en.SH.PP.RU

Hi! Found a crash in nokotan 1.05 while setting up a Spartan mirror.

In src/mimetype.c, load_new_types_db():

db_paths = realloc(db_paths, num_db_paths);

db_paths is a char **, so this asks for one byte per element instead of sizeof(char *) — the buffer comes out 8x too small and every db_paths[n] = strdup(...) writes past its end.

The function is called once per -t file and once more unconditionally for /etc/nokotan-types, so a single -t means two calls: the second writes 8 bytes at offset 8 of a 2-byte allocation. On musl that's a reliable segfault at startup. Without -t there's only one call and the write usually fits inside malloc's rounding, so it starts fine — but it's still out of bounds.

Repro on Alpine:

printf '[text/gemini; charset=UTF-8]\n*.gmi\n' > /tmp/types
nokotan -d /var/spartan -p 3098 -f -t /tmp/types
# Segmentation fault

Fix:

db_paths = realloc(db_paths, num_db_paths * sizeof(*db_paths));

Two more in load_types_db(), spotted while reading — I didn't actually trigger either:

last is a locl, but types_db is a global list that persists, so last->next = ent dereferences NULL on the first entry of -t plus a non-empty /etc/nokotan-types; mine doesn't exist, so fopen bails o/code> from the tail of theexisting list fixes it. file_patt is char[128] and patterns are read with fgets(line, 128, ...ern plus the prepended / overflows it by a byte via strcat. strncat with the remaining room, otime.

Can send patches if useful

alya/$ make
cc -Wall -g -c main.c -o main.o
cc -Wall -g -c lexan.c -o lexan.o
cc -Wall -g -c syntan.c -o syntan.o
cc -Wall -g -c refal_fsm.c -o refal_fsm.o
cc -Wall -g -c pmatch.c -o pmatch.o
cc -Wall -g -c builtin.c -o builtin.o
cc -Wall -g -c exp.c -o exp.o
exp.c: In function ‘is_balanced’:
exp.c:78:14: error: expected identifier or ‘*’ before ‘false’
   78 |         goto false;
      |              ^~~~~
exp.c:96:1: warning: statement with no effect [-Wunused-value]
   96 | false:
      | ^~~~~
exp.c:96:6: error: expected ‘;’ before ‘:’ token
   96 | false:
      |      ^
      |      ;
exp.c:106:1: warning: control reaches end of non-void function [-Wreturn-type]
  106 | }
      | ^
make: *** [Makefile:16: exp.o] Error 1
alya/$

To fix the error, I had to force make to use gcc with the -ansi flag (I also added -pedantic just in case), otherwise the standard cc compiler complains about the program text not conforming to some modern standard.

It would be better to set CC to gcc -ansi -pedantic by default in the Makefile rather than relying on the symlink.