bugGNU Screen - Bugs: bug #50143, Core dump

 
 

bug #50143: Core dump

Submitter:  None
Submitted:  Wed 25 Jan 2017 08:03:50 AM UTC
   
 
Category:  Crash/Freeze/Infloop Severity:  3 - Normal
Priority:  * 5 - Normal Status:  Fixed
Privacy:  Public Assigned to:  anaumov
Open/Closed:  Closed Release:  4.4.0
Fixed Release:  4.5.0 Planned Release:  None
Work Required:  None
* Mandatory Fields

Add a New Comment Rich Markup
   

Sat 11 Feb 2017 08:36:12 PM UTC, comment #5: 

Ok, new patch has been added to the FreeBSD port:
https://svnweb.freebsd.org/ports?view=revision&revision=433828
Thanks to Cy Schubert for that.

No changes for the upstream code base needed.

I will close this report now.

Alexander Naumov <anaumov>
Group administrator
Sat 11 Feb 2017 05:51:24 AM UTC, comment #4: 

r433828 committed in FreeBSD ports repo.

At line 434 of utmp.c (line 478 of original utmp.c).


Cy Schubert <cyschubert>
Mon 06 Feb 2017 10:24:48 PM UTC, comment #3: 

Hi Valentin,
thank you for reporting.

Yes, I can't reproduce it on GNU/Linux.

Can you add NULL pointer check for win_old->w_layer.l_cvlist and try to reproduce it again?


..seems that I need to install FreeBSD.

Alexander Naumov <anaumov>
Group administrator
Wed 25 Jan 2017 12:29:14 PM UTC, comment #2: 

Copying from D_loginhost in SetUtmp() is from FreeBSD port patch; stock version notes "host" here. This could trigger the crash only on FreeBSD.

But I'm still wondering whether it shall have a real display during showing a terminal list to the user.

Valentin Nechayev <netch>
Wed 25 Jan 2017 12:21:43 PM UTC, comment #1: 

Reproducing with debug:

(gdb) bt
#0  0x28232b37 in thr_kill () from /lib/libc.so.7
#1  0x28232b2a in raise () from /lib/libc.so.7
#2  0x28232a76 in abort () from /lib/libc.so.7
#3  0x0804f1fa in CoreDump (sigsig=11) at screen.c:1686
#4  0xbfbff004 in ?? ()
#5  0x0000000b in ?? ()
#6  0x00000001 in ?? ()
#7  0xbfbfa320 in ?? ()
#8  0x00000c6c in ?? ()
#9  0x0804f040 in ParseEscape () at screen.c:3384
#10 0x0807d2e2 in SetUtmp (wi=0x2892a000) at utmp.c:434
#11 0x0807bf7b in WindowChangeNumber (old=2, dest=1) at window.c:2347
#12 0x080bfd4a in gl_Window_input (ldata=0x288031e0, inp=0xbfbfadac, len=0xbfbfad9c) at list_window.c:392
#13 0x080bc7ac in ListProcess (ppbuf=0xbfbfadac, plen=0xbfbfad9c) at list_generic.c:153
#14 0x0808c05d in DoProcess (p=0x0, bufp=0xbfbfadac, lenp=0xbfbfad9c, pa=0x0) at process.c:982
#15 0x0808bd5e in ProcessInput2 (ibuf=0xbfbfae37 "", ilen=0) at process.c:913
#16 0x0808b847 in ProcessInput (ibuf=0xbfbfae36 ",", ilen=-1) at process.c:874
#17 0x080a982f in disp_readev_fn (ev=0x288a6450, data=0x288a5e00 "") at display.c:3528
#18 0x080c097e in sched () at sched.c:237
#19 0x0804ea17 in main (ac=0, av=0xbfbfec44) at screen.c:1474

(gdb) f 10
#10 0x0807d2e2 in SetUtmp (wi=0x2892a000) at utmp.c:434
434       strncpy(u.ut_host, D_loginhost, sizeof(u.ut_host));

(gdb) l
429       if (!saved_ut)
430         makeuser(&u, stripdev(wi->w_tty), LoginName, wi->w_pid);
431
432     #ifdef UTHOST
433     # if !defined(SEQUENT) && !defined(sequent)
434       strncpy(u.ut_host, D_loginhost, sizeof(u.ut_host));
435     # endif
436     #endif /* UTHOST */
437
438       if (pututslot(slot, &u, D_loginhost, wi) == 0)

this is preprocessed to

  strncpy(u.ut_host, display->d_utmp_logintty.ut_host, sizeof(u.ut_host));

but:

(gdb) p display
$12 = (struct display *) 0x0

The suspicious place is: WindowChangeNumber():

  if (p && (p->w_slot != (slot_t) -1) && (p->w_slot != (slot_t) 0))
    {
      display = win_old->w_layer.l_cvlist ? win_old->w_layer.l_cvlist->c_display : 0;
      RemoveUtmp(p);
      SetUtmp(p);
    }

Debug print here confirms there is an issue with display setting:
win_old->w_layer.l_cvlist is NULL during this check.

Valentin Nechayev <netch>
Wed 25 Jan 2017 08:03:50 AM UTC, original submission:  

The following causes a core dump and/or unrecoverable terminal in FreeBSD:
run screen
in screen type
C-a c         (make a new screen)
C-a c         (make a new screen)
C-a "         (get a list of the screens)
,                 (type comma and hit enter)
Core dumps, terminal may be unrecoverable
Running FreeBSD 11.0-RELEASE-p1


Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by cyschubert (Posted a comment)
  • -email is unavailable- added by anaumov (Posted a comment)
  • -email is unavailable- added by netch (Posted a comment)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2017-02-11 anaumov StatusNone Fixed
        Open/ClosedOpen Closed
        Fixed ReleaseNone 4.5.0
    2017-02-09 anaumov Assigned toNone anaumov

    Back to the top

    Powered by Savane 3.13-02a9.
    Corresponding source code