bugGNU troff - Bugs: bug #48433, lkbib with empty file dumps core

 
 

bug #48433: lkbib with empty file dumps core

Submitted by:  Osamu Sayama <sayama>
Submitted on:  Thu 07 Jul 2016 07:02:31 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: CrashStatus: Ready For Test
Privacy: PublicAssigned to: Carsten Kunze <carstenkunze>
Open/Closed: OpenPlanned Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 07 Jul 2016 07:02:31 AM UTC, original submission:

In Solaris, I got the bug report that lkbib dumps core with the following operation.
---
% touch ./a.i
% LD_PRELOAD=libumem.so.1 UMEM_OPTIONS=backend=mmap \
UMEM_DEBUG=default,firewall=1 /usr/bin/lkbib -p ./a
Segmentation Fault (core dumped)
% pstack core
core 'core' of 1509: /usr/bin/lkbib -p ./a
00000000004094fa _1cRindex_search_itemEload6Mi_i () + 10a
0000000000409ad0 _1cWmake_index_search_item6Fpkci_pnLsearch_item_ () + e0
000000000040ea47 _1cLsearch_listIadd_file6Mpkci_v () + 27
0000000000408614 main () + f4
00000000004083a4 ???????? ()
---

Then it looks that this core dump occurs at the following point.
---
src/libs/libbib/index.cpp
;
int index_search_item::load(int fd)
:
mtime = sb.st_mtime;
int size = int(sb.st_size); <= size is 0
:
map_addr = mapread(fd, size);
:
else {
addr = buffer = (char *)malloc(size); <= malloc(0)
:
header = (index_header )addr; <= Segv
---

From the specification of malloc() in the standard (ex, C11),
---
I can see C11 draft version from
http://open-std.org/JTC1/SC22/WG14/www/docs/n1548.pdf
p 347 7.22.3 Memory management functions
--
If the size of the space requested is zero, the behavior is
implementation-defined: either a null pointer is returned, or the behavior
is as if the size were some nonzero value, except that the returned pointer
shall not be used to access an object.
---
There is the possibility that it returns pointer shall not be used to access
an object on some platform. So I think it's nice to check the size of file
to avoid core dump.
---
--- groff-1.22.3/src/libs/libbib/index.cpp.org 2014-11-04 17:38:35.183524522 +0900
+++ groff-1.22.3/src/libs/libbib/index.cpp 2016-07-07 09:41:11.572149218 +0900
@@ -158,6 +158,10 @@
}
mtime = sb.st_mtime;
int size = int(sb.st_size);
+ if (size == 0) {
+ error("`%1' is an empty file", name);
+ return 0;
+ }
char *addr;
map_addr = mapread(fd, size);
if (map_addr) {
---

Osamu Sayama <sayama>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by carstenkunze (Updated the item)
  • -unavailable- added by sayama (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Fri 28 Apr 2017 09:57:34 PM UTCcarstenkunzeStatusNone=>Ready For Test
      Assigned toNone=>carstenkunze

    Back to the top


    Powered by Savane 3.1-cleanup1