bugGNU Screen - Bugs: bug #26742, [Patch] Crash on altscreen toggle...

 
 

bug #26742: [Patch] Crash on altscreen toggle after a host-term resize from <255 to >255 columns

Submitter:  None
Submitted:  Thu 04 Jun 2009 03:38:04 PM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  4 - Important
Priority:  * 7 - High Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  Cur Dev Sources
Fixed Release:  4.1.0 Planned Release:  4.1.0
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Thu 08 Mar 2012 02:17:40 PM UTC, comment #17: 

It seems that current git version of screen suffers from very similar issue.
More:
https://bugzilla.redhat.com/show_bug.cgi?id=784504

Anonymous
Wed 23 Sep 2009 08:41:14 PM UTC, comment #16: 

Thank you Enrico for the patches.

I committed a slightly modified version of the second patch (and updated ->w_alt_hlines too).

Commits: 7cb17d54cc8fca88e17d6d1e7be2fd49daef1b9d and 45d0c395945d2ae0f99748d030a8bffcb4cb46f9

Sadrul Habib Chowdhury <sadrul>
Group administrator
Tue 15 Sep 2009 08:07:44 AM UTC, comment #15: 

@comment #14:

does it still happen with the two patches?

Enrico Scholz <ensc>
Tue 15 Sep 2009 07:12:24 AM UTC, comment #14: 

The same happens when piping an attachment in mutt inside of screen (using urxvt). It works if there are less than 255 columns.

Anonymous
Wed 05 Aug 2009 09:07:19 AM UTC, comment #13: 

Great, this appears to be fixed now.

I got a warning when applying the patch though, I'm not sure if it's of any consequence:
[jpickard@kaffaljidhm:~/downloads/screen-41daa2215ae124e6b24fb25346f3baa36dfe98b6]$ git-apply 0001-Fixed-reallocations-while-resizing-windows.patch
0001-Fixed-reallocations-while-resizing-windows.patch:36: trailing whitespace.
static void
warning: 1 line adds whitespace errors.

Thanks

James

Anonymous
Tue 04 Aug 2009 07:54:45 PM UTC, comment #12: 

You are right; there is an additional issue detected by valgrind with


==25303== Invalid read of size 1
==25303==    at 0x41CFCF: ChangeWindowSize (resize.c:777)
==25303==    by 0x41DFD7: LeaveAltScreen (resize.c:1074)
==25303==    by 0x40E042: DoCSI (ansi.c:1432)
==25303==    by 0x40BD68: WriteString (ansi.c:590)
==25303==    by 0x4277CB: win_readev_fn (window.c:1909)
==25303==    by 0x45ACF8: sched (sched.c:237)
==25303==    by 0x40611A: main (screen.c:1459)
==25303==  Address 0x50ee080 is 128 bytes inside a block of size 256 free'd
==25303==    at 0x4A0776F: realloc (vg_replace_malloc.c:429)
==25303==    by 0x41C847: xrealloc (resize.c:601)
==25303==    by 0x41C559: CheckMaxSize (resize.c:510)
==25303==    by 0x41B6EB: ChangeScreenSize (resize.c:178)
==25303==    by 0x41B579: CheckScreenSize (resize.c:140)
==25303==    by 0x41FF07: ReceiveMsg (socket.c:1108)
==25303==    by 0x409CCA: serv_read_fn (screen.c:3097)
==25303==    by 0x45ACF8: sched (sched.c:237)
==25303==    by 0x40611A: main (screen.c:1459)


The new (additional) patch should fix this.


(file #18525)

Enrico Scholz <ensc>
Tue 04 Aug 2009 08:47:10 AM UTC, comment #11: 

I tried the patch. It seems to now be fixed if the window has at any point been greater than 255 columns after screen was launched. For me, the crash still occurs if the window is 255 columns or less when screen is launched, and is resized to greater than 255 columns for the first time while vim is running.

Thanks for the patch!

