Opened 13 years ago

Closed 13 years ago

#2616 closed bug (fixed)

parsedate() with an invalid time value seesm to create stack corruption.

Reported by: bga Owned by: axeld
Priority: high Milestone: R1/alpha1
Component: System/ Version: R1/pre-alpha1
Keywords: Cc:
Blocked By: Blocking:
Platform: All


I have this email on my account that when parsed by MDR crashes it. More specifically, it crashes in parsedate(). I was able to determine that preparseDate() errors out (more specifically here:

		// if we're reached our maximum number of elements, bail out
		if (index >= MAX_ELEMENTS)
			return B_ERROR;

Then parsedate_etc() catched the error and return it to parsedate():

	if (preparseDate(dateString, elements) < B_OK) {
		return B_ERROR;

This was supposed to return to parsedate() which would in turn return the error but it never actually returns. To be sure I changed parsedate() to:

parsedate(const char *dateString, time_t now)
	int flags = 0;
	printf("calling parsedate_etc()\n");
	time_t result = parsedate_etc(dateString, now, &flags);
	printf("returned from parsedate_etc()\n");
	return result;

The second printf is never printed.

I get a segfault and the following useless stack crawl on gdb:

[Switching to team /system/servers/mail_daemon (5651) thread BGA(BUG-Br) (5659)]
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()

The emails that causes this is attached. Note the problem is its "Date" header line.

Attachments (1)

0)... (1.2 KB ) - added by bga 13 years ago.
Crashing email (check Date header)

Download all attachments as: .zip

Change History (5)

by bga, 13 years ago

Attachment: 0)... added

Crashing email (check Date header)

comment:1 by korli, 13 years ago

You might want to add your testcase in src/tests/system/libroot/os/ParseDateTest.cpp.

comment:2 by bga, 13 years ago

Added the test case with hrev27003. Again, gdb is useless to debug this due to the stack corruption.

comment:3 by axeld, 13 years ago

Milestone: R1R1/alpha1
Status: newassigned

comment:4 by axeld, 13 years ago

Resolution: fixed
Status: assignedclosed

Thanks for the nice test case! Fixed in hrev27006.

Note: See TracTickets for help on using tickets.