[Bug-wget] Segmentation fault in warc_write_digest_headers with ftp URL

[Ivan Kozik]

$ uname -a
Linux sand4 3.8.0-23-generic #34-Ubuntu SMP Wed May 29 20:22:58 UTC
2013 x86_64 x86_64 x86_64 GNU/Linux


$ ./wget/src/wget --version
GNU Wget 1.14.54-9d35f87 built on linux-gnu.

+digest +https +ipv6 -iri +large-file +nls -ntlm +opie +ssl/gnutls

Wgetrc:
    /home/at/wget-git/etc/wgetrc (system)
Locale: /home/at/wget-git/share/locale
Compile: gcc -DHAVE_CONFIG_H -DSYSTEM_WGETRC="/home/at/wget-git/etc/wgetrc"
    -DLOCALEDIR="/home/at/wget-git/share/locale" -I. -I../lib -I../lib
    -O2 -Wall
Link: gcc -O2 -Wall -lgnutls -lgcrypt -lgpg-error -lz -lz -lpcre ftp-opie.o
    gnutls.o ../lib/libgnu.a

[license elided]


$ valgrind ./wget/src/wget --warc-file=letscrash
ftp://ftp.scene.org/pub/mirrors/scenesp.org/modulez/bitl/chvalley.it
==9913== Memcheck, a memory error detector
==9913== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==9913== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==9913== Command: ./wget/src/wget --warc-file=letscrash
ftp://ftp.scene.org/pub/mirrors/scenesp.org/modulez/bitl/chvalley.it
==9913==
Opening WARC file ‘letscrash.warc.gz’.

--2013-06-18 13:18:18--
ftp://ftp.scene.org/pub/mirrors/scenesp.org/modulez/bitl/chvalley.it
           => ‘chvalley.it.1’
Resolving ftp.scene.org... ==9913== Syscall param
sendmsg(mmsg[0].msg_hdr) points to uninitialised byte(s)
==9913==    at 0x5641C79: sendmmsg (sendmmsg.c:32)
==9913==    by 0x79C58FD: __libc_res_nsend (res_send.c:1140)
==9913==    by 0x79C2D48: __libc_res_nquery (res_query.c:226)
==9913==    by 0x79C36F8: __libc_res_nsearch (res_query.c:582)
==9913==    by 0x77B5B57: _nss_dns_gethostbyname4_r (dns-host.c:314)
==9913==    by 0x5611F97: gaih_inet (getaddrinfo.c:849)
==9913==    by 0x5615DB3: getaddrinfo (getaddrinfo.c:2465)
==9913==    by 0x414647: getaddrinfo_with_timeout_callback (in
/home/at/test/wget/src/wget)
==9913==    by 0x42F757: run_with_timeout (in /home/at/test/wget/src/wget)
==9913==    by 0x414B19: lookup_host (in /home/at/test/wget/src/wget)
==9913==    by 0x407BD9: connect_to_host (in /home/at/test/wget/src/wget)
==9913==    by 0x40B41E: getftp (in /home/at/test/wget/src/wget)
==9913==  Address 0x7feffdd70 is on thread 1's stack
==9913==
145.24.145.100
Connecting to ftp.scene.org|145.24.145.100|:21... connected.
Logging in as anonymous ... Logged in!
==> SYST ... done.    ==> PWD ... done.
==> TYPE I ... done.  ==> CWD (1)
/pub/mirrors/scenesp.org/modulez/bitl ... done.
==> SIZE chvalley.it ... 63707
==> PASV ... done.    ==> RETR chvalley.it ... done.
Length: 63707 (62K) (unauthoritative)

     0K .......... .......... .......... .......... .......... 80%  128K 0s
    50K .......... ..                                         100%  684K=0.4s

2013-06-18 13:18:22 (152 KB/s) - ‘chvalley.it.1’ saved [63707]

==9913== Invalid read of size 4
==9913==    at 0x55B9121: rewind (rewind.c:35)
==9913==    by 0x42ACD0: warc_write_digest_headers.part.3 (in
/home/at/test/wget/src/wget)
==9913==    by 0x42B5B4: warc_write_record (in /home/at/test/wget/src/wget)
==9913==    by 0x42C214: warc_write_resource_record (in
/home/at/test/wget/src/wget)
==9913==    by 0x40D2D8: ftp_loop_internal (in /home/at/test/wget/src/wget)
==9913==    by 0x40E838: ftp_loop (in /home/at/test/wget/src/wget)
==9913==    by 0x42706B: retrieve_url (in /home/at/test/wget/src/wget)
==9913==    by 0x4066B5: main (in /home/at/test/wget/src/wget)
==9913==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==9913==
==9913==
==9913== Process terminating with default action of signal 11 (SIGSEGV)
==9913==  Access not within mapped region at address 0x0
==9913==    at 0x55B9121: rewind (rewind.c:35)
==9913==    by 0x42ACD0: warc_write_digest_headers.part.3 (in
/home/at/test/wget/src/wget)
==9913==    by 0x42B5B4: warc_write_record (in /home/at/test/wget/src/wget)
==9913==    by 0x42C214: warc_write_resource_record (in
/home/at/test/wget/src/wget)
==9913==    by 0x40D2D8: ftp_loop_internal (in /home/at/test/wget/src/wget)
==9913==    by 0x40E838: ftp_loop (in /home/at/test/wget/src/wget)
==9913==    by 0x42706B: retrieve_url (in /home/at/test/wget/src/wget)
==9913==    by 0x4066B5: main (in /home/at/test/wget/src/wget)
==9913==  If you believe this happened as a result of a stack
==9913==  overflow in your program's main thread (unlikely but
==9913==  possible), you can try to increase the size of the
==9913==  main thread stack using the --main-stacksize= flag.
==9913==  The main thread stack size used in this run was 8388608.
==9913==
==9913== HEAP SUMMARY:
==9913==     in use at exit: 287,632 bytes in 36 blocks
==9913==   total heap usage: 339 allocs, 303 frees, 646,382 bytes allocated
==9913==
==9913== LEAK SUMMARY:
==9913==    definitely lost: 0 bytes in 0 blocks
==9913==    indirectly lost: 0 bytes in 0 blocks
==9913==      possibly lost: 0 bytes in 0 blocks
==9913==    still reachable: 287,632 bytes in 36 blocks
==9913==         suppressed: 0 bytes in 0 blocks
==9913== Rerun with --leak-check=full to see details of leaked memory
==9913==
==9913== For counts of detected and suppressed errors, rerun with: -v
==9913== Use --track-origins=yes to see where uninitialised values come from
==9913== ERROR SUMMARY: 3 errors from 2 contexts (suppressed: 2 from 2)
zsh: segmentation fault (core dumped)  valgrind ./wget/src/wget
--warc-file=letscrash


This bug is also present in Wget 1.14 and the third-party fork Wget
1.14.lua.20130523-9a5c.


Ivan