GNU Coreutils fixes argument corruption bug in nl utility

A critical bug fix has been submitted to GNU Coreutils addressing an argument corruption issue within the nl utility. The flaw allowed for memory corruption when the command was invoked with multiple -d delimiter arguments, potentially affecting the integrity of file operands or command-line strings.

This vulnerability has been present since the release of Coreutils 9.0. The fix ensures that the internal section delimiter pointer is correctly reset to a static buffer before the single-character delimiter is constructed, preventing writes from overflowing into existing argv strings.

Technical details of the nl corruption

• Memory Corruption Mechanism: The utility used a pointer, section_del, which could point to an existing argument in the argv array after processing a -d flag; subsequent writes would then overflow that argument's memory.
• Locale-Specific Behavior: In a UTF-8 locale, an input like 'nl -d "" FILE -d x' would corrupt the FILE operand, while in a C locale, 'nl -d foo -d x' would result in the incorrect delimiter 'xoo'.
• Code Correction: The patch modifies src/nl.c to ensure section_del is pointed at the static DEFAULT_SECTION_DELIMITERS buffer before the single-character delimiter is built.
• Regression Testing: New test cases have been added to tests/nl/nl.sh and tests/nl/multibyte.sh to prevent future occurrences of this memory safety issue.

Why it matters

As a fundamental component of nearly every Linux distribution, a fix in GNU Coreutils ensures the stability and security of basic shell scripting and text processing. This prevents potential exploitation or unexpected behavior in automated system administration scripts that rely on nl for formatted output.