Skip to content

pcmanfm segfaults with search:/// with crafted URI with no value #125

Description

@mtasaka

gcc16 -fanalyzer -fanalyzer-assume-nothrow warns:

../src/modules/vfs-search.c:490:47: warning: dereference of NULL ‘value’ [CWE-476] [-Wanalyzer-null-dereference]
  490 |                     priv->show_hidden = (value[0] == '1') ? TRUE : FALSE;

Actually trying to do search with pcmanfm with some crafted URI, with no value causes pcmanfm to segfault:

[tasaka1@localhost ~]$ gdb --args pcmanfm "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1"
GNU gdb (Fedora Linux) 17.1-6.fc44

(gdb) r
Starting program: /usr/bin/pcmanfm search:///home/tasaka1\?recursive=0\&show_hidden\&name=\*xscreensaver\*\&name_ci=1
[Thread debugging using libthread_db enabled]

Thread 6 "pool-0" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffe576c6c0 (LWP 124090)]
parse_search_uri (priv=priv@entry=0x7fffc4001920 [FmVfsSearchEnumerator], 
    uri_str=uri_str@entry=0x7fffc40071f0 "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1")
    at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/modules/vfs-search.c:490
490	                    priv->show_hidden = (value[0] == '1') ? TRUE : FALSE;

(gdb) bt
#0  parse_search_uri
    (priv=priv@entry=0x7fffc4001920 [FmVfsSearchEnumerator], uri_str=uri_str@entry=0x7fffc40071f0 "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1") at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/modules/vfs-search.c:490
#1  0x00007fffe463fe00 in _fm_vfs_search_enumerator_new
    (file=<optimized out>, path_str=0x7fffc40071f0 "search:///home/tasaka1?recursive=0&show_hidden&name=*xscreensaver*&name_ci=1", attributes=0x7ffff70c78c0 <gfile_info_query_attribs> "standard::*,unix::*,time::*,access::*,id::filesystem,metadata::emblems", flags=G_FILE_QUERY_INFO_NONE, error=<optimized out>)
    at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/modules/vfs-search.c:360
#2  0x00007ffff70a2fbd in fm_dir_list_job_run_gio (job=0xb33830 [FmDirListJob])
    at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/job/fm-dir-list-job.c:392
#3  0x00007ffff70a8f99 in job_thread (job=0xb33830 [FmDirListJob], unused=<optimized out>)
    at /usr/src/debug/libfm-1.4.1-4.100.fc45.x86_64/libfm/_BUILDDIR_gtk3/../src/job/fm-job.c:371
#4  0x00007ffff6d4803a in g_thread_pool_thread_proxy (data=<optimized out>) at ../glib/gthreadpool.c:336
#5  0x00007ffff6d46332 in g_thread_proxy (data=0x7fffd0000b80) at ../glib/gthread.c:897
#6  0x00007ffff6b3fd19 in start_thread (arg=<optimized out>) at pthread_create.c:454
#7  0x00007ffff6bc364c in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions