command-not-found crash on inreasonably long input

Bug #1643167 reported by thiner
286
This bug affects 9 people
Affects Status Importance Assigned to Milestone
command-not-found
Fix Released
High
Dominique Ramaekers

Bug Description

Bash itself won't crash on extraordinarily long input, but the little utilitarian tool will.
With the ulimit set in /etc/bash.bashrc, the crash info is graceful as seen below. However, it ended up crashing my computer out. (Actually it took my computer into the pitfall of swap, as I found out later. That means, it consumes too much MEMORY, not cpu time.)
The source code seems as if the spelling error candidates are O(n^2). (Although actually it is, at least.)

Possibly a denial of service attack on computer without good config on ulimit :)

~# `printf '=%.0s' {1..10000}`
Sorry, command-not-found has crashed! Please file a bug report at:
https://bugs.launchpad.net/command-not-found/+filebug
Please include the following information with the report:

command-not-found version: 0.3
Python version: 3.5.2 final 0
Distributor ID: Ubuntu
Description: Ubuntu 16.04.1 LTS
Release: 16.04
Codename: xenial
Exception information:

Traceback (most recent call last):
  File "/usr/lib/python3/dist-packages/CommandNotFound/util.py", line 24, in crash_guard
    callback()
  File "/usr/lib/command-not-found", line 90, in main
    if not cnf.advise(args[0], options.ignore_installed) and not options.no_failure_msg:
  File "/usr/lib/python3/dist-packages/CommandNotFound/CommandNotFound.py", line 267, in advise
    self.print_spelling_suggestion(command)
  File "/usr/lib/python3/dist-packages/CommandNotFound/CommandNotFound.py", line 143, in print_spelling_suggestion
    for w in similar_words(word):
  File "/usr/lib/python3/dist-packages/CommandNotFound/CommandNotFound.py", line 102, in similar_words
    replaces = [a + c + b[1:] for a, b in s for c in alphabet if b]
  File "/usr/lib/python3/dist-packages/CommandNotFound/CommandNotFound.py", line 102, in <listcomp>
    replaces = [a + c + b[1:] for a, b in s for c in alphabet if b]
MemoryError

Related branches

thiner (thiner)
description: updated
Revision history for this message
Dominique Ramaekers (dominique-ramaekers) wrote :

Confirm.
I've tested the command in a lxd-container through ssh. My crash is different but it's clear c-n-f consumes 100% of the physical memory.

I'm looking in to this...

Changed in command-not-found:
status: New → Confirmed
assignee: nobody → Dadio (dominique-ramaekers)
Changed in command-not-found:
status: Confirmed → In Progress
Changed in command-not-found:
importance: Undecided → High
status: In Progress → Fix Committed
Changed in command-not-found:
status: Fix Committed → Fix Released
information type: Private Security → Public Security
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.