bugGNU Screen - Bugs: bug #51402, SEGFAULT when querying 'info' on...


bug #51402: SEGFAULT when querying 'info' on detached screen

Submitter:  None
Submitted:  Thu 06 Jul 2017 01:53:12 PM UTC
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  4.6.0
Fixed Release:  4.6.1 Planned Release:  4.6.1
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup

Jump to the original submission

Mon 10 Jul 2017 07:13:07 PM UTC, comment #7: 

Thanks, pushed to screen-v4 and master.

Amadeusz Sławiński <amade>
Group administrator
Fri 07 Jul 2017 09:17:25 AM UTC, comment #6: 

Right, it requires changing $LANG to something else in order to reproduce, will apply.

Amadeusz Sławiński <amade>
Group administrator
Fri 07 Jul 2017 09:04:18 AM UTC, comment #5: 

From your output I see that you are using UTF-8 so you don't run into the code path in question:

#  ifdef UTF8
  if (wp->w_encoding != UTF8) // <- only for !utf8
#  endif
# endif
    if (D_CC0 || (D_CS0 && *D_CS0)) // <-- null ptr derefence

Fri 07 Jul 2017 08:56:24 AM UTC, comment #4: 

Futher remark: Maybe the "display" variable in question depends on termcap related configuration which might be different on our systems.

Fri 07 Jul 2017 08:53:48 AM UTC, comment #3: 

I checked with 4.6.0 as well. My .screenrc is empty.
Old versions of screen went well with just "-d" but more recent version need "-dm" indeed.

Repro (screen from debian/experimental):
winter@testlar:~$ aptitude versions screen
p   4.2.1-3+deb8u1                                oldstable                 500
p   4.5.0-6                                       stable                    550
p   4.5.0-6bfw1                                   testing                   550
p   4.5.1-4                                       unstable                  210
i   4.6.0-1                                       experimental              100
winter@testlar:~$ screen -v
Screen version 4.06.00 (GNU) 28-Jun-17
winter@testlar:~$ screen -dm sleep 999
winter@testlar:~$ screen -Q info
winter@testlar:~$ screen -ls
There are screens on:
        24943..lar-queryA       (07/07/17 10:01:00)     (Dead ???)
        24943..lar      (07/07/17 10:01:00)     (Dead ???)
Remove dead screens with 'screen -wipe'.
2 Sockets in /run/screen/S-winter.

Fri 07 Jul 2017 08:27:11 AM UTC, comment #2: 

Hm... are you sure about reproducer?

$ ./screen -d sleep 9999
There is no screen to be detached.

Tried also with -dm, but it seems to work?
$ ./screen -dm sleep 9999
$ ./screen -Q info
(1,1)/(80,24)+5000 +(+)flow bce UTF-8 0(sleep)%
$ ./screen -ls
Your inventory:
        5071..hostname (Detached)
1 Socket in /home/amade/.screen.

Can you check with current release 4.6.0?

Amadeusz Sławiński <amade>
Group administrator
Fri 07 Jul 2017 06:04:24 AM UTC, comment #1: 

Hidden behind three layers of macro defines, the actual null pointer is "display". Several other places in code check for that but here it was sadly missing, therefore:

diff --git a/process.c b/process.c
index 2b007bc..2da24b8 100644
--- a/process.c
+++ b/process.c
@@ -5772,7 +5772,7 @@ ShowInfo()
   if (wp->w_encoding != UTF8)
 #  endif
 # endif
-    if (D_CC0 || (D_CS0 && *D_CS0))
+    if (display && (D_CC0 || (D_CS0 && *D_CS0)))
        if (wp->w_gr == 2)

Thu 06 Jul 2017 01:53:12 PM UTC, original submission:  

$ screen -d sleep 9999
$ screen -Q info
$ screen -ls
There are screens on:
        28239.pts-101.XXX-queryA        (05/04/17 09:24:25)     (Dead ???)
        28239.pts-101.XXX       (05/04/17 09:24:25)     (Dead ???)
Remove dead screens with 'screen -wipe'.

Unfortunately in Debian there are only very old debug symbol files of version 4.2.1 (but I can also repro on 4.5.0), so gdb trace is from the old version:

(gdb) c

Program received signal SIGSEGV, Segmentation fault.
0x0807a564 in ShowInfo () at process.c:5647
5647    process.c: No such file or directory.
(gdb) bt
#0  0x0807a564 in ShowInfo () at process.c:5647
#1  DoAction (act=0xfff8600b, key=-1) at process.c:1857
#2  0x08080b61 in DoCommand (argv=0xfff8707c, argl=0xfff8717c) at process.c:4567
#3  0x0805ff59 in DoCommandMsg (mp=0x80bb000 <m>) at socket.c:1807
#4  0x080620f1 in ReceiveMsg () at socket.c:1220
#5  0x08090630 in sched () at sched.c:237
#6  0x0804c463 in main (ac=<optimized out>, av=<optimized out>) at screen.c:1487
(gdb) show directories
Source directories searched: $cdir:$cwd
(gdb) dir /tmp/screen-4.2.1
Source directories searched: /tmp/screen-4.2.1:$cdir:$cwd
(gdb) l
warning: Source file is more recent than executable.
5642        }
5643    #  ifdef UTF8
5644      if (wp->w_encoding != UTF8)
5645    #  endif
5646    # endif
5647        if (D_CC0 || (D_CS0 && *D_CS0))
5648          {
5649            if (wp->w_gr == 2)
5650              {
5651                sprintf(p, " G%c", wp->w_Charset + '0');
(gdb) info registers
eax            0x0      0
ecx            0x7      7
edx            0x80cb2d8        135049944
ebx            0xfff8600b       -499701
esp            0xfff85f70       0xfff85f70
ebp            0x0      0x0
esi            0x1      1
edi            0x0      0
eip            0x807a564        0x807a564 <DoAction+20740>
eflags         0x10246  [ PF ZF IF RF ]
cs             0x23     35
ss             0x2b     43
ds             0x2b     43
es             0x2b     43
fs             0x0      0
gs             0x63     99

Clearly there is an invalid dereference most likely due to uninitialized variables when screen is started in detached state.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by amade (Posted a comment)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.


    Follow 6 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-07-10 amade Open/ClosedOpen Closed
        Fixed ReleaseNone 4.6.1
    2017-07-10 amade StatusConfirmed Fixed
        ReleaseNone 4.6.0
        Planned Release4.5.1 4.6.1
    2017-07-07 amade StatusNone Confirmed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code