DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:from:to:subject:date:message-id:mime-version
	:content-type; q=dns; s=default; b=XvFDdl9nioRmU1MgEbB19DGiEXTwD
	pjGEtNfzq6eH7IdSHbTWGUxcvycc8EexI/Fm9ZDCfc0DnMYOjL1VR+CEKact0MQJ
	yMlmC+Ed+CLBdVr//dvC4MwBopzff6888s3+AbZTeA4UcWZzyL+FMHy5GGguaClT
	JSrLzPkQc7DOKs=
Mailing-List: contact cygwin-help AT cygwin DOT com; run by ezmlm
Sender: cygwin-owner AT cygwin DOT com
Mail-Followup-To: cygwin AT cygwin DOT com
From: Ken Harris <Ken DOT Harris AT mathworks DOT com>
To: "cygwin AT cygwin DOT com" <cygwin AT cygwin DOT com>
Subject: Re: winsup\cygwin\path.cc issues
Date: Fri, 4 May 2018 01:23:47 +0000
Message-ID: <DM2PR0501MB1358382033C52CD40E92634F8A860@DM2PR0501MB1358.namprd05.prod.outlook.com>
spamdiagnosticoutput: 1:99
spamdiagnosticmetadata: NSPM
MIME-Version: 1.0
X-MS-Exchange-CrossTenant-Network-Message-Id: 45046162-02fe-4cd6-6d0b-08d5b15daf72
X-MS-Exchange-CrossTenant-originalarrivaltime: 04 May 2018 01:23:47.5286 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 99dd3a11-4348-4468-9bdd-e5072b1dc1e6
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM2PR0501MB1310
X-MC-Unique: LY9mTpRAOFmRUbuaKxvzhw-1
Content-Type: multipart/mixed;	boundary="_002_DM2PR0501MB1358382033C52CD40E92634F8A860DM2PR0501MB1358_"

--_002_DM2PR0501MB1358382033C52CD40E92634F8A860DM2PR0501MB1358_
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable

Hi Marco:
                Sorry for not replying to the original exchange we had. I w=
asn't subscribed to the list but now I am so it won't happen again (so I'm =
quoting our exchange below).
=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20=20
                I installed and built cygwin1.dll with an added assert in p=
ath.cc to identify when the buffer underrun condition I originally describe=
d occurs:

$ diff -b ./cygwin-2.10.0-1.src/newlib-cygwin/winsup/cygwin/path.cc.ORIG ./=
cygwin-2.10.0-1.src/newlib-cygwin/winsup/cygwin/path.cc
2803c2803
<                   ;
---
>                   assert(p >=3D path);

                Thus, a simple:

                cat '\A../../../B'

                will result in the assert firing:

kharris AT ah-kharris /usr/src
$ cat '\A../../../B'
assertion "p >=3D path" failed: file "../../.././winsup/cygwin/path.cc", li=
ne 2803, function: int symlink_info::check(char*, const suffix_info*, fs_in=
fo&, path_conv_handle&)
Aborted (core dumped)

Attached is a patch (in addition to the added assert) with what I *think* m=
ight really fix the problem. This was where the expected backslash got squa=
shed which allowed symlink_info::check() to go "negative" with its 'p' poin=
ter and look for a backslash in someone else's memory.

                I've applied this "correction" in our MSYS2 code.  I hope t=
o get some flight-time with it soon (long duration, automated processing)  =
and if it causes unexpected problems, I'll report back on that. Otherwise, =
I just hope it might be helpful to anyone who might run into similar puzzli=
ng circumstances (the puzzle is when the errant 'p' pointer _doesn't_ find =
a stray backslash in someone else's memory. It segv-s and _that_ was the na=
sty part of the puzzle).

                Thanks,
                -Ken


On 5/2/2018 3:49 PM, Ken Harris wrote:

    Hi:
                     While originally investigating a sporadic failure in M=
SYS2, I believe I found that its origin may actually be within Cygwin.

                     Given the following command sequence on cygwin64 in a =
CMD.EXE command prompt (on Windows 10 x64 if it matters).


       cd C:\Cygwin64\bin
                     echo.exe running \"test\" logging to ../../../my.log


Not clear to me what is the exact command line to replicate

In addition "C:\Cygwin64\bin" is "/bin" so where do you expect
/bin/../../../my.log to be ?

Regards
Marco

--_002_DM2PR0501MB1358382033C52CD40E92634F8A860DM2PR0501MB1358_
Content-Type: application/octet-stream; name="path.cc.patch"
Content-Description: path.cc.patch
Content-Disposition: attachment; filename="path.cc.patch"; size=1745;
	creation-date="Fri, 04 May 2018 01:22:13 GMT";
	modification-date="Fri, 04 May 2018 00:20:54 GMT"
Content-Transfer-Encoding: base64

