bugfindutils - Bugs: bug #38673, locate segfaults

 
 

bug #38673: locate segfaults

Submitter:  Andreas Metzler <ametzler>
Submitted:  Sat 06 Apr 2013 07:07:09 AM UTC
   
 
Category:  locate Severity:  3 - Normal
Item Group:  None Status:  Duplicate
Privacy:  Public Assigned to:  jay
Originator Name:  Open/Closed:  Closed
Release:  4.5.11 Fixed Release:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 17 Apr 2013 05:03:22 PM UTC, comment #3: 

Hello,

I can confirm that this is is fixed by the patch already in Git refered to in 38239.

Sorry for submitting a duplicate report.

cu Andreas

Andreas Metzler <ametzler>
Tue 16 Apr 2013 05:11:01 PM UTC, comment #2: 

Looking in the git repository shows that the code was changed for #38239

=> this defect is a duplicate of #38239


(#38239 contains a link to the patch)

Bram <bram>
Tue 16 Apr 2013 12:03:59 PM UTC, comment #1: 

Using gdb on the core dump shows:

(gdb) bt
#0  splitstring (s=0x0, separators=0x8055922 ":", first=false, pos=0xbfcfe174, len=0xbfcfe178) at splitstring.c:58
#1  0x0804ae21 in dolocate (argc=2, argv=0xbfcfee44, secure_db_fd=-1) at locate.c:1892
#2  0x08049955 in main (argc=2, argv=0xbfcfee44) at locate.c:1940


locate.c:1892 contains:
     if (!splitstring (locate_path, path_separators, false,
                        &path_element_pos, &path_element_len))


Goign 'up' in the gdb session and printing locate_path shows:

(gdb) up
#1  0x0804ae21 in dolocate (argc=2, argv=0xbfd4c154, secure_db_fd=-1) at locate.c:1892
1892 locate.c: No such file or directory.
in locate.c
(gdb) print locate_path
$1 = 0x0
(gdb) print path_separators
$2 = 0x8055922 ":"


It appears that splitstring is unable to handle the null argument..

A work around for the segfault appears to be with setting the database:

  • 'locate foo' --> segfault
  • 'locate -d /var/db/locatedb foo' --> no segfault
  • 'LOCATE_PATH=/var/db/locatedb locate foo' --> no segfault


Not sure what the proper fix is tho..
Checking for null in splitstring.c and/or locate.c seems easy enough but is that the proper fix?

Bram <bram>
Sat 06 Apr 2013 07:07:09 AM UTC, original submission:  

Hello,

this is <http://bugs.debian.org/704193>: locate 4.5.11 segfaults reproducibly for at least two users. - Downgrading to 4.5.10 (or 4.4.2) fixes the issue.

<quote>
Here's an strace.  The segfault happens just AFTER locatedb is closed.
It also happens on a successful lookup.  I'm running i386 sid userland on an x86_64 kernel.

execve("/usr/bin/locate", ["locate", "qqqq"], [/* 24 vars */]) = 0
brk(0)                                  = 0x84a9000
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf77cd000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=145521, ...}) = 0
mmap2(NULL, 145521, PROT_READ, MAP_PRIVATE, 3, 0) = 0xf77a9000
close(3)                                = 0
access("/etc/ld.so.nohwcap", F_OK)      = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/i686/cmov/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\372\202M4\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1756536, ...}) = 0
mmap2(0x4d816000, 1764124, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x4d816000
mmap2(0x4d9bf000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a9) = 0x4d9bf000
mmap2(0x4d9c2000, 11036, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4d9c2000
close(3)                                = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf77a8000
set_thread_area({entry_number:-1 -> 12, base_addr:0xf77a8900, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0x805a000, 4096, PROT_READ)    = 0
mprotect(0x4d9bf000, 8192, PROT_READ)   = 0
mprotect(0x4d812000, 4096, PROT_READ)   = 0
munmap(0xf77a9000, 145521)              = 0
open("/var/cache/locate/locatedb", O_RDONLY|O_LARGEFILE) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC)         = 0
geteuid32()                             = $UID
getuid32()                              = $UID
getgid32()                              = $GID
setgid32($GID)                          = 0
brk(0)                                  = 0x84a9000
brk(0x84ca000)                          = 0x84ca000
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=21917714, ...}) = 0
time(NULL)                              = 1364566351
fcntl64(3, F_GETFL)                     = 0x8000 (flags O_RDONLY|O_LARGEFILE)
fstat64(3, {st_mode=S_IFREG|0644, st_size=21917714, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf77cc000
_llseek(3, 0, [0], SEEK_CUR)            = 0
read(3, ""..., 4096) = 4096

(Lots of additional reads omitted)

read(3, "", 4096)                       = 0
close(3)                                = 0
munmap(0xf77cc000, 4096)                = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++


Andreas Metzler <ametzler>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by jay (Updated the item)
  • -email is unavailable- added by bram (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-04-20 jay StatusNone Duplicate
        Assigned toNone jay
        Open/ClosedOpen Closed
    2013-04-06 ametzler Carbon-CopyRemoved 20807 -

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code