bugGNU Screen - Bugs: bug #51402, SEGFAULT when querying 'info' on...

 
 

bug #51402: SEGFAULT when querying 'info' on detached screen

Submitted by:  None
Submitted on:  Thu 06 Jul 2017 01:53:12 PM UTC  
 
Category: Crash/Freeze/InfloopSeverity: 3 - Normal
Priority: 5 - NormalStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: ClosedRelease: 4.6.0
Fixed Release: 4.6.1Planned Release: 4.6.1
Work Required: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 10 Jul 2017 07:13:07 PM UTC, comment #7:

Thanks, pushed to screen-v4 and master.

Amadeusz Sławiński <amade>
Project Administrator
Fri 07 Jul 2017 09:17:25 AM UTC, comment #6:

Right, it requires changing $LANG to something else in order to reproduce, will apply.

Amadeusz Sławiński <amade>
Project Administrator
Fri 07 Jul 2017 09:04:18 AM UTC, comment #5:

From your output I see that you are using UTF-8 so you don't run into the code path in question:

# ifdef UTF8
if (wp->w_encoding != UTF8) // <- only for !utf8
# endif
# endif
if (D_CC0 || (D_CS0 && *D_CS0)) // <-- null ptr derefence

Anonymous
Fri 07 Jul 2017 08:56:24 AM UTC, comment #4:

Futher remark: Maybe the "display" variable in question depends on termcap related configuration which might be different on our systems.

Anonymous
Fri 07 Jul 2017 08:53:48 AM UTC, comment #3:

I checked with 4.6.0 as well. My .screenrc is empty.
Old versions of screen went well with just "-d" but more recent version need "-dm" indeed.

Repro (screen from debian/experimental):
winter@testlar:~$ aptitude versions screen
p 4.2.1-3+deb8u1 oldstable 500
p 4.5.0-6 stable 550
p 4.5.0-6bfw1 testing 550
p 4.5.1-4 unstable 210
i 4.6.0-1 experimental 100
winter@testlar:~$ screen -v
Screen version 4.06.00 (GNU) 28-Jun-17
winter@testlar:~$ screen -dm sleep 999
winter@testlar:~$ screen -Q info
^C
winter@testlar:~$ screen -ls
There are screens on:
24943..lar-queryA (07/07/17 10:01:00) (Dead ???)
24943..lar (07/07/17 10:01:00) (Dead ???)
Remove dead screens with 'screen -wipe'.
2 Sockets in /run/screen/S-winter.

Anonymous
Fri 07 Jul 2017 08:27:11 AM UTC, comment #2:

Hm... are you sure about reproducer?

$ ./screen -d sleep 9999
There is no screen to be detached.

Tried also with -dm, but it seems to work?
$ ./screen -dm sleep 9999
$ ./screen -Q info
(1,1)/(80,24)+5000 +(+)flow bce UTF-8 0(sleep)%
$ ./screen -ls
Your inventory:
5071..hostname (Detached)
1 Socket in /home/amade/.screen.

Can you check with current release 4.6.0?

Amadeusz Sławiński <amade>
Project Administrator
Fri 07 Jul 2017 06:04:24 AM UTC, comment #1:

Hidden behind three layers of macro defines, the actual null pointer is "display". Several other places in code check for that but here it was sadly missing, therefore:

Fix:
diff --git a/process.c b/process.c
index 2b007bc..2da24b8 100644
--- a/process.c
+++ b/process.c
@@ -5772,7 +5772,7 @@ ShowInfo()
if (wp->w_encoding != UTF8)
# endif
# endif
- if (D_CC0 || (D_CS0 && *D_CS0))
+ if (display && (D_CC0 || (D_CS0 && *D_CS0)))
{
if (wp->w_gr == 2)
{

Anonymous
Thu 06 Jul 2017 01:53:12 PM UTC, original submission:

repro:
$ screen -d sleep 9999
$ screen -Q info
$ screen -ls
There are screens on:
28239.pts-101.XXX-queryA (05/04/17 09:24:25) (Dead ???)
28239.pts-101.XXX (05/04/17 09:24:25) (Dead ???)
Remove dead screens with 'screen -wipe'.

Unfortunately in Debian there are only very old debug symbol files of version 4.2.1 (but I can also repro on 4.5.0), so gdb trace is from the old version:

(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0807a564 in ShowInfo () at process.c:5647
5647 process.c: No such file or directory.
(gdb) bt
#0 0x0807a564 in ShowInfo () at process.c:5647
#1 DoAction (act=0xfff8600b, key=-1) at process.c:1857
#2 0x08080b61 in DoCommand (argv=0xfff8707c, argl=0xfff8717c) at process.c:4567
#3 0x0805ff59 in DoCommandMsg (mp=0x80bb000 <m>) at socket.c:1807
#4 0x080620f1 in ReceiveMsg () at socket.c:1220
#5 0x08090630 in sched () at sched.c:237
#6 0x0804c463 in main (ac=<optimized out>, av=<optimized out>) at screen.c:1487
(gdb) show directories
Source directories searched: $cdir:$cwd
(gdb) dir /tmp/screen-4.2.1
Source directories searched: /tmp/screen-4.2.1:$cdir:$cwd
(gdb) l
warning: Source file is more recent than executable.
5642 }
5643 # ifdef UTF8
5644 if (wp->w_encoding != UTF8)
5645 # endif
5646 # endif
5647 if (D_CC0 || (D_CS0 && *D_CS0))
5648 {
5649 if (wp->w_gr == 2)
5650 {
5651 sprintf(p, " G%c", wp->w_Charset + '0');
(gdb) info registers
eax 0x0 0
ecx 0x7 7
edx 0x80cb2d8 135049944
ebx 0xfff8600b -499701
esp 0xfff85f70 0xfff85f70
ebp 0x0 0x0
esi 0x1 1
edi 0x0 0
eip 0x807a564 0x807a564 <DoAction+20740>
eflags 0x10246 [ PF ZF IF RF ]
cs 0x23 35
ss 0x2b 43
ds 0x2b 43
es 0x2b 43
fs 0x0 0
gs 0x63 99

Clearly there is an invalid dereference most likely due to uninitialized variables when screen is started in detached state.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by amade (Posted a comment)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 6 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Mon 10 Jul 2017 07:48:00 PM UTCamadeOpen/ClosedOpen=>Closed
      Fixed ReleaseNone=>4.6.1
    Mon 10 Jul 2017 07:13:07 PM UTCamadeStatusConfirmed=>Fixed
      ReleaseNone=>4.6.0
      Planned Release4.5.1=>4.6.1
    Fri 07 Jul 2017 09:17:25 AM UTCamadeStatusNone=>Confirmed

    Back to the top


    Powered by Savane 3.1-cleanup1