29-Jun-2012

wget issue
Doing some investigation for our sales department – doing some useful while being ‘in between jobs’ – I use Steven Schweda’s port of wget. This is a great tool to get the desired data – once you find (or create) a page you can use as a starting point, and find your way around in the possible options.

But accessing one particular site, the program crashes (with local and remote information obscured):

$ wget --output-file="/drive/dirpath/name.log" -
--recursive --level=3 --wait=1 --random-wait -
--directory-prefix="/drive/dirpath" -x -
--ignore-length --max-redirect=20 -
--adjust-extension --no-clobber -
"http://site/begin"
%SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=000000007BF06B80, PC=FFFFFFFF81074684, PS=0000001B

Improperly handled condition, image exit forced by last chance handler.
Signal arguments: Number = 0000000000000005
Name = 000000000000000C
0000000000000000
000000007BF06B80
FFFFFFFF81074684
000000000000001B

Register dump:
R0 = 00000000000001EC R1 = 0000000000000000 R2 = 000000007BF06D60
R3 = 000000007BF6B4D0 R4 = 0000000000000000 R5 = 0000000000000000
R6 = 0000000000000000 R7 = 0000000000000000 R8 = 000000000000000A
R9 = 0000000000306D40 R10 = 0000000000000006 R11 = 0000000000316000
R12 = 0000000000000000 R13 = 0000000000000000 R14 = 0000000000306BD0
R15 = 0000000000000001 R16 = 0000000000000003 R17 = 000000007FF80000
R18 = 00000000FDF80000 R19 = FFFFFFFF81C08B48 R20 = 000000007FFF0000
R21 = 0000000000000002 R22 = 0000000000000000 R23 = FFFFFFFFFFFFFFFF
R24 = 0000000037DFD55E R25 = FFFFFFFF824F55C0 R26 = 0000000000000FD2
R27 = FFFFFFFF81C10210 R28 = 0000000000000000 R29 = 000000007ADDB390
SP = 000000007ADDB390 PC = FFFFFFFF81074684 PS = 100000000000001B
%SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=000000007BF06200, PC=FFFFFFFF80086930, PS=0000001B

Improperly handled condition, image exit forced by last chance handler.
Signal arguments: Number = 0000000000000005
Name = 000000000000000C
0000000000000000
000000007BF06200
FFFFFFFF80086930
000000000000001B

Register dump:
R0 = FFFFFFFF80381930 R1 = 000000000000001B R2 = 0000000000000003
R3 = FFFFFFFF81CD2920 R4 = 0000000000000001 R5 = 000000007BF6B510
R6 = 000000001000000C R7 = 000000007FF87FC0 R8 = 000000000000000A
R9 = 0000000000306D40 R10 = 0000000000000006 R11 = 0000000000316000
R12 = 0000000000000000 R13 = FFFFFFFF81D4EE18 R14 = 0000000000306BD0
R15 = 0000000000000001 R16 = 000000007BF6B520 R17 = 000000007BF06200
R18 = 0000000000000005 R19 = FFFFFFFF80381430 R20 = 000000007FF87FA8
R21 = 000000007ADDAF8C R22 = 000000007BF06200 R23 = 000000007BF06200
R24 = 0000000000000001 R25 = 0000000000000001 R26 = FFFFFFFF80086A18
R27 = FFFFFFFF81C5CCD0 R28 = 0000000000000006 R29 = 000000007ADDAFD0
SP = 000000007ADDAF80 PC = FFFFFFFF80086930 PS = 000000000000001B
$

Running the program using the --debug option, the log suggests a buffer overflow

...
/drive/dirpath/site-dir/main.html: merge(`http://site/main', `http://site♦
appending `http://site/' to urlpos.

/drive/dirpath/site_dir/main.html: merge(`http://site/main', `http://site♦
appending `http://site-2/' to urlpos.

/drive/dirpath/sit
[End of file]

It really ends in the middle of a site speccification – quite a lot of data is appended to urlpos….

I have signaled it to Steven Scheweda to have a look, and when possible, I’ll try my way around in this program (not really familiar with C, but I’ll manage)

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.