James

Anonymous
Sat 01 Aug 2009 12:50:21 PM UTC, comment #10: 

should be fixed by attached patch

Enrico Scholz <ensc>
Sat 01 Aug 2009 11:58:52 AM UTC, comment #9: 

ditto in Fedora 11 (see
https://bugzilla.redhat.com/show_bug.cgi?id=515055). There, valgrind
reports




==2344== Invalid free() / delete / delete[]
==2344== at 0x4A0776F: realloc (vg_replace_malloc.c:429)
==2344== by 0x415474: xrealloc (resize.c:638)
==2344== by 0x41555A: CheckMaxSize (resize.c:554)
==2344== by 0x4172AA: ChangeScreenSize (resize.c:211)
==2344== by 0x4256D8: InitTermcap (termcap.c:411)
==2344== by 0x417705: FinishAttach (socket.c:1152)
==2344== by 0x419561: ReceiveMsg (socket.c:998)
==2344== by 0x44407A: sched (sched.c:232)
==2344== by 0x405E86: main (screen.c:1374)
==2344== Address 0x50f0f80 is 0 bytes inside a block of size 256 free'd
==2344== at 0x4A0776F: realloc (vg_replace_malloc.c:429)
==2344== by 0x415474: xrealloc (resize.c:638)
==2344== by 0x41556F: CheckMaxSize (resize.c:556)
==2344== by 0x4172AA: ChangeScreenSize (resize.c:211)
==2344== by 0x4256D8: InitTermcap (termcap.c:411)
==2344== by 0x405C83: main (screen.c:1283)
==2344==
==2344== Invalid free() / delete / delete[]
==2344== at 0x4A0633D: free (vg_replace_malloc.c:323)
==2344== by 0x4154A1: xrealloc (resize.c:640)
==2344== by 0x41555A: CheckMaxSize (resize.c:554)
==2344== by 0x4172AA: ChangeScreenSize (resize.c:211)
==2344== by 0x4256D8: InitTermcap (termcap.c:411)
==2344== by 0x417705: FinishAttach (socket.c:1152)
==2344== by 0x419561: ReceiveMsg (socket.c:998)
==2344== by 0x44407A: sched (sched.c:232)
==2344== by 0x405E86: main (screen.c:1374)
==2344== Address 0x50f0f80 is 0 bytes inside a block of size 256 free'd
==2344== at 0x4A0776F: realloc (vg_replace_malloc.c:429)
==2344== by 0x415474: xrealloc (resize.c:638)
==2344== by 0x41556F: CheckMaxSize (resize.c:556)
==2344== by 0x4172AA: ChangeScreenSize (resize.c:211)
==2344== by 0x4256D8: InitTermcap (termcap.c:411)
==2344== by 0x405C83: main (screen.c:1283)


Enrico Scholz <ensc>
Fri 26 Jun 2009 11:04:47 AM UTC, comment #8: 

Hello all!

I can reproduce the freeze.
I run rxvt-unicode, bash and the latest screen from git sources.

Some sample dmesg lines for those crashes:
[11205954.700597] screen[2983]: segfault at 0 ip 7facc4457a23 sp 7fffcd1df1a0 error 4 in libc-2.7.so[7facc43e2000+14a000]
[11212856.251055] screen[3633]: segfault at c ip f7dc2318 sp ffe27030 error 4 in libc-2.7.so[f7d56000+138000]
[11212931.800760] screen[3687]: segfault at c ip f7e81318 sp ff9e7b90 error 4 in libc-2.7.so[f7e15000+138000]
[11213285.905693] screen[3859]: segfault at c ip f7e26318 sp ffd8afa0 error 4 in libc-2.7.so[f7dba000+138000]
[11213506.847455] screen[3937]: segfault at c ip f7e3c318 sp ff8a22c0 error 4 in libc-2.7.so[f7dd0000+138000]

I didn't manage to produce a core file (it just didn't appear), nor was I able to attach GDB during the crash (ptrace failed).

ps faux said:
username      4466  0.0  0.0   5656   984 pts/5    S+   14:03   0:00      \_ ./screen
username      4467  0.8  0.0      0     0 ?        Zs   14:03   0:00          \_ [screen] <defunct>

Anonymous
Fri 05 Jun 2009 05:23:54 PM UTC, comment #7: 

Well, current sources still seem to exhibit this problem, and I can't find a duplicate for this bug.

Micah Cowan <micahcowan>
Fri 05 Jun 2009 05:13:32 PM UTC, comment #6: 

Ah, okay, well that explains why I couldn't reproduce: on my laptop, a maximized window extends to ~224 columns.

