From 64aef5fb9afecc023a6e719da161dbbf450908b8 Mon Sep 17 00:00:00 2001
From: Jim Meyering <jim@meyering.net>
Date: Tue, 16 Oct 2012 17:43:49 +0200
Subject: [PATCH] cp: avoid data-corrupting free-memory-read

* src/extent-scan.c (extent_scan_read): Reset our last_ei
pointer whenever the parent buffer might have just been freed.
* tests/cp/fiemap-extent-FMR.sh: New test.
* tests/local.mk (all_tests): Add it.
* NEWS (Bug fixes): Mention it.
Reported by Mike Gerth in http://bugs.gnu.org/12656, and with
help from Alan Curry.  Bug introduced in commit v8.10-60-g18f5a85.
---
 NEWS                   |   10 ++++++++++
 src/extent-scan.c      |   12 +++++++++---
 tests/Makefile.am      |    1 +
 tests/cp/fiemap-FMR.sh |   31 +++++++++++++++++++++++++++++++
 4 files changed, 51 insertions(+), 3 deletions(-)
 create mode 100755 tests/cp/fiemap-FMR.sh

Index: coreutils-8.12/NEWS
===================================================================
--- coreutils-8.12.orig/NEWS	2014-08-22 13:22:41.357037448 +0200
+++ coreutils-8.12/NEWS	2014-08-22 13:27:35.449360788 +0200
@@ -1,5 +1,15 @@
 GNU coreutils NEWS                                    -*- outline -*-
 
+* Noteworthy changes in after release of 8.12 (2011-04-26) [stable]
+
+ ** Bug fixes
+
+  cp could read from freed memory and could even make corrupt copies.
+  This could happen with a very fragmented and sparse input file,
+  on GNU/Linux file systems supporting fiemap extent scanning.
+  [bug introduced in coreutils-8.11]
+
+
 * Noteworthy changes in release 8.12 (2011-04-26) [stable]
 
 ** Bug fixes
Index: coreutils-8.12/src/extent-scan.c
===================================================================
--- coreutils-8.12.orig/src/extent-scan.c	2014-08-22 13:22:37.783082129 +0200
+++ coreutils-8.12/src/extent-scan.c	2014-08-22 13:22:41.357037448 +0200
@@ -91,7 +91,7 @@ extern bool
 extent_scan_read (struct extent_scan *scan)
 {
   unsigned int si = 0;
-  struct extent_info *last_ei IF_LINT ( = scan->ext_info);
+  struct extent_info *last_ei = scan->ext_info;
 
   while (true)
     {
@@ -129,8 +129,14 @@ extent_scan_read (struct extent_scan *sc
 
       assert (scan->ei_count <= SIZE_MAX - fiemap->fm_mapped_extents);
       scan->ei_count += fiemap->fm_mapped_extents;
-      scan->ext_info = xnrealloc (scan->ext_info, scan->ei_count,
-                                  sizeof (struct extent_info));
+      {
+        /* last_ei points into a buffer that may be freed via xnrealloc.
+           Record its offset and adjust after allocation.  */
+        size_t prev_idx = last_ei - scan->ext_info;
+        scan->ext_info = xnrealloc (scan->ext_info, scan->ei_count,
+                                    sizeof (struct extent_info));
+        last_ei = scan->ext_info + prev_idx;
+      }
 
       unsigned int i = 0;
       for (i = 0; i < fiemap->fm_mapped_extents; i++)
Index: coreutils-8.12/tests/Makefile.am
===================================================================
--- coreutils-8.12.orig/tests/Makefile.am	2014-08-22 13:22:37.703083129 +0200
+++ coreutils-8.12/tests/Makefile.am	2014-08-22 13:27:14.113627522 +0200
@@ -28,6 +28,7 @@ root_tests =					\
   cp/cp-mv-enotsup-xattr			\
   cp/capability					\
   cp/sparse-fiemap				\
+  cp/fiemap-FMR.sh				\
   dd/skip-seek-past-dev				\
   install/install-C-root			\
   ls/capability					\
Index: coreutils-8.12/tests/cp/fiemap-FMR.sh
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ coreutils-8.12/tests/cp/fiemap-FMR.sh	2014-08-22 13:22:41.357037448 +0200
@@ -0,0 +1,31 @@
+#!/bin/sh
+# Trigger a free-memory read bug in cp from coreutils-[8.11..8.19]
+
+# Copyright (C) 2012 Free Software Foundation, Inc.
+
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+. "${srcdir=.}/tests/init.sh"; path_prepend_ ./src
+print_ver_ cp
+
+require_valgrind_
+require_perl_
+: ${PERL=perl}
+
+$PERL -e 'for (1..600) { sysseek (*STDOUT, 4096, 1)' \
+  -e '&& syswrite (*STDOUT, "a" x 1024) or die "$!"}' > j || fail=1
+valgrind --quiet --error-exitcode=3 cp j j2 || fail=1
+cmp j j2 || fail=1
+
+Exit $fail
