bugGNU Screen - Bugs: bug #35757, Switching from altscreen after...

 
 

bug #35757: Switching from altscreen after window resize causes segfault in resize.c:750

Submitted by:  None
Submitted on:  Thu 08 Mar 2012 06:18:21 AM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedRelease: 4.2.1
Fixed Release: NonePlanned Release: Later
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 22 Jun 2015 04:01:57 PM UTC, comment #10:

I can't reproduce it using v4.3.0.
It looks like this problem is FIXED.

Thanks again for submitting bug report ;-)

Alexander Naumov <anaumov>
Project Administrator
Sat 31 May 2014 06:05:26 PM UTC, comment #9:

That fixes it as far as I'm concerned. Thanks, Amadeusz!

Erik Falor <ewfalor>
Fri 23 May 2014 09:19:38 AM UTC, comment #8:

Ok, I've rechecked, patch from comment #4 seems to fix this so I applied it, can you check again?

Amadeusz Sławiński <amade>
Project Administrator
Fri 23 May 2014 05:10:33 AM UTC, comment #7:

I just tested this on 32-bit Slackware 14.1 using commit 8ffd5f46 from May 17, 2014, and the segfault is still present :(

Erik Falor <ewfalor>
Fri 23 May 2014 04:47:14 AM UTC, comment #6:

I just tested this out afresh, and I'm seeing today (on commit ) the exact same thing as I did two years ago:

(gdb) frame 4
#4 0x000000000041e09f in ChangeWindowSize (p=0x22a9730, wi=180, he=70, hi=2048) at resize.c:766
766 if (ml->image[p->w_width] == ' ')
(gdb) print*ml
$1 = {
image = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
attr = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
font = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
fontx = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
color = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>
}

I should point out that this is happening on Linux x86_64; when I try the very same procedure on with a 64-bit build of screen on AIX 7.1 it does not crash.

I'll try to test this out on my 32-bit Linux laptop tomorrow to see if it's a Linux thing or a 64-bit Linux thing.

Erik Falor <ewfalor>
Wed 23 Apr 2014 06:54:03 PM UTC, comment #5:

This commit on screen-v4 branch should fix this issue
http://git.savannah.gnu.org/cgit/screen.git/commit/?h=screen-v4&id=049a3bfdfc59590a24dfeefa707abb64b74ae17b

Amadeusz Sławiński <amade>
Project Administrator
Mon 30 Apr 2012 09:41:04 AM UTC, comment #4:

I have an idea, but I am not sure if I am not completely wrong. When is screen calculating resize it uses current cursor location, but I think that it should use the position where the cursor was before entering altscreen. I have tried this small modification and segfault is gone.

diff --git a/src/ansi.c b/src/ansi.c
index d88e153..8df79b2 100644
--- a/src/ansi.c
+++ b/src/ansi.c
@@ -1438,8 +1438,8 @@ int c, intermediate;
}
else
{
- LeaveAltScreen(curr);
RestoreCursor(&curr->w_alt.cursor);
+ LeaveAltScreen(curr);
}
if (a1 == 47 && !i)
curr->w_saved.on = 0;

Lukáš Nykrýn <lnykryn>
Wed 14 Mar 2012 07:48:06 PM UTC, comment #3:

I hate to say it, but this fix covers only the case outlined in my original Steps to Reproduce. If you instead follow these steps, you'll get a segfault again:

Steps to reproduce:
0. Launch screen and set ":altscreen on" (use the attached crash.screenrc)
1. Split into two regions
2. Use the 'screen' command to launch a program that will use the altscreen (eg. C-a :screen vim)
3. Execute :only to kill the other region; now vim is using the entire screen
4. Exit vim. (that's :q for you Emacs folks). Screen segfaults at this point.

When I probe the core file left behind, I see this:

(gdb) frame 4
#4 0x00000000004202d8 in ChangeWindowSize (p=0x24f1e60, wi=80, he=60, hi=100)
at resize.c:752
752 if (ml->image[p->w_width] == ' ')
(gdb) print *ml
$1 = {
image = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
attr = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
font = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
color = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>
}

Somehow (struct mline *) ml now contains a bunch of ASCII space characters.

Erik Falor <ewfalor>
Wed 14 Mar 2012 04:46:19 PM UTC, comment #2:

Thanks for the speedy fix, Sadrul!

Erik Falor <ewfalor>
Wed 14 Mar 2012 01:48:47 AM UTC, comment #1:

Hi! Thanks for reporting the bug. It should be fixed by http://git.savannah.gnu.org/cgit/screen.git/commit/?id=3c2946ed7b773370924e34b07e78015c87a3e325

Sadrul Habib Chowdhury <sadrul>
Project Administrator
Thu 08 Mar 2012 06:18:21 AM UTC, original submission:

The crash happens in the function ChangeWindowSize() at resize.c:750 while trying to dereference a structure's member.

f9535294 is the first bad commit

Steps to reproduce:
0. Launch screen and set ":altscreen on" (use the attached crash.screenrc)
1. Split into two regions
2. Launch a program that will use the altscreen (eg. vim)
3. Execute :only to kill the other region; now vim is using the entire screen
4. Exit vim. (that's :q for you Emacs folks). Screen segfaults at this point.

This is the code at the point of the problem:

749 ml = OLDWIN(yy);
750 if (ml->image[p->w_width] == ' ')

OLDWIN returns NULL in this case.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #25292:  crash.screenrc added by None (47B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by anaumov (Posted a comment)
  • -unavailable- added by amade (Posted a comment)
  • -unavailable- added by lnykryn (Posted a comment)
  • -unavailable- added by ewfalor (Posted a comment)
  • -unavailable- added by sadrul (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 14 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 22 Jun 2015 04:13:33 PM UTCanaumovOpen/ClosedOpen=>Closed
    Mon 22 Jun 2015 04:01:57 PM UTCanaumovStatusIn Progress=>Fixed
    Fri 23 May 2014 09:19:38 AM UTCamadeStatusFixed=>In Progress
      Open/ClosedClosed=>Open
    Sun 27 Apr 2014 11:10:34 PM UTCamadeOpen/ClosedOpen=>Closed
      ReleaseCur Dev Sources=>4.2.1
    Wed 23 Apr 2014 06:54:03 PM UTCamadeStatusNone=>Fixed
      Planned Release4.1.0=>Later
    Thu 26 Apr 2012 11:30:13 AM UTCsadrulPlanned ReleaseNone=>4.1.0
    Thu 26 Apr 2012 11:29:30 AM UTCsadrulOpen/ClosedClosed=>Open
      Fixed Release4.1.0=>None
    Wed 14 Mar 2012 01:48:47 AM UTCsadrulOpen/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.1.0
    Thu 08 Mar 2012 06:18:21 AM UTCNoneAttached File-=>Added crash.screenrc, #25292

    Back to the top


    Powered by Savane 3.1-cleanup1