bugGNU Screen - Bugs: bug #18895, crash if .screenrc contains chdir...

 
 

bug #18895: crash if .screenrc contains chdir to non existing directory

Submitted by:  Vadim Zeitlin <zeitlin>
Submitted on:  Sun 28 Jan 2007 02:42:36 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Need Investigation
Privacy: PublicAssigned to: None
Open/Closed: OpenRelease: None
Fixed Release: NonePlanned Release: 4.1.0
Work Required: 0 - Hours

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Fri 18 Jul 2008 09:24:37 PM UTC, comment #13:

No, not really.
This is what I did yesterday:

cat <<EOF > /tmp/xx
chdir /foo/bar
chdir /foojlkjhlkjhljkhkjhlkjhlkjhlkjhlkjhlkjhlkjhlkjhlkjhhlkjhlkj/bar
EOF

ltrace -f -o x -s500 ./screen -c /tmp/xx

But as soon as tried to approach this with gdb or valgrind, everything was okay.

Juergen Weigert <jnweiger>
Project Administrator
Fri 18 Jul 2008 08:07:04 PM UTC, comment #12:

Sounds like it's not just a FreeBSD thing, then.

Juergen, I don't suppose you can craft a script that reproduces this reliably for you?

Micah Cowan <micahcowan>
Fri 18 Jul 2008 09:47:17 AM UTC, comment #11:

I was testing on latest SUSE linux with latest git checkout.
Have no FreebSD here, sorry.
My concern is, that his resolution is just no longer triggering the bug, although it is still there.

Juergen Weigert <jnweiger>
Project Administrator
Thu 17 Jul 2008 10:34:29 PM UTC, comment #10:

Hm, Juergen, were you also testing on FreeBSD? The OP apparently resolved the issue simply by an updated ports tree; it seems that either the issue was originally with the package, or else the packager found the problem and fixed it (in which case, it'd have been better if they'd notified us...).

Perhaps looking at the last couple versions of the FreeBSD screen package will be informative.

Reopening so we don't forget to check it out, to be sure.

Micah Cowan <micahcowan>
Thu 17 Jul 2008 12:59:04 PM UTC, comment #9:

I'd suspect this is the strncpy() in screen.c:Msg().
Is it possible that strerror() returns NULL in FreeBSD?
Still I doubt, this is the cause.

I tried to reproduce, and had a crash, while running under ltrace, but no crash while under gdb.
the crash with ltrace happened at different locations.
once in execve(), once in unlockpt() and once in strcmp_chk().

This indicates memory corruption.

Juergen Weigert <jnweiger>
Project Administrator
Thu 17 Jul 2008 03:52:58 AM UTC, comment #8:

Hm. Wonder if it was a FreeBSD packager's patch, then. Thanks for the update!

Micah Cowan <micahcowan>
Thu 17 Jul 2008 02:41:45 AM UTC, comment #7:

I've updated to the latest ports version and now the non-debug version works too so this really can be closed (I don't seem to have permissions to do it myself though).

Vadim Zeitlin <zeitlin>
Wed 16 Jul 2008 08:59:52 PM UTC, comment #6:

Does "make WITH_DEBUG=1" do anything besides adding a -g flag to compilation? If so, you might hack the sources or makefile (or possibly just set your own CFLAGS) so that -g is added, without making any other changes from what a normal make would do.

As it is, it's somewhat instructive to at least see that it segfaults in a string-copying function. But yeah, not enough information.

Micah Cowan <micahcowan>
Wed 16 Jul 2008 08:29:58 PM UTC, comment #5:

Unfortunately this bug is nastier than I thought -- it doesn't manifest itself when screen is built with debug ("make WITH_DEBUG=1" in /usr/ports/sysutils/screen). And while I can still it reproduce it 100% reliably with the packaged version it doesn't have any symbols and so doesn't provide any useful information:

Program terminated with signal 11, Segmentation fault.
(gdb) bt
#0 0x0000000800aaf858 in strncpy () from /lib/libc.so.6
#1 0x000000000040398b in ?? ()
#2 0x000000000042f1fb in ?? ()
#3 0x0000000000430c12 in ?? ()
#4 0x000000000040f1be in ?? ()
#5 0x000000000040fdd5 in ?? ()
#6 0x0000000000407af0 in ?? ()
#7 0x0000000000402f2e in ?? ()
#8 0x000000080056f000 in ?? ()
#9 0x0000000000000000 in ?? ()
... and so on and so forth but the last frame is obviously invalid so it doesn't matter ...

I guess this bug should be forwarded to screen port maintainer in FreeBSD but unfortunately I don't even know how to do it.

Anyhow, I don't see what you can do about it if you can't reproduce it so I guess it should be just closed.

Thanks,
VZ

Vadim Zeitlin <zeitlin>
Fri 11 Jul 2008 01:59:47 AM UTC, comment #4:

I cannot seem to reproduce this in Linux, either in 4.0.03 or in the git version. A backtrace would indeed be helpful.

Sadrul Habib Chowdhury <sadrul>
Project Administrator
Mon 16 Jun 2008 01:40:14 AM UTC, comment #3:

Mostly, it just means I'll look into it when I can (and I need to verify that it's still a problem, look into appropriate solutions, etc).

Micah Cowan <micahcowan>
Sun 15 Jun 2008 11:36:25 AM UTC, comment #2:

Is there anything I can do in order to confirm this bug?

Thanks!

Vadim Zeitlin <zeitlin>
 Spam posted by an anonymous
Sun 28 Jan 2007 02:46:45 PM UTC, comment #1:

Oops, sorry, I forgot to mention that this is for amd64 version.

Vadim Zeitlin <zeitlin>
Sun 28 Jan 2007 02:42:36 PM UTC, original submission:

Reproduced in a freshly installed (in a VmWare 6 virtual machine but it really shouldn't matter) FreeBSD 6.2 system:

1. Install screen version 4.00.03 (FAU) 23-Oct-06 from the ports collection in the usual way (i.e. "make" without any special options)

2. screen works

3. echo "chdir /bloordyblop > ~/.screenrc"

4. now screen core dumps (can recompile with stack available if needed, i.e. if there is any problem with reproducing this)

FWIW chdir without argument and chdir to an existing directory work just fine.

Vadim Zeitlin <zeitlin>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jnweiger (Posted a comment)
  • -unavailable- added by sadrul (Posted a comment)
  • -unavailable- added by micahcowan (Updated the item)
  • -unavailable- added by zeitlin (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 10 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Thu 17 Jul 2008 10:34:29 PM UTCmicahcowanStatusWorks For Me=>Need Investigation
      Open/ClosedClosed=>Open
    Thu 17 Jul 2008 03:52:58 AM UTCmicahcowanStatusNeed Investigation=>Works For Me
      Open/ClosedOpen=>Closed
    Mon 23 Jun 2008 10:01:53 PM UTCmicahcowanCategoryNone=>Crash/Freeze/Infloop
      Priority4=>5 - Normal
      Planned ReleaseNone=>4.1.0
      Work RequiredNone=>0 - Hours
    Sun 15 Jun 2008 07:47:09 AM UTCmicahcowanPriority5 - Normal=>4
      StatusNone=>Need Investigation

    Back to the top


    Powered by Savane 3.1-cleanup1