This rings a vague bell; I think we may have fixed this in the dev sources. Looking into it...

Micah Cowan <micahcowan>
Fri 05 Jun 2009 11:35:46 AM UTC, comment #5: 

Sorry I forgot to add the Ubuntu screen package.

[jpickard@kaffaljidhm:~]$ dpkg -l ubuntu | cat
No packages found matching ubuntu.
[jpickard@kaffaljidhm:~]$ dpkg -l screen | cat
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Installed/Config-f/Unpacked/Failed-cfg/Half-inst/t-aWait/T-pend
|/ Err?=(none)/Hold/Reinst-required/X=both-problems (Status,Err: uppercase=bad)
||/ Name                                                           Version                                                    Description
+++-==============================================================-==========================================================-=======================================================
ii  screen

Anonymous
Fri 05 Jun 2009 09:37:52 AM UTC, comment #4: 

SHELL=/usr/bin/zsh

But also happens reliably on a different computer using bash.

What I meant by "goes dead" is that the window appears to crash. I can resize the window, but it accepts no input, including "C-a", and doesn't redraw properly.

screen -ls shows this:
7140.pts-9.kaffaljidhm  (Dead ???)

I've investigated some more, it seems to occur when the window is 255 columns wide or less before vim is opened, but is 256 columns wide or greater when the :sh command is executed.

Thanks for looking at this.

Anonymous
Thu 04 Jun 2009 08:36:09 PM UTC, comment #3: 

Also, what the value of $SHELL is for you, and what exactly you mean by "goes dead", are important data. Does screen stop responding to "C-a ?"? Does "screen -ls" in another terminal show a dead socket? What actually happens for you?

Micah Cowan <micahcowan>
Thu 04 Jun 2009 08:07:02 PM UTC, comment #2: 

Not for me, it doesn't. Need a reliable way to reproduce.

Tested with development version, and with Ubuntu's screen-4.0.3-11

Please specify which version of the Ubuntu screen package you're using ("dpkg -l ubuntu | cat"), and provide a reliable way to reproduce.

Micah Cowan <micahcowan>
Thu 04 Jun 2009 04:15:27 PM UTC, comment #1: 

Also happens with urxvt, gnome-terminal, Eterm

Anonymous
Thu 04 Jun 2009 03:38:04 PM UTC, original submission:  

To reproduce:
Add 'altscreen on' in ~/.screenrc
Open xterm
Start screen
Open vim
Maximise xterm window
Try to drop into shell by executing :sh command

The screen session is now dead.

This occurs when executing any vim command that drops into a shell, such as :grep or any command that starts with an exclamation mark (!).

Tested with:
OS: Ubuntu 8.04.2
Gnome version 2.22.3
Xterm versions: X.Org 6.9.0(243), XTerm(229)
Screen versions: 4.1.0w.127-710, 4.00.03 (FAU) 23-Oct-06
Vim version: 7.2

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #18509:  0001-Fixed-abort-on-certain-window-resize-operations.patch added by ensc (966B - text/x-diff - simple paste & copy typo...)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by sadrul (Posted a comment)
  • -email is unavailable- added by ensc (Posted a comment)
  • -email is unavailable- added by micahcowan (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 12 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2009-09-23 sadrul StatusConfirmed Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.1.0
    2009-08-04 ensc Attached File- Added 0001-Fixed-reallocations-while-resizing-windows.patch, #18525
    2009-08-01 micahcowan SummaryCrash on altscreen toggle after a host-term resize from &lt;255 to &gt;255 columns [Patch] Crash on altscreen toggle after a host-term resize from <255 to >255 columns
    2009-08-01 ensc Attached File- Added 0001-Fixed-abort-on-certain-window-resize-operations.patch, #18509
    2009-06-05 micahcowan Severity3 - Normal 4 - Important
        Priority5 - Normal 7 - High
        StatusNeed Info Confirmed
        SummaryScreen goes dead when dropping to shell from vim with \'altscreen on\' in .screenrc Crash on altscreen toggle after a host-term resize from <255 to >255 columns
    2009-06-04 micahcowan StatusNone Need Info
        Planned ReleaseNone 4.1.0

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code