bugGNU Screen - Bugs: bug #51402, SEGFAULT when querying 'info' on...

 
 

bug #51402: SEGFAULT when querying 'info' on detached screen

Submitted by:  None
Submitted on:  Thu 06 Jul 2017 01:53:12 PM UTC  
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  4.6.0
Fixed Release:  4.6.1 Planned Release:  4.6.1
Work Required:  None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

( Jump to the original submission)

Mon 10 Jul 2017 07:13:07 PM UTC, comment #7:

Thanks, pushed to screen-v4 and master.

Amadeusz Sławiński <amade>
Project Administrator
Fri 07 Jul 2017 09:17:25 AM UTC, comment #6:

Right, it requires changing $LANG to something else in order to reproduce, will apply.

Amadeusz Sławiński <amade>
Project Administrator
Fri 07 Jul 2017 09:04:18 AM UTC, comment #5:

From your output I see that you are using UTF-8 so you don't run into the code path in question:

# ifdef UTF8
if (wp->w_encoding != UTF8) // <- only for !utf8
# endif
# endif
if (D_CC0 || (D_CS0 && *D_CS0)) // <-- null ptr derefence

Anonymous
Fri 07 Jul 2017 08:56:24 AM UTC, comment #4:

Futher remark: Maybe the "display" variable in question depends on termcap related configuration which might be different on our systems.

Anonymous
Fri 07 Jul 2017 08:53:48 AM UTC, comment #3:

I checked with 4.6.0 as well. My .screenrc is empty.
Old versions of screen went well with just "-d" but more recent version need "-dm" indeed.

Repro (screen from debian/experimental):
winter@testlar:~$ aptitude versions screen
p 4.2.1-3+deb8u1 oldstable 500
p 4.5.0-6 stable 550
p 4.5.0-6bfw1 testing 550
p 4.5.1-4 unstable 210
i 4.6.0-1 experimental 100
winter@testlar:~$ screen -v
Screen version 4.06.00 (GNU) 28-Jun-17
winter@testlar:~$ screen -dm sleep 999
winter@testlar:~$ screen -Q info
^C
winter@testlar:~$ screen -ls
There are screens on:
24943..lar-queryA (07/07/17 10:01:00) (Dead ???)
24943..lar (07/07/17 10:01:00) (Dead ???)
Remove dead screens with 'screen -wipe'.
2 Sockets in /run/screen/S-winter.

Anonymous
Fri 07 Jul 2017 08:27:11 AM UTC, comment #2:

Hm... are you sure about reproducer?

$ ./screen -d sleep 9999
There is no screen to be detached.

Tried also with -dm, but it seems to work?
$ ./screen -dm sleep 9999
$ ./screen -Q info
(1,1)/(80,24)+5000 +(+)flow bce UTF-8 0(sleep)%
$ ./screen -ls
Your inventory:
5071..hostname (Detached)
1 Socket in /home/amade/.screen.

Can you check with current release 4.6.0?

Amadeusz Sławiński <amade>
Project Administrator
Fri 07 Jul 2017 06:04:24 AM UTC, comment #1:

Hidden behind three layers of macro defines, the actual null pointer is "display". Several other places in code check for that but here it was sadly missing, therefore:

Fix:
diff --git a/process.c b/process.c
index 2b007bc..2da24b8 100644
--- a/process.c
+++ b/process.c
@@ -5772,7 +5772,7 @@ ShowInfo()
if (wp->w_encoding != UTF8)
# endif
# endif
- if (D_CC0 || (D_CS0 && *D_CS0))
+ if (display && (D_CC0 || (D_CS0 && *D_CS0)))
{
if (wp->w_gr == 2)
{

Anonymous
Thu 06 Jul 2017 01:53:12 PM UTC, original submission:

repro:
$ screen -d sleep 9999
$ screen -Q info
$ screen -ls
There are screens on:
28239.pts-101.XXX-queryA (05/04/17 09:24:25) (Dead ???)
28239.pts-101.XXX (05/04/17 09:24:25) (Dead ???)
Remove dead screens with 'screen -wipe'.

Unfortunately in Debian there are only very old debug symbol files of version 4.2.1 (but I can also repro on 4.5.0), so gdb trace is from the old version:

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0807a564 in ShowInfo () at process.c:5647
5647 process.c: No such file or directory.
(gdb) bt
#0 0x0807a564 in ShowInfo () at process.c:5647
#1 DoAction (act=0xfff8600b, key=-1) at process.c:1857
#2 0x08080b61 in DoCommand (argv=0xfff8707c, argl=0xfff8717c) at process.c:4567
#3 0x0805ff59 in DoCommandMsg (mp=0x80bb000 <m>) at socket.c:1807
#4 0x080620f1 in ReceiveMsg () at socket.c:1220
#5 0x08090630 in sched () at sched.c:237
#6 0x0804c463 in main (ac=<optimized out>, av=<optimized out>) at screen.c:1487
(gdb) show directories
Source directories searched: $cdir:$cwd
(gdb) dir /tmp/screen-4.2.1
Source directories searched: /tmp/screen-4.2.1:$cdir:$cwd
(gdb) l
warning: Source file is more recent than executable.
5642 }
5643 # ifdef UTF8
5644 if (wp->w_encoding != UTF8)
5645 # endif
5646 # endif
5647 if (D_CC0 || (D_CS0 && *D_CS0))
5648 {
5649 if (wp->w_gr == 2)
5650 {
5651 sprintf(p, " G%c", wp->w_Charset + '0');
(gdb) info registers
eax 0x0 0
ecx 0x7 7
edx 0x80cb2d8 135049944
ebx 0xfff8600b -499701
esp 0xfff85f70 0xfff85f70
ebp 0x0 0x0
esi 0x1 1
edi 0x0 0
eip 0x807a564 0x807a564 <DoAction+20740>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x63 99

Clearly there is an invalid dereference most likely due to uninitialized variables when screen is started in detached state.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by amade (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

     

     

    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-10 amade Open/ClosedOpen => Closed
        Fixed ReleaseNone => 4.6.1
    2017-07-10 amade StatusConfirmed => Fixed
        ReleaseNone => 4.6.0
        Planned Release4.5.1 => 4.6.1
    2017-07-07 amade StatusNone => Confirmed

    Back to the top


    Powered by Savane 3.3