segmentation fault in binwalk

[GoogleCodeExporter]

segmentation fault in binwalk

[GoogleCodeExporter]

Thanks for the report, I've added it to the issues list at the Binwalk project 
page (http://binwalk.googlecode.com). 

I'd like to reproduce the bug - can you tell me exactly which firmware image 
caused the seg fault? I tried against 
http://dd-wrt.com/routerdb/de/download/D-Link/DIR-615/C1/dir615c1-firmware.bin/3
588 but could not reproduce the issue.

Original comment by [email protected] on 25 Nov 2011 at 4:31

• Changed state: Accepted

[GoogleCodeExporter]

Hi,

some more info:

I am using gcc (Debian 4.6.2-4) 4.6.2
The firmware extracted is 
http://dd-wrt.com/routerdb/de/download/D-Link/DIR-615/D3/dir615d-ddwrt-webflash.
bin/3829 (think the D3 version is germany specific (?))
My kernel is x86_64 (Linux super 3.1.0-1-amd64 #1 SMP Mon Nov 14 08:02:25 UTC 
2011 x86_64 GNU/Linux)

I attached the valgrind log and the log of the extract-ng.sh script.

Original comment by [email protected] on 26 Nov 2011 at 1:09

Attachments:

• extract_run_valgrind.log
• command.log

[GoogleCodeExporter]

By the way, just noticed that the binwalk log in fmk/logs/binwalk.log seems to 
look fine ...

Original comment by [email protected] on 26 Nov 2011 at 1:13

[GoogleCodeExporter]

Thanks for the additional information. I tested the firmware image on Ubuntu 
10.04 Linux ubuntu 2.6.32-33-generic #71-Ubuntu SMP Wed Jul 20 17:27:30 UTC 
2011 x86_64 GNU/Linux) with gcc 4.4.3 (Ubuntu 4.4.3-4ubuntu5), but binwalk ran 
without error. 

I can easily apply the patch, it's simple enough, but I'd really like to 
understand what is causing the NULL string. The code explicitly checks the 
'type' string pointer for NULL, and does not call print if type is NULL, so I'm 
not sure how a NULL string is getting passed to vfprintf in the first place.

Original comment by [email protected] on 26 Nov 2011 at 2:20

[GoogleCodeExporter]

Maybe it's something specific with my gcc version. Also you can recognize this 
maybe because the patch is rather stupid. The print function works with null 
strings if only one %s is present in the format string, if there are others it 
seems to fail. So splitting up the print into two fixes the crash problem for 
me, but I do not understand why... also had the same thoughts as you as there 
are explicit checks for null ...

Original comment by [email protected] on 26 Nov 2011 at 4:49

[GoogleCodeExporter]

I could be a gcc issue, not sure - definitely odd though. In any case, if 
splitting the print statement into two print statements fixes the issue I'll do 
that as it won't hurt anything else. I'll apply the changes back to the main 
binwalk project as well. Thanks!

Original comment by [email protected] on 26 Nov 2011 at 5:12

[GoogleCodeExporter]

Upgraded binwalk to v0.4.1 which fixes this issue.

Original comment by [email protected] on 3 Dec 2011 at 3:46

• Changed state: Fixed