bugfindutils - Bugs: bug #38673, locate segfaults

 
 

bug #38673: locate segfaults

Submitted by:  Andreas Metzler <ametzler>
Submitted on:  Sat 06 Apr 2013 07:07:09 AM UTC  
 
Category: locateSeverity: 3 - Normal
Item Group: NoneStatus: Duplicate
Privacy: PublicAssigned to: James Youngman <jay>
Originator Name: Open/Closed: Closed
Release: 4.5.11Fixed Release: None

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Wed 17 Apr 2013 05:03:22 PM UTC, comment #3:

Hello,

I can confirm that this is is fixed by the patch already in Git refered to in 38239.

Sorry for submitting a duplicate report.

cu Andreas

Andreas Metzler <ametzler>
Tue 16 Apr 2013 05:11:01 PM UTC, comment #2:

Looking in the git repository shows that the code was changed for #38239

=> this defect is a duplicate of #38239

(#38239 contains a link to the patch)

Bram <bram>
Tue 16 Apr 2013 12:03:59 PM UTC, comment #1:

Using gdb on the core dump shows:

(gdb) bt
#0 splitstring (s=0x0, separators=0x8055922 ":", first=false, pos=0xbfcfe174, len=0xbfcfe178) at splitstring.c:58
#1 0x0804ae21 in dolocate (argc=2, argv=0xbfcfee44, secure_db_fd=-1) at locate.c:1892
#2 0x08049955 in main (argc=2, argv=0xbfcfee44) at locate.c:1940

locate.c:1892 contains:
if (!splitstring (locate_path, path_separators, false,
&path_element_pos, &path_element_len))

Goign 'up' in the gdb session and printing locate_path shows:

(gdb) up
#1 0x0804ae21 in dolocate (argc=2, argv=0xbfd4c154, secure_db_fd=-1) at locate.c:1892
1892 locate.c: No such file or directory.
in locate.c
(gdb) print locate_path
$1 = 0x0
(gdb) print path_separators
$2 = 0x8055922 ":"

It appears that splitstring is unable to handle the null argument..

A work around for the segfault appears to be with setting the database:

  • 'locate foo' --> segfault
  • 'locate -d /var/db/locatedb foo' --> no segfault
  • 'LOCATE_PATH=/var/db/locatedb locate foo' --> no segfault

Not sure what the proper fix is tho..
Checking for null in splitstring.c and/or locate.c seems easy enough but is that the proper fix?

Bram <bram>
Sat 06 Apr 2013 07:07:09 AM UTC, original submission:

Hello,

this is <http://bugs.debian.org/704193>: locate 4.5.11 segfaults reproducibly for at least two users. - Downgrading to 4.5.10 (or 4.4.2) fixes the issue.

<quote>
Here's an strace. The segfault happens just AFTER locatedb is closed.
It also happens on a successful lookup. I'm running i386 sid userland on an x86_64 kernel.

execve("/usr/bin/locate", ["locate", "qqqq"], [/* 24 vars */]) = 0
brk(0) = 0x84a9000
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
mmap2(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf77cd000
access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat64(3, {st_mode=S_IFREG|0644, st_size=145521, ...}) = 0
mmap2(NULL, 145521, PROT_READ, MAP_PRIVATE, 3, 0) = 0xf77a9000
close(3) = 0
access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
open("/lib/i386-linux-gnu/i686/cmov/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0P\372\202M4\0\0\0"..., 512) = 512
fstat64(3, {st_mode=S_IFREG|0755, st_size=1756536, ...}) = 0
mmap2(0x4d816000, 1764124, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x4d816000
mmap2(0x4d9bf000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1a9) = 0x4d9bf000
mmap2(0x4d9c2000, 11036, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x4d9c2000
close(3) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf77a8000
set_thread_area({entry_number:-1 -> 12, base_addr:0xf77a8900, limit:1048575, seg_32bit:1, contents:0, read_exec_only:0, limit_in_pages:1, seg_not_present:0, useable:1}) = 0
mprotect(0x805a000, 4096, PROT_READ) = 0
mprotect(0x4d9bf000, 8192, PROT_READ) = 0
mprotect(0x4d812000, 4096, PROT_READ) = 0
munmap(0xf77a9000, 145521) = 0
open("/var/cache/locate/locatedb", O_RDONLY|O_LARGEFILE) = 3
fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
geteuid32() = $UID
getuid32() = $UID
getgid32() = $GID
setgid32($GID) = 0
brk(0) = 0x84a9000
brk(0x84ca000) = 0x84ca000
ioctl(1, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
fstat64(3, {st_mode=S_IFREG|0644, st_size=21917714, ...}) = 0
time(NULL) = 1364566351
fcntl64(3, F_GETFL) = 0x8000 (flags O_RDONLY|O_LARGEFILE)
fstat64(3, {st_mode=S_IFREG|0644, st_size=21917714, ...}) = 0
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0xf77cc000
_llseek(3, 0, [0], SEEK_CUR) = 0
read(3, ""..., 4096) = 4096

(Lots of additional reads omitted)

read(3, "", 4096) = 0
close(3) = 0
munmap(0xf77cc000, 4096) = 0
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV +++

Andreas Metzler <ametzler>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by jay (Updated the item)
  • -unavailable- added by bram (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 20 Apr 2013 11:42:22 AM UTCjayStatusNone=>Duplicate
      Assigned toNone=>jay
      Open/ClosedOpen=>Closed
    Sat 06 Apr 2013 07:10:23 AM UTCametzlerCarbon-CopyRemoved 20807=>-

    Back to the top


    Powered by Savane 3.1-cleanup