related with this bug, so I set Privacy of
this ticket to Public.



___

File Attachments:


---
Date: Thu 14 Jan 2021 09:45:21 AM UTC  Name: MAKEFILE  Size: 8B   By: fabse333



___

Reply to this item at:

  

___
  Message sent via Savannah
  https://savannah.gnu.org/