Buffer overflow

Hi,

I just thought I'll do a trivial check of trivial bugs, in this case
giving a bit too long parameters. These actually look like bugs in the apr
library.

gdb --args svn export \
        file:///home/svn/debian/`perl -e 'print A x 20000'`

Results in:
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 19831)]
0x401c865a in apr_allocator_set_mutex () from /usr/lib/libapr.so.0
(gdb) bt
#0 0x401c865a in apr_allocator_set_mutex () from /usr/lib/libapr.so.0
#1 0x401c7957 in apr_pvsprintf () from /usr/lib/libapr.so.0
#2 0x40156c48 in svn_error_createf () from /usr/lib/libsvn_subr-1.so.0
#3 0x40075163 in svn_repos_create () from /usr/lib/libsvn_repos-1.so.0
#4 0x400751f0 in svn_repos_create () from /usr/lib/libsvn_repos-1.so.0
#5 0x40075458 in svn_repos_open () from /usr/lib/libsvn_repos-1.so.0
#6 0x40065fd4 in svn_ra_local__split_URL () from /usr/lib/libsvn_ra_local-1.so.0
#7 0x40064b0c in _init () from /usr/lib/libsvn_ra_local-1.so.0
#8 0x40034891 in svn_client__open_ra_session () from /usr/lib/libsvn_client-1.so.0
#9 0x40026eef in svn_client_checkout () from /usr/lib/libsvn_client-1.so.0
#10 0x40030877 in svn_client_export () from /usr/lib/libsvn_client-1.so.0
#11 0x0804bf58 in svn_handle_warning ()
#12 0x0804e99d in svn_handle_warning ()
#13 0x404599f1 in __libc_start_main () from /lib/libc.so.6
(gdb) quit

And:

gdb --args svn export file:///home/svn/debian/`perl -e 'print a x 16300'`

Resulted in:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 19872)]
0x404ae16d in mallopt () from /lib/libc.so.6
(gdb) bt
#0 0x404ae16d in mallopt () from /lib/libc.so.6
#1 0x404ad172 in free () from /lib/libc.so.6
#2 0x401c6cbb in apr_allocator_destroy () from /usr/lib/libapr.so.0
#3 0x401c743e in apr_pool_destroy () from /usr/lib/libapr.so.0
#4 0x401c6fa6 in apr_pool_terminate () from /usr/lib/libapr.so.0
#5 0x401c2f25 in apr_terminate () from /usr/lib/libapr.so.0
#6 0x4046c744 in exit () from /lib/libc.so.6
#7 0x404599f9 in __libc_start_main () from /lib/libc.so.6
(gdb) q

-- 
Baruch Even
http://baruch.ev-en.org/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@subversion.tigris.org
For additional commands, e-mail: dev-help@subversion.tigris.org