/usr/bin/nmap:11:hascaptures:hascaptures:hascaptures:hascaptures:hascaptures
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
lua-lpeg (Debian) |
Fix Released
|
Unknown
|
|||
lua-lpeg (Ubuntu) |
Fix Released
|
Medium
|
Victor Tapia | ||
Xenial |
Fix Released
|
Medium
|
Victor Tapia | ||
Bionic |
Fix Released
|
Medium
|
Victor Tapia | ||
Disco |
Fix Released
|
Medium
|
Victor Tapia | ||
Eoan |
Fix Released
|
Medium
|
Victor Tapia |
Bug Description
[Impact]
Under certain conditions, lpeg will crash while walking the pattern tree looking for TCapture nodes.
[Test Case]
The reproducer, taken from an upstream discussion (link in "Other info"), is:
$ cat repro.lua
#!/usr/bin/env lua
lpeg = require "lpeg"
p = lpeg.C(
p:match("xx")
The program crashes due to a hascaptures() infinite recursion:
$ ./repro.lua
Segmentation fault (core dumped)
(gdb) bt -25
#523984 0x00007ffff7a3743c in hascaptures () from /usr/lib/
#523985 0x00007ffff7a3743c in hascaptures () from /usr/lib/
#523986 0x00007ffff7a3743c in hascaptures () from /usr/lib/
#523987 0x00007ffff7a3743c in hascaptures () from /usr/lib/
#523988 0x00007ffff7a3743c in hascaptures () from /usr/lib/
#523989 0x00007ffff7a3743c in hascaptures () from /usr/lib/
#523990 0x00007ffff7a3815c in ?? () from /usr/lib/
#523991 0x00007ffff7a388e3 in compile () from /usr/lib/
#523992 0x00007ffff7a36fab in ?? () from /usr/lib/
#523993 0x000055555555fd1e in ?? ()
#523994 0x000055555556a5fc in ?? ()
#523995 0x00005555555600c8 in ?? ()
#523996 0x000055555555f63f in ?? ()
#523997 0x000055555556030f in ?? ()
#523998 0x000055555555dc91 in lua_pcallk ()
#523999 0x000055555555b896 in ?? ()
#524000 0x000055555555c54b in ?? ()
#524001 0x000055555555fd1e in ?? ()
#524002 0x0000555555560092 in ?? ()
#524003 0x000055555555f63f in ?? ()
#524004 0x000055555556030f in ?? ()
#524005 0x000055555555dc91 in lua_pcallk ()
#524006 0x000055555555b64b in ?? ()
#524007 0x00007ffff7c94bbb in __libc_start_main (main=0x5555555
at ../csu/
#524008 0x000055555555b70a in ?? ()
The expected behavior is to have the program finish normally
[Regression potential]
Low, this is a backport from upstream and only limits the infinite recursion in a scenario where it shouldn't happen to begin with (TCapture node search).
[Other info]
This was fixed upstream in 1.0.1 by stopping the recursion in TCall nodes and controlling that TRule nodes do not follow siblings (sib2)
The upstream discussion can be found here: http://
My analysis can be found here: http://
[Original description]
The Ubuntu Error Tracker has been receiving reports about a problem regarding nmap. This problem was most recently seen with version 7.01-2ubuntu2, the problem page at https:/
Changed in nmap (Ubuntu): | |
importance: | Undecided → High |
tags: | added: sts |
Changed in nmap (Ubuntu Xenial): | |
assignee: | Dan Streetman (ddstreet) → Victor Tapia (vtapia) |
Changed in nmap (Ubuntu Eoan): | |
assignee: | nobody → Victor Tapia (vtapia) |
no longer affects: | nmap (Ubuntu Eoan) |
description: | updated |
no longer affects: | nmap (Ubuntu) |
no longer affects: | nmap (Ubuntu Xenial) |
no longer affects: | lua-lpeg (Ubuntu Focal) |
Changed in lua-lpeg (Ubuntu): | |
assignee: | nobody → Victor Tapia (vtapia) |
status: | New → In Progress |
Changed in lua-lpeg (Debian): | |
status: | Unknown → New |
Changed in lua-lpeg (Ubuntu): | |
importance: | Undecided → Critical |
importance: | Critical → Medium |
Changed in lua-lpeg (Ubuntu): | |
status: | In Progress → Fix Committed |
Changed in lua-lpeg (Ubuntu Eoan): | |
assignee: | nobody → Victor Tapia (vtapia) |
Changed in lua-lpeg (Ubuntu Disco): | |
assignee: | nobody → Victor Tapia (vtapia) |
Changed in lua-lpeg (Ubuntu Bionic): | |
assignee: | nobody → Victor Tapia (vtapia) |
Changed in lua-lpeg (Ubuntu Xenial): | |
assignee: | nobody → Victor Tapia (vtapia) |
status: | New → In Progress |
Changed in lua-lpeg (Ubuntu Disco): | |
status: | New → In Progress |
Changed in lua-lpeg (Ubuntu Bionic): | |
status: | New → In Progress |
Changed in lua-lpeg (Ubuntu Xenial): | |
importance: | Undecided → Medium |
Changed in lua-lpeg (Ubuntu Disco): | |
importance: | Undecided → Medium |
Changed in lua-lpeg (Ubuntu Bionic): | |
importance: | Undecided → Medium |
Changed in lua-lpeg (Ubuntu Eoan): | |
importance: | Undecided → Medium |
status: | New → In Progress |
Changed in lua-lpeg (Debian): | |
status: | New → Fix Released |
Status changed to 'Confirmed' because the bug affects multiple users.