Entering a long, invalid command to the terminal freezes the system

Bug #1605732 reported by Aku Viljanen
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
command-not-found (Ubuntu)
Fix Released
High
Unassigned

Bug Description

If I enter an invalid command that is a few thousand characters long it goes to the command-not-found program, and it starts to look for it in the repositories. This takes up a lot of RAM, and the whole system freezes.

By default, /usr/lib/command-not-found contains these lines:

    if len(args) == 1:
        cnf = CommandNotFound(options.data_dir)
        if not cnf.advise(args[0], options.ignore_installed) and not options.no_failure_msg:
            print(_("%s: command not found") % args[0], file=sys.stderr)

Adding a simple length check is enough to completely solve this problem.

    if len(args) == 1:
        # Fix crashing with long commands
        if len(args[0]) > 50:
            print(_("%s: command not found") % args[0], file=sys.stderr)
        else:
            cnf = CommandNotFound(options.data_dir)
            if not cnf.advise(args[0], options.ignore_installed) and not options.no_failure_msg:
                print(_("%s: command not found") % args[0], file=sys.stderr)

I'm having this issue in Ubuntu 14.04.04 with command-not-found 0.3ubuntu12, but the same code is in 16.10's packages.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: command-not-found 0.3ubuntu12 [modified: usr/lib/command-not-found]
ProcVersionSignature: Ubuntu 4.2.0-42.49~14.04.1-generic 4.2.8-ckt12
Uname: Linux 4.2.0-42-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.21
Architecture: amd64
CurrentDesktop: MATE
Date: Fri Jul 22 19:12:59 2016
PackageArchitecture: all
SourcePackage: command-not-found
UpgradeStatus: No upgrade log present (probably fresh install)

Revision history for this message
Aku Viljanen (akuviljanen17) wrote :
Michael Vogt (mvo)
Changed in command-not-found (Ubuntu):
status: New → In Progress
importance: Undecided → High
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package command-not-found - 0.3ubuntu18.04.0~pre3

---------------
command-not-found (0.3ubuntu18.04.0~pre3) bionic; urgency=medium

  * CommandNotFound/CommandNotFound.py:
    - limit input to 256 chars to avoid DoS (LP: #1605732)
    - add support for suggesting commands snap from snaps
      (needs snapd 2.31+ to work)
    - add "snapd" to suggests

 -- Michael Vogt <email address hidden> Thu, 15 Feb 2018 09:15:40 +0100

Changed in command-not-found (Ubuntu):
status: In Progress → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.