Debian Bug report logs - #1024635
dash: segfaults during runtime when executing a script with invalid syntax

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Christoph Anton Mitterer <calestyo@scientia.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: dash: segfaults during runtime when executing a script with invalid syntax

Date: Tue, 22 Nov 2022 14:54:34 +0100

Package: dash
Version: 0.5.11+git20210903+057cd650a4ed-9
Severity: normal
Tags: upstream
Control: forwarded -1 https://lore.kernel.org/dash/b2e298215b3d51d8284296484caa138faddaa0e4.camel@scientia.org/


Hey.

I've already forwarded this upstream, but there doesn't seem to be any
bug tracker, so report it here in addition, to keep some records until
it is fixed.


Cheers,
Chris.



I found the following issue by chance, when converting a shell
script[0] from bash to POSIX sh (well that + the use of "local"):

Below is a strongly reduced version of [0] which still causes the
error:
-------------------------------------------------------------------
#!/bin/sh


reject_and_die()
{
    exit 1
}


reject_filtered_cmd()
{
    reject_and_die "disallowed command${restrict_path_list:+ (restrict-path: \"${restrict_path_list//|/\", \"}\")}"
}

reject_filtered_cmd
-------------------------------------------------------------------

As you can see, I missed one bashism, namely the
${parameter//pattern/string} form of parameter expansion.


Now executing this with dash:
$ dpkg -l dash | grep ^ii
ii  dash           0.5.11+git20210903+057cd650a4ed-9 amd64        POSIX-compliant shell
$ dash ssh_filter_btrbk.sh
Segmentation fault
$

With kernel log:
Nov 21 03:31:37 heisenberg kernel: dash[145217]: segfault at 1 ip 000055fa32ef8cd4 sp 00007ffd79a75140 error 4 in dash[55fa32ef3000+13000]
Nov 21 03:31:37 heisenberg kernel: Code: e2 01 4c 8d 34 42 48 8d 05 61 d9 00 00 49 01 c6 89 f0 83 e0 02 89 85 fc fe ff ff 74 17 c7 85 fc fe ff ff 00 00 00 00 83 e3 fd <41> 80 3f 7e 0f 84 c2 05 00 00 48 8b 35 8b 58 01 00 48 8b 05 5c 53


Shouldn't that rather give some parsing error?



One some other system (where I cannot really test any further since I
have no root) it even may have caused some more:
[10527194.157467] ssh_filter_btrb[816610]: segfault at 0 ip 000055c8ac34a698 sp 00007ffd4a997080 error 4 in dash[55c8ac344000+13000]
[10527194.157482] Code: 85 c4 01 00 00 48 83 c4 68 4c 89 f8 5b 5d 41 5c 41 5d 41 5e 41 5f c3 0f 1f 00 48 83 c2 02 eb a2 66 90 4c 89 fa 4d 85 f6 78 98 <48> 8b 36 bf 01 00 00 00 eb 8e 66 0f 1f 44 00 00 0f b6 42 01 48 83
[10527195.790531] traps: pool-tracker-st[816482] trap int3 ip:7f94e8271295 sp:7f94deffc770 error:0 in libglib-2.0.so.0.6400.6[7f94e8235000+84000]

Not sure whether that traps is in anyway related or just some
coincidence.



Thanks,
Chris.


[0] https://github.com/digint/btrbk/blob/master/ssh_filter_btrbk.sh

Message #12 received at 1024635@bugs.debian.org (full text, mbox, reply):

From: Christoph Anton Mitterer <calestyo@scientia.org>

To: 1024635@bugs.debian.org

Subject: Re: dash: segfaults during runtime when executing a script with invalid syntax

Date: Thu, 24 Nov 2022 06:18:11 +0100

Just for the records, the same issue (as well as some other variant)
also exists in other ash bashed shells:

klibc:
https://lists.zytor.com/archives/klibc/2022-November/004694.html
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024735

busybox:
http://lists.busybox.net/pipermail/busybox/2022-November/090036.html


Cheers,
Chris.

