mainThe GNU Bourne-Again SHell - Support: sr #109634, SIGSEGV at malloc.c

 
 

sr #109634: SIGSEGV at malloc.c

Submitter:  Dhiraj <mdhiraj>
Submitted:  Tue 22 Jan 2019 01:13:44 PM UTC
   
 
Category:  None Priority:  5 - Normal
Severity:  6 - Security Status:  Works For Me
Privacy:  Public Assigned to:  None
Open/Closed:  Open Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 01 Feb 2019 03:26:06 PM UTC, comment #1: 

Since this only happens when running with asan, I suggest you investigate how you're building it. You may need to configure bash --without-bash-malloc so that asan's function interposition works right.

Chet Ramey <chet>
Group administrator
Tue 22 Jan 2019 01:13:44 PM UTC, original submission:  

Hi Team,

I have build bash-5.0 using clang via ASAN, however while running ./bash a segmentation fault was observed.

$ gdb ./bash
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./bash...done.
(gdb) run
Starting program: /home/zero/Downloads/bash-5.0/bash
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x0000000000845d9e in internal_malloc (n=<optimized out>, file=<optimized out>, line=<optimized out>, flags=0) at malloc.c:797
797 {
(gdb) bt
#0  0x0000000000845d9e in internal_malloc (n=<optimized out>, file=<optimized out>, line=<optimized out>, flags=0) at malloc.c:797
#1  0x000000000084a8cb in internal_calloc (n=<optimized out>, s=<optimized out>, file=<optimized out>, line=0, flags=0) at malloc.c:1263
#2  calloc (n=<optimized out>, n@entry=1, s=<optimized out>, s@entry=32) at malloc.c:1413
#3  0x00007ffff79a87e5 in _dlerror_run (operate=operate@entry=0x7ffff79a80d0 <dlsym_doit>, args=args@entry=0x7fffffffde50) at dlerror.c:140
#4  0x00007ffff79a8166 in __dlsym (handle=<optimized out>, name=0x855057 "textdomain") at dlsym.c:70
#5  0x0000000000500bec in __interception::GetRealFunctionAddress(char const*, unsigned long*, unsigned long, unsigned long) ()
#6  0x00000000004ddad4 in __asan::InitializeAsanInterceptors() ()
#7  0x00000000004fd102 in __asan::AsanInitInternal() [clone .part.1] ()
#8  0x00007ffff7de5806 in _dl_init (main_map=0x7ffff7ffe170, argc=1, argv=0x7fffffffdf98, env=0x7fffffffdfa8) at dl-init.c:104
#9  0x00007ffff7dd60ca in _dl_start_user () from /lib64/ld-linux-x86-64.so.2
#10 0x0000000000000001 in ?? ()
#11 0x00007fffffffe2e0 in ?? ()
#12 0x0000000000000000 in ?? ()
(gdb) i r
rax            0xff2b 65323
rbx            0x7fffffffdce0 140737488346336
rcx            0x17bb1d0 24883664
rdx            0x0 0
rsi            0x0 0
rdi            0x20 32
rbp            0x7fffffffddf0 0x7fffffffddf0
rsp            0x7fffffffdb80 0x7fffffffdb80
r8             0xfffffffffffffffc -4
r9             0x0 0
r10            0x9 9
r11            0x84a890 8693904
r12            0x20 32
r13            0x7fffffffdb80 140737488345984
r14            0xaf9f50 11509584
r15            0xffffffffb70 17592186043248
rip            0x845d9e 0x845d9e <internal_malloc+158>
eflags         0x10202 [ IF RF ]
cs             0x33 51
ss             0x2b 43
ds             0x0 0
es             0x0 0
fs             0x0 0
gs             0x0 0
(gdb)


Snip code from malloc.c

#ifndef NO_CALLOC
static PTR_T
internal_calloc (n, s, file, line, flags)
     size_t n, s;
     const char *file;
     int line, flags;
{
  size_t total;
  PTR_T result;

  total = n * s;
  result = internal_malloc (total, file, line, flags|MALLOC_INTERNAL);
  if (result)
    memset (result, 0, total);
  return result; 
}

Dhiraj <mdhiraj>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chet (Posted a comment)
  • -email is unavailable- added by mdhiraj (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follows 1 latest change.

    Date Changed by Updated Field Previous Value => Replaced by
    2019-02-01 chet StatusNone Works For Me

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code