bugGNU Screen - Bugs: bug #35757, Switching from altscreen after...

 
 

bug #35757: Switching from altscreen after window resize causes segfault in resize.c:750

Submitter:  None
Submitted:  Thu 08 Mar 2012 06:18:21 AM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed Release:  4.2.1
Fixed Release:  None Planned Release:  Later
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Jump to the original submission

Mon 22 Jun 2015 04:01:57 PM UTC, comment #10: 

I can't reproduce it using v4.3.0.
It looks like this problem is FIXED.


Thanks again for submitting bug report ;-)

Alexander Naumov <anaumov>
Group administrator
Sat 31 May 2014 06:05:26 PM UTC, comment #9: 

That fixes it as far as I'm concerned.  Thanks, Amadeusz!

Erik Falor <ewfalor>
Fri 23 May 2014 09:19:38 AM UTC, comment #8: 

Ok, I've rechecked, patch from comment #4 seems to fix this so I applied it, can you check again?

Amadeusz Sławiński <amade>
Group administrator
Fri 23 May 2014 05:10:33 AM UTC, comment #7: 

I just tested this on 32-bit Slackware 14.1 using commit 8ffd5f46 from May 17, 2014, and the segfault is still present :(

Erik Falor <ewfalor>
Fri 23 May 2014 04:47:14 AM UTC, comment #6: 

I just tested this out afresh, and I'm seeing today (on commit ) the exact same thing as I did two years ago:

(gdb) frame 4
#4  0x000000000041e09f in ChangeWindowSize (p=0x22a9730, wi=180, he=70, hi=2048) at resize.c:766
766   if (ml->image[p->w_width] == ' ')
(gdb) print*ml
$1 = {
  image = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  attr = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  font = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  fontx = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  color = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>
}

I should point out that this is happening on Linux x86_64; when I try the very same procedure on with a 64-bit build of screen on AIX 7.1 it does not crash.

I'll try to test this out on my 32-bit Linux laptop tomorrow to see if it's a Linux thing or a 64-bit Linux thing.

Erik Falor <ewfalor>
Wed 23 Apr 2014 06:54:03 PM UTC, comment #5: 
Amadeusz Sławiński <amade>
Group administrator
Mon 30 Apr 2012 09:41:04 AM UTC, comment #4: 

I have an idea, but I am not sure if I am not completely wrong. When is screen calculating resize it uses current cursor location, but I think that it should use the position where the cursor was before entering altscreen. I have tried this small modification and segfault is gone.

diff --git a/src/ansi.c b/src/ansi.c
index d88e153..8df79b2 100644
--- a/src/ansi.c
+++ b/src/ansi.c
@@ -1438,8 +1438,8 @@ int c, intermediate;
                    }
                  else
                    {
-                     LeaveAltScreen(curr);
                      RestoreCursor(&curr->w_alt.cursor);
+                     LeaveAltScreen(curr);
                    }
                  if (a1 == 47 && !i)
                    curr->w_saved.on = 0;

Lukáš Nykrýn <lnykryn>
Wed 14 Mar 2012 07:48:06 PM UTC, comment #3: 

I hate to say it, but this fix covers only the case outlined in my original Steps to Reproduce.  If you instead follow these steps, you'll get a segfault again:

Steps to reproduce:
0. Launch screen and set ":altscreen on" (use the attached crash.screenrc)
1. Split into two regions
2. Use the 'screen' command to launch a program that will use the altscreen (eg. C-a :screen vim)
3. Execute :only to kill the other region; now vim is using the entire screen
4. Exit vim. (that's :q for you Emacs folks). Screen segfaults at this point.

When I probe the core file left behind, I see this:

(gdb) frame 4
#4  0x00000000004202d8 in ChangeWindowSize (p=0x24f1e60, wi=80, he=60, hi=100)
    at resize.c:752
752               if (ml->image[p->w_width] == ' ')
(gdb) print *ml
$1 = {
  image = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  attr = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  font = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>,
  color = 0x2020202020202020 <Address 0x2020202020202020 out of bounds>
}


Somehow (struct mline *) ml now contains a bunch of ASCII space characters.

Erik Falor <ewfalor>
Wed 14 Mar 2012 04:46:19 PM UTC, comment #2: 

Thanks for the speedy fix, Sadrul!

Erik Falor <ewfalor>
Wed 14 Mar 2012 01:48:47 AM UTC, comment #1: 
Sadrul Habib Chowdhury <sadrul>
Group administrator
Thu 08 Mar 2012 06:18:21 AM UTC, original submission:  

The crash happens in the function ChangeWindowSize() at resize.c:750 while trying to dereference a structure's member.

f9535294 is the first bad commit

Steps to reproduce:
0. Launch screen and set ":altscreen on" (use the attached crash.screenrc)
1. Split into two regions
2. Launch a program that will use the altscreen (eg. vim)
3. Execute :only to kill the other region; now vim is using the entire screen
4. Exit vim. (that's :q for you Emacs folks).  Screen segfaults at this point.

This is the code at the point of the problem:

749   ml = OLDWIN(yy);
750   if (ml->image[p->w_width] == ' ')

OLDWIN returns NULL in this case.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #25292:  crash.screenrc added by None (47B - application/octet-stream)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by anaumov (Posted a comment)
  • -email is unavailable- added by amade (Posted a comment)
  • -email is unavailable- added by lnykryn (Posted a comment)
  • -email is unavailable- added by ewfalor (Posted a comment)
  • -email is unavailable- added by sadrul (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 14 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-06-22 anaumov Open/ClosedOpen Closed
    2015-06-22 anaumov StatusIn Progress Fixed
    2014-05-23 amade StatusFixed In Progress
        Open/ClosedClosed Open
    2014-04-27 amade Open/ClosedOpen Closed
        ReleaseCur Dev Sources 4.2.1
    2014-04-23 amade StatusNone Fixed
        Planned Release4.1.0 Later
    2012-04-26 sadrul Planned ReleaseNone 4.1.0
    2012-04-26 sadrul Open/ClosedClosed Open
        Fixed Release4.1.0 None
    2012-03-14 sadrul Open/ClosedOpen Closed
        Fixed ReleaseNone 4.1.0
    2012-03-08 None Attached File- Added crash.screenrc, #25292

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code