[Bug 258387] fetch -v displays bogus data

From: <bugzilla-noreply_at_freebsd.org>
Date: Thu, 09 Sep 2021 13:54:53 UTC 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=258387

            Bug ID: 258387
           Summary: fetch -v displays bogus data
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Some People
          Priority: ---
         Component: bin
          Assignee: bugs@FreeBSD.org
          Reporter: se@FreeBSD.org

The error output of "fetch -v" should be server messages, but it appears that
the buffer gets overwritten with data of unknown origin (mostly NUL bytes),
e.g.:

$ fetch -v http://distcache.us-west.freebsd.org/x 2>&1 | hd
00000000  72 65 73 6f 6c 76 69 6e  67 20 73 65 72 76 65 72  |resolving server|
00000010  20 61 64 64 72 65 73 73  3a 20 64 69 73 74 63 61  | address: distca|
00000020  63 68 65 2e 75 73 2d 77  65 73 74 2e 66 72 65 65  |che.us-west.free|
00000030  62 73 64 2e 6f 72 67 3a  38 30 0a 72 65 71 75 65  |bsd.org:80.reque|
00000040  73 74 69 6e 67 20 68 74  74 70 3a 2f 2f 64 69 73  |sting http://dis|
00000050  74 63 61 63 68 65 2e 75  73 2d 77 65 73 74 2e 66  |tcache.us-west.f|
00000060  72 65 65 62 73 64 2e 6f  72 67 2f 78 0a 0d 0a 00  |reebsd.org/x....|
00000070  67 69 6e 78 00 00 00 0a  34 30 34 20 4e 6f 74 20  |ginx....404 Not |
00000080  46 6f 75 6e 64 0d 0a 00  00 00 00 00 10 02 00 50  |Found..........P|
00000090  95 14 01 c9 00 00 00 00  00 00 00 00 0a 0d 0a 00  |................|
000000a0  74 6c 65 3e 34 30 34 20  4e 6f 74 20 46 6f 75 6e  |tle>404 Not Foun|
000000b0  64 0d 0a 00 00 00 00 00  10 02 00 50 95 14 01 c9  |d..........P....|
000000c0  00 00 00 00 00 00 00 00  0a 34 30 34 20 4e 6f 74  |.........404 Not|
000000d0  20 46 6f 75 6e 64 0d 0a  00 0a 00 00 00 00 00 10  | Found..........|
000000e0  02 00 50 95 14 01 c9 00  00 00 00 00 00 00 00 0a  |..P.............|
000000f0  6e 67 69 6e 78 0d 0a 00  3e 0d 0a 00 0a 00 00 00  |nginx...>.......|
00000100  00 00 10 02 00 50 95 14  01 c9 00 00 00 00 00 00  |.....P..........|
00000110  00 00 0a 0d 0a 00 72 3e  6e 67 69 6e 78 0d 0a 00  |......r>nginx...|
00000120  3e 0d 0a 00 0a 00 00 00  00 00 10 02 00 50 95 14  |>............P..|
00000130  01 c9 00 00 00 00 00 00  00 00 0a 0d 0a 00 72 3e  |..............r>|
00000140  6e 67 69 6e 78 0d 0a 00  3e 0d 0a 00 0a 00 00 00  |nginx...>.......|
00000150  00 00 10 02 00 50 95 14  01 c9 00 00 00 00 00 00  |.....P..........|
00000160  00 00 0a 66 65 74 63 68  3a 20 68 74 74 70 3a 2f  |...fetch: http:/|
00000170  2f 64 69 73 74 63 61 63  68 65 2e 75 73 2d 77 65  |/distcache.us-we|
00000180  73 74 2e 66 72 65 65 62  73 64 2e 6f 72 67 2f 78  |st.freebsd.org/x|
00000190  3a 20 4e 6f 74 20 46 6f  75 6e 64 0a              |: Not Found.|
0000019c

The expected output is returned by wget, e.g.:

$ wget -d http://distcache.us-west.freebsd.org/x
[...]
404 Not Found
Registered socket 3 for persistent reuse.
Skipping 146 bytes of body: [<html>
<head><title>404 Not Found</title></head>
<body>
<center><h1>404 Not Found</h1></center>
<hr><center>nginx</center>
</body>
</html>
] done.
2021-09-09 15:37:02 ERROR 404: Not Found.

Part of the HTML response can be found in the fetch output, too:

"r>nginx" is obviously a fragment of "<center>nginx</center>", but "r>nginx"
appears twice, 40 bytes apart.

"tle>404 Not Found" is a fragment of "<title>404 Not Found</title>", with "404
Not Found" appearing a total of 3 times ...

This could be a result of recent changes to the memcpy function, which used to
allow overlapping buffers, but does not anymore on -CURRENT.

But the 4 occurences of memcpy() in libfetch/http.c and libfetch/common.c seem
to be sane, and I did not look any further for the source of the data
corruption.

-- 
You are receiving this mail because:
You are the assignee for the bug.