Message #17 received at 1024635@bugs.debian.org (full text, mbox, reply):

From: Christoph Anton Mitterer <calestyo@scientia.org>

To: 1024635@bugs.debian.org

Subject: Re: dash: segfaults during runtime when executing a script with invalid syntax

Date: Wed, 07 Dec 2022 05:55:55 +0100

Control: tags -1 + patch

Hey.

For the records:

A patch (for dash) was posted at:
https://lore.kernel.org/dash/Y47ZlpwkQy+jiule@gondor.apana.org.au/
and is scheduled to be merged into upstream’s git.


Cheers,
Chris.

Message #24 received at 1024635@bugs.debian.org (full text, mbox, reply):

From: Christoph Anton Mitterer <calestyo@scientia.org>

To: 1024635@bugs.debian.org

Subject: Re: klibc-utils: klibc sh segfault on invalid substitutions

Date: Wed, 07 Dec 2022 06:07:19 +0100

Just for the records, meanwhile I've also opened a proper ticket about
this over at BusyBox regarding the same bug in their sh at:

https://bugs.busybox.net/show_bug.cgi?id=15171

Message #29 received at 1024635@bugs.debian.org (full text, mbox, reply):

From: Christoph Anton Mitterer <calestyo@scientia.org>

To: 1024635@bugs.debian.org

Subject: Re: dash: segfaults during runtime when executing a script with invalid syntax

Date: Wed, 07 Dec 2022 16:47:23 +0100

The first patch seems to have been buggy, a v2 was posted:
https://lore.kernel.org/dash/Y5BTWr28NgVMm8UG@gondor.apana.org.au/

Cheers,
Chris.

Message #34 received at 1024635@bugs.debian.org (full text, mbox, reply):

From: наб <nabijaczleweli@nabijaczleweli.xyz>

To: 1024635@bugs.debian.org

Cc: Christoph Anton Mitterer <calestyo@scientia.org>

Subject: Re: Bug#1024635: dash: segfaults during runtime when executing a script with invalid syntax

Date: Wed, 14 Dec 2022 06:09:21 +0100

[Message part 1 (text/plain, inline)]

Control: tags -1 + upstream fixed-upstream

The patch referenced above has landed as
  https://git.kernel.org/pub/scm/utils/dash/dash.git/commit/?id=f0d57fded5b1a4b0aa6f0571a316cb9482ef3af8
which was subsequently tagged as v0.5.12.

I can independently confirm that upstream dash 0.5.12
doesn't suffer from this bug.

наб

[signature.asc (application/pgp-signature, inline)]

Message #41 received at 1024635-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1024635-close@bugs.debian.org

