bugGNU Screen - Bugs: bug #50143, Core dump

 
 

bug #50143: Core dump

Submitted by:  None
Submitted on:  Wed 25 Jan 2017 08:03:50 AM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: Alexander Naumov <anaumov>
Open/Closed: ClosedRelease: 4.4.0
Fixed Release: 4.5.0Planned Release: None
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 11 Feb 2017 08:36:12 PM UTC, comment #5:

Ok, new patch has been added to the FreeBSD port:
https://svnweb.freebsd.org/ports?view=revision&revision=433828
Thanks to Cy Schubert for that.

No changes for the upstream code base needed.

I will close this report now.

Alexander Naumov <anaumov>
Project AdministratorIn charge of this item.
Sat 11 Feb 2017 05:51:24 AM UTC, comment #4:

r433828 committed in FreeBSD ports repo.

At line 434 of utmp.c (line 478 of original utmp.c).

Cy Schubert <cyschubert>
Mon 06 Feb 2017 10:24:48 PM UTC, comment #3:

Hi Valentin,
thank you for reporting.

Yes, I can't reproduce it on GNU/Linux.

Can you add NULL pointer check for win_old->w_layer.l_cvlist and try to reproduce it again?

..seems that I need to install FreeBSD.

Alexander Naumov <anaumov>
Project AdministratorIn charge of this item.
Wed 25 Jan 2017 12:29:14 PM UTC, comment #2:

Copying from D_loginhost in SetUtmp() is from FreeBSD port patch; stock version notes "host" here. This could trigger the crash only on FreeBSD.

But I'm still wondering whether it shall have a real display during showing a terminal list to the user.

Valentin Nechayev <netch>
Wed 25 Jan 2017 12:21:43 PM UTC, comment #1:

Reproducing with debug:

(gdb) bt
#0 0x28232b37 in thr_kill () from /lib/libc.so.7
#1 0x28232b2a in raise () from /lib/libc.so.7
#2 0x28232a76 in abort () from /lib/libc.so.7
#3 0x0804f1fa in CoreDump (sigsig=11) at screen.c:1686
#4 0xbfbff004 in ?? ()
#5 0x0000000b in ?? ()
#6 0x00000001 in ?? ()
#7 0xbfbfa320 in ?? ()
#8 0x00000c6c in ?? ()
#9 0x0804f040 in ParseEscape () at screen.c:3384
#10 0x0807d2e2 in SetUtmp (wi=0x2892a000) at utmp.c:434
#11 0x0807bf7b in WindowChangeNumber (old=2, dest=1) at window.c:2347
#12 0x080bfd4a in gl_Window_input (ldata=0x288031e0, inp=0xbfbfadac, len=0xbfbfad9c) at list_window.c:392
#13 0x080bc7ac in ListProcess (ppbuf=0xbfbfadac, plen=0xbfbfad9c) at list_generic.c:153
#14 0x0808c05d in DoProcess (p=0x0, bufp=0xbfbfadac, lenp=0xbfbfad9c, pa=0x0) at process.c:982
#15 0x0808bd5e in ProcessInput2 (ibuf=0xbfbfae37 "", ilen=0) at process.c:913
#16 0x0808b847 in ProcessInput (ibuf=0xbfbfae36 ",", ilen=-1) at process.c:874
#17 0x080a982f in disp_readev_fn (ev=0x288a6450, data=0x288a5e00 "") at display.c:3528
#18 0x080c097e in sched () at sched.c:237
#19 0x0804ea17 in main (ac=0, av=0xbfbfec44) at screen.c:1474

(gdb) f 10
#10 0x0807d2e2 in SetUtmp (wi=0x2892a000) at utmp.c:434
434 strncpy(u.ut_host, D_loginhost, sizeof(u.ut_host));

(gdb) l
429 if (!saved_ut)
430 makeuser(&u, stripdev(wi->w_tty), LoginName, wi->w_pid);
431
432 #ifdef UTHOST
433 # if !defined(SEQUENT) && !defined(sequent)
434 strncpy(u.ut_host, D_loginhost, sizeof(u.ut_host));
435 # endif
436 #endif /* UTHOST */
437
438 if (pututslot(slot, &u, D_loginhost, wi) == 0)

this is preprocessed to

strncpy(u.ut_host, display->d_utmp_logintty.ut_host, sizeof(u.ut_host));

but:

(gdb) p display
$12 = (struct display *) 0x0

The suspicious place is: WindowChangeNumber():

if (p && (p->w_slot != (slot_t) -1) && (p->w_slot != (slot_t) 0))
{
display = win_old->w_layer.l_cvlist ? win_old->w_layer.l_cvlist->c_display : 0;
RemoveUtmp(p);
SetUtmp(p);
}

Debug print here confirms there is an issue with display setting:
win_old->w_layer.l_cvlist is NULL during this check.

Valentin Nechayev <netch>
Wed 25 Jan 2017 08:03:50 AM UTC, original submission:

The following causes a core dump and/or unrecoverable terminal in FreeBSD:
run screen
in screen type
C-a c (make a new screen)
C-a c (make a new screen)
C-a " (get a list of the screens)
, (type comma and hit enter)
Core dumps, terminal may be unrecoverable
Running FreeBSD 11.0-RELEASE-p1

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by cyschubert (Posted a comment)
  • -unavailable- added by anaumov (Posted a comment)
  • -unavailable- added by netch (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 4 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Sat 11 Feb 2017 08:36:12 PM UTCanaumovStatusNone=>Fixed
      Open/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.5.0
    Thu 09 Feb 2017 03:07:18 PM UTCanaumovAssigned toNone=>anaumov

    Back to the top


    Powered by Savane 3.1-cleanup1