[Bug 1342255] Re: SRU: fix parted memory corruption crash

[Phillip Susi]

** Description changed:

- After copying data from a `hfsplus`to a `fat32`/`vfat` partition on an
- USB stick with `cp` of busybox 1.20.2 in a Lubuntu 13.04 live session on
- an `iMac G4 PowerMac 6,1`, gparted crashes with
+ [Impact]
  
-   * `*** Error in `/usr/sbin/gpartedbin': malloc(): corrupted unsorted chunks 2: 0x0000000000b93e10 ***` if I request the `vfat` partition to be made smaller and an ext4 partition to be created on the freed space
-   * `Attempt to write sectors 4026-4089 outside of partition on .
- *** Error in `/usr/sbin/gpartedbin': corrupted double-linked list: 0x0000000002303740 ***` if I request the `vfat` partition to be made smaller only
+ Parted, and tools that depend on it like gparted, crash or have other
+ errant behavior due to memory corruption.
  
- The USB stick is a SanDisk Extreme USB 3.0 with 64 GB capacity. Two
- primary fat32 partitions (formatted with gparted) are present on a
- `msdos` partition table.
+ [Test Case]
  
- Experienced with 0.18.0 on Ubuntu 14.04.
+ Create a fat16 partition and use gparted to resize it.
+ 
+ [Regression Potential]
+ Minimal: patch just fixes the code to check for a null pointer and avoid dereferencing it.
+ 
+ [Other Info]
+ 
+ Mike Fleetwood discovered a memory corruption error in parted while
+ investigating a crash report against upstream gparted.  The fix has been
+ applied to the upstream parted git repo and needs cherry picked to our
+ parted release in 14.04.
+ 
+ Patch notes:
+ 
+     lib-fs-resize: Prevent crash resizing FAT16 file systems
+ 
+     Resizing FAT16 file system crashes in libparted/fs/r/fat/resize.c
+     create_resize_context() because it was dereferencing NULL pointer
+     fs_info->info_sector to copy the info_sector.
+ 
+     Only FAT32 file systems have info_sector populated by fat_open() ->
+     fat_info_sector_read().  FAT12 and FAT16 file systems don't have an
+     info_sector so pointer fs_info->info_sector remains assigned NULL from
+     fat_alloc().  When resizing a FAT file system create_resize_context()
+     was always dereferencing fs_info->info_sector to memory copy the
+     info_sector, hence it crashed for FAT12 and FAT16.
+ 
+     Make create_resize_context() only copy the info_sector for FAT32 file
+     systems.
+ 
+     Reported by Christian Hesse in
+     https://bugzilla.gnome.org/show_bug.cgi?id=735669

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to parted in Ubuntu.
https://bugs.launchpad.net/bugs/1342255

Title:
  SRU: fix parted memory corruption crash

Status in “parted” package in Ubuntu:
  In Progress

Bug description:
  [Impact]

  Parted, and tools that depend on it like gparted, crash or have other
  errant behavior due to memory corruption.

  [Test Case]

  Create a fat16 partition and use gparted to resize it.

  [Regression Potential]
  Minimal: patch just fixes the code to check for a null pointer and avoid dereferencing it.

  [Other Info]

  Mike Fleetwood discovered a memory corruption error in parted while
  investigating a crash report against upstream gparted.  The fix has
  been applied to the upstream parted git repo and needs cherry picked
  to our parted release in 14.04.

  Patch notes:

      lib-fs-resize: Prevent crash resizing FAT16 file systems

      Resizing FAT16 file system crashes in libparted/fs/r/fat/resize.c
      create_resize_context() because it was dereferencing NULL pointer
      fs_info->info_sector to copy the info_sector.

      Only FAT32 file systems have info_sector populated by fat_open() ->
      fat_info_sector_read().  FAT12 and FAT16 file systems don't have an
      info_sector so pointer fs_info->info_sector remains assigned NULL from
      fat_alloc().  When resizing a FAT file system create_resize_context()
      was always dereferencing fs_info->info_sector to memory copy the
      info_sector, hence it crashed for FAT12 and FAT16.

      Make create_resize_context() only copy the info_sector for FAT32 file
      systems.

      Reported by Christian Hesse in
      https://bugzilla.gnome.org/show_bug.cgi?id=735669

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/parted/+bug/1342255/+subscriptions