Skip to content

Fix heap-use-after-free error of robots.txt processor

Didik Setiawan requested to merge tmp-robots-leak into master
  • src/wget.c (try_connection): Fix heap-use-after-free error of robots.txt processor when build using --enable-fsanitize-asan --enable-fsanitize-ubsan

When build using --enable-fsanitize-asan --enable-fsanitize-ubsan I found some memory leak when testing using persistent connection.

GET /robots.txt HTTP/1.1^M                                                                                                                                                                        
Host: localhost^M                                                                                                                                                                                 
Accept-Encoding: gzip, deflate, bzip2, xz, lzma, br^M                                                                                                                                             
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8^M                                                                                                                         
User-Agent: wget2/1.0.0^M                                                                                                                                                                         
Connection: keep-alive^M                                                                                                                                                                          
^M                                                                                                                                                                                                
21.145457.258 [0] action=2 pending=1 host=0x60700000dd10                                                                                                                                          
21.145457.258 ### req 0x61500002fb00 pending requests = 1                                                                                                                                         
21.145457.258 nbytes 126 nread 0 102400                                                                                                                                                           
21.145457.258 # got header 122 bytes:                                                                                                                                                             
HTTP/1.1 200 OK^M                                                                                                                                                                                 
Connection: Keep-Alive^M                                                                                                                                                                          
Content-Length: 85^M                                                                                                                                                                              
Content-Type: text/plain^M                                                                                                                                                                        
Date: Fri, 21 Jul 2017 07:54:57 GMT                                                                                                                                                               
                                                                                                                                                                                                  
21.145457.258 method 2                                                                                                                                                                            
21.145457.258 nbytes 85 total 85/85                                                                                                                                                               
21.145457.258 keep_alive=1                                                                                                                                                                        
21.145457.258 Scanning robots.txt ...                                                                                                                                                             
21.145457.259 host_remove_job: 0x60c00000b740                                                                                                                                                     
21.145457.259 host_remove_job: qsize=1 host->qsize=1                                                                                                                                              
21.145457.259 [0] action=1 pending=0 host=0x60700000dd10                                                                                                                                          
21.145457.259 qsize=1 blocked=0                                                                                                                                                                   
21.145457.259 pause=-1500623697259                                                                                                                                                                
21.145457.259 dequeue job http://localhost:33047/index.html                                                                                                                                       
=================================================================                                                                                                                                 
==20582==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000007de3 at pc 0x7f95e26402d5 bp 0x7f95d96fec60 sp 0x7f95d96fe408
READ of size 6 at 0x610000007de3 thread T1
21.145457.259 main: wake up
#0 0x7f95e26402d4  (/usr/lib/x86_64-linux-gnu/libasan.so.2+0x472d4)
#1 0x7f95e229b1b1 in wget_strcmp /home/didik/wget2/libwget/utils.c:82
#2 0x41bc29 in try_connection /home/didik/wget2/src/wget.c:1144
#3 0x41c5d6 in establish_connection /home/didik/wget2/src/wget.c:1207
#4 0x42345b in downloader_thread /home/didik/wget2/src/wget.c:1699
#5 0x7f95e10416b9 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x76b9)
#6 0x7f95e0d773dc in clone (/lib/x86_64-linux-gnu/libc.so.6+0x1073dc)

Merge request reports