View Issue Details

IDProjectCategoryView StatusLast Update
0016218CentOS-7curlpublic2019-06-27 09:22
Reporterisolov 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
Product Version7.6.1810 
Target VersionFixed in Version 
Summary0016218: Setting CURLOPT_BUFFERSIZE using curl_easy_setopt() causes segmentation fault in curl_easy_perform()
DescriptionIf the curl_easy_setopt(curl_h, CURLOPT_BUFFERSIZE, 128000L); is used to set preferred buffer size, the curl_easy_setopt() may cause segmentation fault.
It was OK in the previous version of the libcurl-7.29.0-46.el7.x86_64 (CentOS 7.5.1804).
Steps To ReproduceDownload CURL example https://curl.haxx.se/libcurl/c/fopen.html and add line 256:

254 curl_easy_setopt(file->handle.curl, CURLOPT_VERBOSE, 0L);
255 curl_easy_setopt(file->handle.curl, CURLOPT_WRITEFUNCTION, write_callback);
256 curl_easy_setopt(file->handle.curl, CURLOPT_BUFFERSIZE, 128000L);
257
258 if(!multi_handle)
259 multi_handle = curl_multi_init();

The application will crash trying to get any big URL, for example:

bash-4.2$ gcc -o /tmp/fopen -lcurl /tmp/fopen.c
bash-4.2$ ldd /tmp/fopen | grep curl
    libcurl.so.4 => /lib64/libcurl.so.4 (0x00007feaefcb3000)
bash-4.2$ ls -la /lib64/libcurl.so.4
lrwxrwxrwx 1 root root 16 Jun 25 12:39 /lib64/libcurl.so.4 -> libcurl.so.4.3.0
bash-4.2$ rpm -qf /lib64/libcurl.so.4.3.0
libcurl-7.29.0-51.el7.x86_64
bash-4.2$ gdb --args /tmp/fopen http://212.183.159.230/5MB.zip
GNU gdb (GDB) Red Hat Enterprise Linux 7.6.1-114.el7
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /tmp/fopen...(no debugging symbols found)...done.
(gdb) run
Starting program: /tmp/fopen http://212.183.159.230/5MB.zip
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bada20 in Curl_splay () from /lib64/libcurl.so.4
Missing separate debuginfos, use: debuginfo-install cyrus-sasl-lib-2.1.26-23.el7.x86_64 glibc-2.17-260.el7_6.5.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.15.1-37.el7_6.x86_64 libcom_err-1.42.9-13.el7.x86_64 libcurl-7.29.0-51.el7.x86_64 libidn-1.28-4.el7.x86_64 libselinux-2.5-14.1.el7.x86_64 libssh2-1.4.3-12.el7_6.2.x86_64 nspr-4.19.0-1.el7_5.x86_64 nss-3.36.0-7.1.el7_6.cern.x86_64 nss-softokn-freebl-3.36.0-5.el7_5.x86_64 nss-util-3.36.0-1.1.el7_6.x86_64 openldap-2.4.44-21.el7_6.x86_64 openssl-libs-1.0.2k-16.el7_6.1.x86_64 pcre-8.32-17.el7.x86_64 zlib-1.2.7-18.el7.x86_64
(gdb) where
#0 0x00007ffff7bada20 in Curl_splay () from /lib64/libcurl.so.4
#1 0x00007ffff7badc21 in Curl_splaygetbest () from /lib64/libcurl.so.4
#2 0x00007ffff7ba6425 in curl_multi_perform () from /lib64/libcurl.so.4
#3 0x000000000040129f in fill_buffer ()
#4 0x00000000004017cf in url_fgets ()
#5 0x00000000004019fa in main ()

Commenting line 256 out makes program working normally.
TagsNo tags attached.
abrt_hash
URL

Activities

isolov

isolov

2019-06-26 15:45

reporter  

fopen.c (15,408 bytes)
TrevorH

TrevorH

2019-06-26 16:28

manager   ~0034726

CentOS is a rebuild of the sources used to create RHEL. We do not modify anything except to remove branding and logos. You will need to submit your request to Redhat via bugzilla.redhat.com and if/when RH accepts it and incorporates it into RHEL and releases a patched version, then CentOS will pick it up and rebuild it.
isolov

isolov

2019-06-26 16:37

reporter   ~0034727

In the latest version of curl used by CentOS7 there is a bug, while the previous version libcurl-7.29.0-46.el7.x86_64 was OK. I will try to report the bug to RH, but meanwhile one can to rollback the latest version.
isolov

isolov

2019-06-27 09:22

reporter   ~0034744

After discussion with RedHat (see https://bugzilla.redhat.com/show_bug.cgi?id=1724292), this is known bug:
> Thank you for reporting the bug! We are aware of it and the bug is already being fixed in RHEL-7.7 and RHEL-7.6.z. I can create an unsupported copr build of curl if you are interested in testing the fix.

Issue History

Date Modified Username Field Change
2019-06-26 15:45 isolov New Issue
2019-06-26 15:45 isolov File Added: fopen.c
2019-06-26 16:28 TrevorH Note Added: 0034726
2019-06-26 16:37 isolov Note Added: 0034727
2019-06-27 09:22 isolov Note Added: 0034744