bugtexinfo - GNU documentation system - Bugs: bug #44099, info segfaults on xterm when...

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #44099: info segfaults on xterm when window height is very small

Submitted by:  Vitezslav Crhonek <vcrhonek>
Submitted on:  Tue 27 Jan 2015 12:34:37 PM UTC  
 
Category: infoRelease: 
Priority: 5 - NormalSeverity: 3 - Normal
Item Group: NonePrivacy: Public
Open/Closed: ClosedAssigned to: None
Status: Works For Me

Thu 29 Jan 2015 10:23:40 AM UTC, comment #2:

Thanks for your reply. I can confirm that it works fine in latest development revision (6074).

There's just minor issue - when compiling with "-Werror=format-security", the build fails:

info.c: In function 'main':
info.c:908:9: error: format not a string literal and no format arguments [-Werror=format-security]
info_error (error);
^
info.c:917:7: error: format not a string literal and no format arguments [-Werror=format-security]
info_error (error);

This can be easily fixed, patch attached.

I hope you don't mind that I'm attaching it to unrelated issue, I can report it separately, if necessary.

(file #32937)

Vitezslav Crhonek <vcrhonek>
Tue 27 Jan 2015 11:46:15 PM UTC, comment #1:

Thanks for your investigations. There has already been work on this bug. I believe the bug was due to SIGWINCH signals not being blocked correctly leading the display array, as you mention, being reallocated while in the middle of other code dealing with it. If you want to test if it's been fixed, please re-try with the latest development version. There have been quite a few changes since the last release so it would save your time if you looked at the most recent version rather than trying to patch up the last release.

Gavin D. Smith <gavin>
Project Administrator
Tue 27 Jan 2015 12:34:37 PM UTC, original submission:

Can be easily reproduced, just run "info", or "info info". I've seen it on Fedora and Arch Linux.

It's caused by double free error. Patch fixing it is attached.

But that helps only partially, there's still an issue in display_update_one_window() and display_node_text().

It fails on
display.c:138
if (entry->inverse

It seems that
DISPLAY_LINE *entry = display[win->first_row + pline_index];
is not NULL, but points into unallocated/unowned memory, which
causes segfault when accessing this memory.

I tried to workaround it, but my knowledge of the info code is not deep enough... See the second patch for illustration, it improves the situation a bit, but info still fails sometimes (although in different part of the program) and the output is not 100 % correct in all cases (window sizes).

Vitezslav Crhonek <vcrhonek>

 

Attached Files
file #32937:  format-security.patch added by vcrhonek (613B - application/mbox)
file #32916:  texinfo-5.2-double-free.patch added by vcrhonek (482B - application/mbox)
file #32917:  test.patch added by vcrhonek (1KiB - application/mbox)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by gavin (Posted a comment)
  • -unavailable- added by vcrhonek (Submitted the item)
  • -unavailable- added by vcrhonek
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 29 May 2015 09:14:28 PM UTCgavinOpen/ClosedOpen=>Closed
    Thu 29 Jan 2015 10:23:40 AM UTCvcrhonekAttached File-=>Added format-security.patch, #32937
    Tue 27 Jan 2015 11:46:15 PM UTCgavinStatusNone=>Works For Me
    Tue 27 Jan 2015 12:34:37 PM UTCvcrhonekAttached File-=>Added texinfo-5.2-double-free.patch, #32916
      Attached File-=>Added test.patch, #32917
      Carbon-Copy-=>Added vcrhonek

    Back to the top


    Powered by Savane 3.1-cleanup1