Subject: Bug#1024635: fixed in dash 0.5.12-1

Date: Thu, 05 Jan 2023 13:19:14 +0000

Source: dash
Source-Version: 0.5.12-1
Done: Andrej Shadura <andrewsh@debian.org>

We believe that the bug you reported is fixed in the latest version of
dash, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1024635@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura <andrewsh@debian.org> (supplier of updated dash package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 05 Jan 2023 14:06:02 +0100
Source: dash
Architecture: source
Version: 0.5.12-1
Distribution: unstable
Urgency: medium
Maintainer: Andrej Shadura <andrewsh@debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Closes: 558607 819829 850202 975326 1017531 1024635
Changes:
 dash (0.5.12-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #1017531, #1024635).
   * Refresh patches.
   * Apply upstream patches for hash, ulimit and manpages
     (Closes: #558607, #819829, #850202, #975326).
Checksums-Sha1:
 97cd1d5275fe8d1f81c036d7c998133674c07f25 1520 dash_0.5.12-1.dsc
 e15444a93853f693774df003f87d9040ab600a5e 246054 dash_0.5.12.orig.tar.gz
 1dd0eee42af5fd7ead7de85a79a9a8699bc5bc13 38520 dash_0.5.12-1.debian.tar.xz
Checksums-Sha256:
 0861850b279fdcd8ff6740e4813896f2ad20365b5995ef175e7d18f6122633c1 1520 dash_0.5.12-1.dsc
 6a474ac46e8b0b32916c4c60df694c82058d3297d8b385b74508030ca4a8f28a 246054 dash_0.5.12.orig.tar.gz
 b022cf6c89c9312fe57e9a767390f022b4dbedb5f6541c06f6a8b20187a3da61 38520 dash_0.5.12-1.debian.tar.xz
Files:
 0f4256c25db24c637966edb041f35fac 1520 shells optional dash_0.5.12-1.dsc
 57222b768b84003ea4b801e5d5e0e52b 246054 shells optional dash_0.5.12.orig.tar.gz
 4b932e195cf79623b4895b3f9a3ae0ff 38520 shells optional dash_0.5.12-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCY7bLcgAKCRDoRGtKyMdy
Ybj4AQDGyhSiHNJ+NT4Tq3TN1OImwvvVhfbyPaaUpOiSq19v3AD/YdpLQHB6Ju7W
/UrNXSUeUsP4ijKpbWe4JYF37hn18Aw=
=uLUG
-----END PGP SIGNATURE-----

Message #46 received at 1024635-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 1024635-close@bugs.debian.org

Subject: Bug#1024635: fixed in dash 0.5.12-2

Date: Thu, 05 Jan 2023 13:35:08 +0000

Source: dash
Source-Version: 0.5.12-2
Done: Andrej Shadura <andrewsh@debian.org>

We believe that the bug you reported is fixed in the latest version of
dash, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1024635@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Andrej Shadura <andrewsh@debian.org> (supplier of updated dash package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Thu, 05 Jan 2023 14:20:48 +0100
Source: dash
Architecture: source
Version: 0.5.12-2
Distribution: unstable
Urgency: medium
Maintainer: Andrej Shadura <andrewsh@debian.org>
Changed-By: Andrej Shadura <andrewsh@debian.org>
Closes: 558607 819829 975325 975326 1017531 1024635
Changes:
 dash (0.5.12-2) unstable; urgency=medium
 .
   * Fix the changelog entry.
 .
 dash (0.5.12-1) unstable; urgency=medium
 .
   * New upstream release (Closes: #1017531, #1024635).
   * Refresh patches.
   * Apply upstream patches for hash, ulimit and manpages
     (Closes: #558607, #819829, #975325, #975326).
Checksums-Sha1:
 fa572b2b5f629af9618ea08693bb83b93a4cba7a 1520 dash_0.5.12-2.dsc
 3d892a207a28afa4894296c76c0a3c322b892a6a 38512 dash_0.5.12-2.debian.tar.xz
Checksums-Sha256:
 25c0fb805c735fdb7470ce485ce76dae1a7b6c04efdfb0fdac5eab921cbd78a5 1520 dash_0.5.12-2.dsc
 bddd9129215eb60f4cc43a0ffdcc42d8f25e0bd09730520d599a2b7bc492e375 38512 dash_0.5.12-2.debian.tar.xz
Files:
 c9bc18de18ef1473455b481ab1a8ede1 1520 shells optional dash_0.5.12-2.dsc
 54efe6439b0ddae0eef83f6635609371 38512 shells optional dash_0.5.12-2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iHUEARYIAB0WIQSD3NF/RLIsyDZW7aHoRGtKyMdyYQUCY7bPAgAKCRDoRGtKyMdy
YUbYAP9x9er7SC0J4zeO9pEB6EC9zxkn/7M+RsJKGxvaOThO5AEA5wu2PSI1YsM3
2cEheyy8EPzWh7FhHyJ+o01jXk8WKgg=
=FOGH
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.