Comment 11 for bug 1573307

Revision history for this message
Chen-Han Hsiao (Stanley) (swem) wrote :

This issue could be reproduced with following command. More easily to be reproduced with narrow terminal (such as 40 characters width)

wget http://old-releases.ubuntu.com/releases/16.04.0/ubuntu-16.04-desktop-amd64.iso

This issue has been fixed by the following commit
http://git.savannah.gnu.org/cgit/wget.git/commit/?id=7099f4899880eaefc2c40a3dc7693ab4174a819b

From 7099f4899880eaefc2c40a3dc7693ab4174a819b Mon Sep 17 00:00:00 2001
From: Darshit Shah <email address hidden>
Date: Mon, 22 Feb 2016 15:08:15 +0100
Subject: [PATCH] Sanitize value sent to memset to prevent SEGFAULT

---
 src/progress.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/progress.c b/src/progress.c
index 93f6246..8a5df21 100644
--- a/src/progress.c
+++ b/src/progress.c
@@ -1164,6 +1164,8 @@ create_image (struct bar_progress *bp, double dl_total_time, bool done)
     }

   padding = bp->width - count_cols (bp->buffer);
+ assert (padding > 0 && "Padding length became non-positive!");
+ padding = padding > 0 ? padding : 0;
   memset (p, ' ', padding);
   p += padding;
   *p = '\0';
@@ -1174,6 +1176,9 @@ create_image (struct bar_progress *bp, double dl_total_time, bool done)
    * from the release code since we do not want Wget to crash and burn when the
    * assertion fails. Instead Wget should continue downloading and display a
    * horrible and irritating progress bar that spams the screen with newlines.
+ *
+ * By default, all assertions are disabled in a Wget build and are enabled
+ * only with the --enable-assert configure option.
    */
   assert (count_cols (bp->buffer) == bp->width);
 }
--
2.7.4