memcached segmentation fault (1.4.5 and 1.4.11)

[GoogleCodeExporter]

Other versions not tested.

This segfault was "detoured" by checking that tokens[COMMAND_TOKEN].value is 
not null on line 3336 (memcached.c)

full backtrace attached.

Original issue reported on code.google.com by daniel.b...@gmail.com on 19 Jan 2012 at 5:02

Attachments:

• memcached-backtrace.txt

[GoogleCodeExporter]

Correction - line 3332.

Operation system details:
Linux 2.6.18-194.32.1.el5 #1 SMP Wed Jan 5 17:52:25 EST 2011 x86_64 x86_64 
x86_64 GNU/Linux 
CentOS 5 - x64 with 32GB of memory

glibc:
ldd (GNU libc) 2.5

Compiled from source.

Original comment by daniel.b...@gmail.com on 19 Jan 2012 at 5:12

[GoogleCodeExporter]

See example: http://pastebin.com/xQkJNVai

Original comment by mannetje...@gmail.com on 22 Jan 2012 at 6:15

[GoogleCodeExporter]

After applying following patch to memcached.c I don't see any more seg fault, 
open the file and go to line 3245 where it says this:
    ntokens = tokenize_command(command, tokens, MAX_TOKENS);
    if (ntokens >= 3 &&
and then apply the following patch in between the above lines.
3245,3248d3244
<     if ( tokens[COMMAND_TOKEN].value == NULL) {
<       out_string(c,"ERROR");
<       return;
<     }

Dormando or Tornd or any other organization member please verify the above 
patch and let us know if that make sense or not.

Original comment by majidkha...@gmail.com on 25 Jan 2012 at 9:50

[GoogleCodeExporter]

Thanks for your report. I'll be reviewing this once we catch up with a few 
other bugs.

Original comment by dorma...@rydia.net on 25 Jan 2012 at 8:13

[GoogleCodeExporter]

fixed in tree, will be in 1.4.12. Thanks!

the code is supposed to check for an ntoken count before attempting to parse 
anything, and that one spot wasn't. The rest is hopefully good.

I lose points for not adding a test. hopefully can add one later.

Original comment by dorma...@rydia.net on 26 Jan 2012 at 8:39

• Changed state: Fixed