Ubuntu
patch package

patch -pq throws segfault

Bug #1306412 reported by Ari Hyttinen on 2014-04-11

This bug affects 2 people

	Status	Importance	Assigned to	Milestone
patch (Debian)	Fix Released	Unknown	debbugs #742470
patch (Ubuntu)	Fix Released	Low	Unassigned
Trusty	Fix Released	Low	Brian Murray	Ubuntu trusty-updates

Bug Description

[Impact]
patch crashes when -p option is given non-number. Output when running with:

~/src/patch-2.7.1$ gdb --args src/patch -pq

(gdb) run
Starting program: /home/user/src/patch-2.7.1/src/patch -pq
/home/user/src/patch-2.7.1/src/patch: **** strip count q is not a number

Program received signal SIGSEGV, Segmentation fault.
gl_list_iterator_inline (list=0x0) at ../lib/gl_list.h:762
762 ->iterator (list);
(gdb)

[Test Case]
patch -pq

[Regression Potential]
Just in Utopic. Add if clause.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: patch 2.7.1-4
ProcVersionSignature: Ubuntu 3.13.0-19.40-generic 3.13.6
Uname: Linux 3.13.0-19-generic x86_64
ApportVersion: 2.14.1-0ubuntu2
Architecture: amd64
CurrentDesktop: LXDE
Date: Fri Apr 11 10:12:15 2014
Dependencies:
gcc-4.9-base 4.9-20140406-0ubuntu1
libc6 2.19-0ubuntu4
libgcc1 1:4.9-20140406-0ubuntu1
multiarch-support 2.19-0ubuntu4
InstallationDate: Installed on 2014-04-07 (3 days ago)
InstallationMedia: Lubuntu 14.04 LTS "Trusty Tahr" - Beta amd64 (20140326)
SourcePackage: patch
UpgradeStatus: No upgrade log present (probably fresh install)

See original description

Tags:

Related branches

lp:~jamesodhunt/ubuntu/trusty/patch/bug-1306412

Rejected for merging into lp:ubuntu/trusty/patch

Ubuntu branches: Pending requested 2014-05-01

lp:ubuntu/trusty-proposed/patch

Revision history for this message

Ari Hyttinen (ari-hyttinen-gmail) wrote on 2014-04-11:

ProcEnviron.txt Edit (316 bytes, text/plain; charset="utf-8")

Revision history for this message

Ari Hyttinen (ari-hyttinen-gmail) wrote on 2014-04-11:

I didn't think this as security vulnerability, but on 2nd thought, I could see how a bug in patch could be expoited to introduce unintended changes along with an innocent patch.

Revision history for this message

James Hunt (jamesodhunt) wrote on 2014-04-11:

patch-bug-1306412.diff Edit (431 bytes, text/plain)

A fix for this issue is attached - the cleanup() function calls forget_output_files(), even if the list that stores those files is never created.

Changed in patch (Ubuntu):
status:	New → Triaged

Ubuntu Foundations Team Bug Bot (crichton) on 2014-04-11

tags:

added: patch

Brian Murray (brian-murray) on 2014-04-11

Changed in patch (Ubuntu Trusty):
importance:	Undecided → Low
milestone:	none → trusty-updates

Bug Watch Updater (bug-watch-updater) on 2014-04-12

Changed in patch (Debian):
status:	Unknown → New

Revision history for this message

James Hunt (jamesodhunt) wrote on 2014-04-14:

Patch forwarded to Debian.

Bug Watch Updater (bug-watch-updater) on 2014-04-15

Changed in patch (Debian):
status:	New → Fix Released

Revision history for this message

Scaramanga (scaramanga) wrote on 2014-04-15:

Tested patch in comment #3. Package "patch" no longer segfaults with '-pq'.

Running Xubuntu 14.04.

Scaramanga (scaramanga) on 2014-05-01

tags:

added: patch-test-passed

Brian Murray (brian-murray) on 2014-05-01

Changed in patch (Ubuntu):
milestone:	trusty-updates → none
status:	Triaged → Fix Released
Changed in patch (Ubuntu Trusty):
assignee:	nobody → Brian Murray (brian-murray)
status:	Triaged → In Progress

Revision history for this message

Chris J Arges (arges) wrote on 2014-05-05:

Please work on getting this patch upstream and in debian.

description:

updated

Revision history for this message

Chris J Arges (arges) wrote on 2014-05-05: Please test proposed package

Hello Ari, or anyone else affected,

Accepted patch into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/patch/2.7.1-4ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in patch (Ubuntu Trusty):
status:	In Progress → Fix Committed
tags:	added: verification-needed

Revision history for this message

Doug McMahon (mc3man) wrote on 2014-05-08:

2.7.1-4ubuntu1 doesn't segfault

tags:

added: verification-done
removed: verification-needed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-05-13:

This bug was fixed in the package patch - 2.7.1-4ubuntu1

---------------
patch (2.7.1-4ubuntu1) trusty-proposed; urgency=low

[ James Hunt <email address hidden> ]
* Fix segfault due to incorrect usage (LP: #1306412).
-- Brian Murray <email address hidden> Thu, 01 May 2014 09:24:26 -0700

Changed in patch (Ubuntu Trusty):
status:	Fix Committed → Fix Released

Revision history for this message

Adam Conrad (adconrad) wrote on 2014-05-13: Update Released

#10

The verification of the Stable Release Update for patch has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.