LS0tIC4vY3lnd2luLTIuMTAuMC0xLnNyYy9uZXdsaWItY3lnd2luL3dpbnN1
cC9jeWd3aW4vcGF0aC5jYy5PUklHCTIwMTgtMDUtMDMgMTk6NDM6MDAuNDgy
NDcyMTAwIC0wNDAwCisrKyAuL2N5Z3dpbi0yLjEwLjAtMS5zcmMvbmV3bGli
LWN5Z3dpbi93aW5zdXAvY3lnd2luL3BhdGguY2MJMjAxOC0wNS0wMyAyMDow
OTo0NC4wMzU2MzA3MDAgLTA0MDAKQEAgLTEzNDIsNiArMTM0Miw3IEBACiBp
bnQKIG5vcm1hbGl6ZV93aW4zMl9wYXRoIChjb25zdCBjaGFyICpzcmMsIGNo
YXIgKmRzdCwgY2hhciAqJnRhaWwpCiB7CisgIGludCBkcnZwcmVmaXhsZW4g
PSAwOwogICBjb25zdCBjaGFyICpzcmNfc3RhcnQgPSBzcmM7CiAgIGJvb2wg
YmVnX3NyY19zbGFzaCA9IGlzZGlyc2VwIChzcmNbMF0pOwogCkBAIC0xMzg1
LDkgKzEzODYsMTAgQEAKIAkqdGFpbCsrID0gY3lnX3RvdXBwZXIgKCpzcmMr
Kyk7CiAgICAgICBlbHNlIGlmICgqc3JjICE9ICcvJykKIAl7Ci0JICBpZiAo
YmVnX3NyY19zbGFzaCkKLQkgICAgdGFpbCArPSBjeWdoZWFwLT5jd2QuZ2V0
X2RyaXZlIChkc3QpOwotCSAgZWxzZSBpZiAoIWN5Z2hlYXAtPmN3ZC5nZXQg
KGRzdCwgMCkpCisJICBpZiAoYmVnX3NyY19zbGFzaCkgeworCSAgICBkcnZw
cmVmaXhsZW4gPSBjeWdoZWFwLT5jd2QuZ2V0X2RyaXZlIChkc3QpOworCSAg
ICB0YWlsICs9IGRydnByZWZpeGxlbjsKKwkgIH0gZWxzZSBpZiAoIWN5Z2hl
YXAtPmN3ZC5nZXQgKGRzdCwgMCkpCiAJICAgIHJldHVybiBnZXRfZXJybm8g
KCk7CiAJICBlbHNlCiAJICAgIHsKQEAgLTE0MjMsMTAgKzE0MjUsMTAgQEAK
IAkgIGVsc2UKIAkgICAgewogCSAgICAgIC8qIEJhY2sgdXAgb3ZlciAvLCBi
dXQgbm90IGlmIGl0J3MgdGhlIGZpcnN0IG9uZS4gICovCi0JICAgICAgaWYg
KHRhaWwgPiBkc3QgKyAxKQorCSAgICAgIGlmICh0YWlsID4gZHN0ICsgMSAr
IGRydnByZWZpeGxlbikKIAkJdGFpbC0tOwogCSAgICAgIC8qIE5vdyBiYWNr
IHVwIHRvIHRoZSBuZXh0IC8uICAqLwotCSAgICAgIHdoaWxlICh0YWlsID4g
ZHN0ICsgMSAmJiB0YWlsWy0xXSAhPSAnXFwnICYmIHRhaWxbLTJdICE9ICc6
JykKKwkgICAgICB3aGlsZSAodGFpbCA+IGRzdCArIDEgKyBkcnZwcmVmaXhs
ZW4gJiYgdGFpbFstMV0gIT0gJ1xcJyAmJiB0YWlsWy0yXSAhPSAnOicpCiAJ
CXRhaWwtLTsKIAkgICAgICBzcmMgKz0gMjsKIAkgICAgICAvKiBTa2lwIC8n
cyB0byB0aGUgbmV4dCBwYXRoIGNvbXBvbmVudC4gKi8KQEAgLTE0NDYsNyAr
MTQ0OCw3IEBACiAgICAgICBpZiAoKHRhaWwgLSBkc3QpID49IE5UX01BWF9Q
QVRIKQogCXJldHVybiBFTkFNRVRPT0xPTkc7CiAgICAgfQotICBpZiAodGFp
bCA+IGRzdCArIDEgJiYgdGFpbFstMV0gPT0gJy4nICYmIHRhaWxbLTJdID09
ICdcXCcpCisgIGlmICh0YWlsID4gZHN0ICsgMSArIGRydnByZWZpeGxlbiAm
JiB0YWlsWy0xXSA9PSAnLicgJiYgdGFpbFstMl0gPT0gJ1xcJykKICAgICB0
YWlsLS07CiAgICp0YWlsID0gJ1wwJzsKICAgZGVidWdfcHJpbnRmICgiJXMg
PSBub3JtYWxpemVfd2luMzJfcGF0aCAoJXMpIiwgZHN0LCBzcmNfc3RhcnQp
OwpAQCAtMjgwMCw3ICsyODAyLDcgQEAKIAkgICAgICBpZiAoKnAgIT0gJy4n
ICYmICpwICE9ICcgJykKIAkJewogCQkgIHdoaWxlICgqLS1wICE9ICdcXCcp
Ci0JCSAgICA7CisJCSAgICBhc3NlcnQocCA+PSBwYXRoKTsKIAkJICBpZiAo
KisrcCAhPSAnICcpCiAJCSAgICBwID0gTlVMTDsKIAkJfQo=


--_002_DM2PR0501MB1358382033C52CD40E92634F8A860DM2PR0501MB1358_
Content-Type: text/plain; charset=us-ascii


--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
--_002_DM2PR0501MB1358382033C52CD40E92634F8A860DM2PR0501MB1358_--