From eugen@grosbein.pp.ru Sat Nov 1 10:11:51 2003 Return-Path: Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id BBEF216A4F8 for ; Sat, 1 Nov 2003 10:11:51 -0800 (PST) Received: from grosbein.pp.ru (D00015.dialonly.kemerovo.su [213.184.66.105]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0454743F3F for ; Sat, 1 Nov 2003 10:11:34 -0800 (PST) (envelope-from eugen@grosbein.pp.ru) Received: from grosbein.pp.ru (smmsp@localhost [127.0.0.1]) by grosbein.pp.ru (8.12.9p2/8.12.9) with ESMTP id hA1HqwFG059987 for ; Sun, 2 Nov 2003 00:52:58 +0700 (KRAT) (envelope-from eugen@grosbein.pp.ru) Received: (from eugen@localhost) by grosbein.pp.ru (8.12.9p2/8.12.9/Submit) id hA1HktIv059840; Sun, 2 Nov 2003 00:46:55 +0700 (KRAT) (envelope-from eugen) Message-Id: <200311011746.hA1HktIv059840@grosbein.pp.ru> Date: Sun, 2 Nov 2003 00:46:55 +0700 (KRAT) From: Eugene Grosbein Reply-To: Eugene Grosbein To: FreeBSD-gnats-submit@freebsd.org Cc: Subject: Incorrect behavour of sed(1) X-Send-Pr-Version: 3.113 X-GNATS-Notify: >Number: 58813 >Category: bin >Synopsis: Incorrect behavour of sed(1) >Confidential: no >Severity: non-critical >Priority: medium >Responsible: tjr >State: closed >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sat Nov 01 10:20:17 PST 2003 >Closed-Date: Fri Jan 09 22:31:22 PST 2004 >Last-Modified: Fri Jan 09 22:31:22 PST 2004 >Originator: Eugene Grosbein >Release: FreeBSD 4.9-STABLE i386 >Organization: Svyaz Service JSC >Environment: System: FreeBSD grosbein.pp.ru 4.9-STABLE FreeBSD 4.9-STABLE #25: Thu Oct 30 23:34:44 KRAT 2003 eu@grosbein.pp.ru:/usr/local/obj/usr/local/src/sys/DADV i386 CPUTYPE=i686 and no other optimizations >Description: sed(1) can produce incorrect output while processing long lines. It can produce false error messages. It can even segfault. >How-To-Repeat: Example 1. perl -e 'print "10: "; print "A" x 2030; print "\n" ' | \ sed -E 's/^([^:]+):(.*)$/\1<\/a>:\2/' 2>&1 |hd Writes: 00000000 3c 61 20 68 72 65 66 3d 31 30 3e 31 30 3c 2f 61 |10: AAAAAAAAAAAAA| 00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 |AAAAAAAAAAAAAAAA| * 00000800 00 0a |..| 00000802 Note zero byte in last line. Replace 2030 with 4000 and see: 00000000 3c 61 20 68 72 65 66 3d 31 30 3e 31 30 3c 2f 61 |10: AAAAAAAAAAAAA| 00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 |AAAAAAAAAAAAAAAA| * 00000800 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| * 00000fb0 00 00 00 0a |....| 00000fb4 Now there are lots of zero characters. Use 4077 instead of 4000 and get segmentation fault. Example 2. perl -e 'print "10: A\n20: "; print "A" x 2542; print "\n\n" ' | \ sed -E 's/^([^:]+)\:(.*)$/\1<\/a>:\2/' >/dev/null Writes: sed: RE error: invalid regular expression That's not true. >Fix: Unknown for me. >Release-Note: >Audit-Trail: Responsible-Changed-From-To: freebsd-bugs->tjr Responsible-Changed-By: kris Responsible-Changed-When: Sat Nov 1 16:57:45 PST 2003 Responsible-Changed-Why: tjr has done a lot of work on sed, perhaps he will be interested in fixing this. http://www.freebsd.org/cgi/query-pr.cgi?pr=58813 From: Kris Kennaway To: Eugene Grosbein Cc: bug-followup@FreeBSD.org Subject: Re: bin/58813: Incorrect behavour of sed(1) Date: Sat, 1 Nov 2003 16:57:08 -0800 On Sun, Nov 02, 2003 at 12:46:55AM +0700, Eugene Grosbein wrote: > >Description: > sed(1) can produce incorrect output while processing > long lines. It can produce false error messages. > It can even segfault. > > >How-To-Repeat: > > Example 1. > > perl -e 'print "10: "; print "A" x 2030; print "\n" ' | \ > sed -E 's/^([^:]+):(.*)$/\1<\/a>:\2/' 2>&1 |hd > > Writes: > > 00000000 3c 61 20 68 72 65 66 3d 31 30 3e 31 30 3c 2f 61 |10 00000010 3e 3a 20 41 41 41 41 41 41 41 41 41 41 41 41 41 |>: AAAAAAAAAAAAA| > 00000020 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 |AAAAAAAAAAAAAAAA| > * > 00000800 00 0a |..| > 00000802 > > Note zero byte in last line. > Enabling malloc debugging (MALLOC_OPTIONS=AJ), the null bytes become 'd0', which is the malloc debugging character, indicating a memory managament error. This bug also exists on 5.x. Kris State-Changed-From-To: open->patched State-Changed-By: tjr State-Changed-When: Sun Nov 2 15:21:23 PST 2003 State-Changed-Why: Fixed in -current, will be MFC'd after 2 weeks. http://www.freebsd.org/cgi/query-pr.cgi?pr=58813 State-Changed-From-To: patched->closed State-Changed-By: tjr State-Changed-When: Fri Jan 9 22:30:55 PST 2004 State-Changed-Why: Fixed in -stable, thanks for the report. http://www.freebsd.org/cgi/query-pr.cgi?pr=58813 >Unformatted: