[Bug 829720] New: repeatable Error in `/usr/bin/more': free(): invalid pointer: 0x000000000060f850 ***
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c0 Summary: repeatable Error in `/usr/bin/more': free(): invalid pointer: 0x000000000060f850 *** Classification: openSUSE Product: openSUSE Factory Version: 13.1 Milestone 2 Platform: x86-64 OS/Version: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem AssignedTo: bnc-team-screening@forge.provo.novell.com ReportedBy: dave@treblig.org QAContact: qa-bugs@suse.de Found By: --- Blocker: --- User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:23.0) Gecko/20100101 Firefox/23.0 *** Error in `/usr/bin/more': free(): invalid pointer: 0x000000000060f850 *** (gdb) bt full #0 0x00007ffff782b619 in raise () from /lib64/libc.so.6 No symbol table info available. #1 0x00007ffff782caa8 in abort () from /lib64/libc.so.6 No symbol table info available. #2 0x00007ffff786a327 in __libc_message () from /lib64/libc.so.6 No symbol table info available. #3 0x00007ffff786fc2e in malloc_printerr () from /lib64/libc.so.6 No symbol table info available. #4 0x0000000000403d42 in end_it (dummy=dummy@entry=0) at text-utils/more.c:777 No locals. #5 0x0000000000406037 in command (filename=filename@entry=0x0, f=f@entry=0x6133a0) at text-utils/more.c:1263 nlines = 0 retval = <optimized out> c = <optimized out> colonch = <optimized out> done = 0 comchar = 113 'q' cmdbuf = "\001\000\000\000\377\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000(\245\177\367\377\177\000\000\001", '\000' <repeats 23 times>, "e\362\336\367\377\177\000\000\n\000\000\000\000\000\000\000\377\377\377\377\000\000\000" #6 0x0000000000406806 in screen (f=f@entry=0x6133a0, num_lines=<optimized out>, num_lines@entry=24) at text-utils/more.c:708 ---Type <return> to continue, or q <return> to quit--- c = <optimized out> nchars = <optimized out> length = 1 prev_len = 1 #7 0x00000000004025e5 in main (argc=<optimized out>, argv=<optimized out>) at text-utils/more.c:503 f = 0x6133a0 s = <optimized out> ch = <optimized out> left = 24 prnames = 0 initopt = 0 srchopt = 0 clearit = 0 initline = 0 initbuf = 0x0 (gdb) ======= Backtrace: ========= /lib64/libc.so.6(+0x79c2e)[0x7ffff786fc2e] /usr/bin/more[0x403d42] /usr/bin/more[0x406037] /usr/bin/more[0x406806] /usr/bin/more[0x4025e5] /lib64/libc.so.6(__libc_start_main+0xf5)[0x7ffff7817a35] /usr/bin/more[0x4028dd] ======= Memory map: ======== 00400000-00409000 r-xp 00000000 00:13 341039 /usr/bin/more 00608000-00609000 r--p 00008000 00:13 341039 /usr/bin/more 00609000-0060a000 rw-p 00009000 00:13 341039 /usr/bin/more 0060a000-0062b000 rw-p 00000000 00:00 0 [heap] 7ffff75df000-7ffff75f5000 r-xp 00000000 00:13 312490 /lib64/libgcc_s.so.1 7ffff75f5000-7ffff77f4000 ---p 00016000 00:13 312490 /lib64/libgcc_s.so.1 7ffff77f4000-7ffff77f5000 r--p 00015000 00:13 312490 /lib64/libgcc_s.so.1 7ffff77f5000-7ffff77f6000 rw-p 00016000 00:13 312490 /lib64/libgcc_s.so.1 7ffff77f6000-7ffff799d000 r-xp 00000000 00:13 306066 /lib64/libc-2.17.so 7ffff799d000-7ffff7b9d000 ---p 001a7000 00:13 306066 /lib64/libc-2.17.so 7ffff7b9d000-7ffff7ba1000 r--p 001a7000 00:13 306066 /lib64/libc-2.17.so 7ffff7ba1000-7ffff7ba3000 rw-p 001ab000 00:13 306066 /lib64/libc-2.17.so 7ffff7ba3000-7ffff7ba7000 rw-p 00000000 00:00 0 7ffff7ba7000-7ffff7bd2000 r-xp 00000000 00:13 307892 /lib64/libtinfo.so.5.9 7ffff7bd2000-7ffff7dd1000 ---p 0002b000 00:13 307892 /lib64/libtinfo.so.5.9 7ffff7dd1000-7ffff7dd5000 r--p 0002a000 00:13 307892 /lib64/libtinfo.so.5.9 7ffff7dd5000-7ffff7dda000 rw-p 0002e000 00:13 307892 /lib64/libtinfo.so.5.9 7ffff7dda000-7ffff7ddb000 rw-p 00000000 00:00 0 7ffff7ddb000-7ffff7dfc000 r-xp 00000000 00:13 306059 /lib64/ld-2.17.so 7ffff7e68000-7ffff7ea7000 r--p 00000000 00:13 334055 /usr/lib/locale/en_GB.utf8/LC_CTYPE 7ffff7ea7000-7ffff7fd7000 r--p 00000000 00:13 334054 /usr/lib/locale/en_GB.utf8/LC_COLLATE 7ffff7fd7000-7ffff7fda000 rw-p 00000000 00:00 0 7ffff7fe5000-7ffff7fe8000 rw-p 00000000 00:00 0 7ffff7fe8000-7ffff7fe9000 r--p 00000000 00:13 334076 /usr/lib/locale/en_GB.utf8/LC_NUMERIC 7ffff7fe9000-7ffff7fea000 r--p 00000000 00:13 334271 /usr/lib/locale/en_GB.utf8/LC_TIME 7ffff7fea000-7ffff7feb000 r--p 00000000 00:13 334204 /usr/lib/locale/en_GB.utf8/LC_MONETARY 7ffff7feb000-7ffff7fec000 r--p 00000000 00:13 334083 /usr/lib/locale/en_GB.utf8/LC_MESSAGES/SYS_LC_MESSAGES 7ffff7fec000-7ffff7fed000 r--p 00000000 00:13 334060 /usr/lib/locale/en_GB.utf8/LC_PAPER 7ffff7fed000-7ffff7fee000 r--p 00000000 00:13 334205 /usr/lib/locale/en_GB.utf8/LC_NAME 7ffff7fee000-7ffff7fef000 r--p 00000000 00:13 334297 /usr/lib/locale/en_GB.utf8/LC_ADDRESS 7ffff7fef000-7ffff7ff0000 r--p 00000000 00:13 334206 /usr/lib/locale/en_GB.utf8/LC_TELEPHONE 7ffff7ff0000-7ffff7ff1000 r--p 00000000 00:13 334056 /usr/lib/locale/en_GB.utf8/LC_MEASUREMENT 7ffff7ff1000-7ffff7ff8000 r--s 00000000 00:13 334483 /usr/lib64/gconv/gconv-modules.cache 7ffff7ff8000-7ffff7ff9000 r--p 00000000 00:13 332213 /usr/lib/locale/en_GB.utf8/LC_IDENTIFICATION 7ffff7ff9000-7ffff7ffa000 rw-p 00000000 00:00 0 7ffff7ffa000-7ffff7ffc000 r-xp 00000000 00:00 0 [vdso] 7ffff7ffc000-7ffff7ffd000 r--p 00021000 00:13 306059 /lib64/ld-2.17.so 7ffff7ffd000-7ffff7ffe000 rw-p 00022000 00:13 306059 /lib64/ld-2.17.so 7ffff7ffe000-7ffff7fff000 rw-p 00000000 00:00 0 7ffffffde000-7ffffffff000 rw-p 00000000 00:00 0 [stack] ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall] Program received signal SIGABRT, Aborted. 0x00007ffff782b619 in raise () from /lib64/libc.so.6 Reproducible: Always Steps to Reproduce: 1. more /var/lib/rpm/Packages 2. hit q on the 1st page 3. kaboom! Actual Results: Error in `/usr/bin/more': free(): invalid pointer: 0x000000000060f850 *** Expected Results: a nice clean exit to shell util-linux-2.23.1-4.3.x86_64 (Machine was installed with 12.3 and updated via tumbleweed and now on factory). The bug is fully repeatable for me.) -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c1 --- Comment #1 from Dave Gilbert <dave@treblig.org> 2013-07-16 19:04:40 UTC --- Created an attachment (id=548234) --> (http://bugzilla.novell.com/attachment.cgi?id=548234) file that causes the crash This is the smallest segment of my Packages file I could isolate that would trigger the bug; it triggers when run from an 86x25 terminal. It also triggers on upstream util-linux git, so I'll report it there as well; a valgrind shows: ==22488== Invalid write of size 1 ==22488== at 0x4037A2: get_line (more.c:1043) if (colflg && eatnl && Wrap) { *p++ = '\n'; /* simulate normal wrap */ } ==22488== by 0x4066C3: screen (more.c:660) ==22488== by 0x4025E4: main (more.c:503) ==22488== Address 0x542c318 is 0 bytes after a block of size 344 alloc'd ==22488== at 0x4C297AB: malloc (in /usr/lib64/valgrind/vgpreload_memcheck-amd64-lin so I'm assuming there isn't quite enough space for that nl. Dave -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c2 --- Comment #2 from Dave Gilbert <dave@treblig.org> 2013-07-16 21:08:30 UTC --- OK, I can see what's going on here - I'll report it to the util-linux list; get_line() has: while (p < &Line[LineLen - 1]) { and can add two terminating characters at the end (a \n and a \0) which in itself seems dodgy, but anyway, inside that loop is some WIDECHAR code that uses a goto, and that goto can cause 2 characters to be written in one loop iteration, so you hit the end with I think p=Line[LineLen-1] and then you write two more terms. Dave -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c3 --- Comment #3 from Dave Gilbert <dave@treblig.org> 2013-07-17 00:02:21 UTC --- My upstream report: http://marc.info/?l=util-linux-ng&m=137401887913346&w=2 -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c Ye Yuan <yyuan@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |yyuan@suse.com AssignedTo|bnc-team-screening@forge.pr |sbrabec@suse.com |ovo.novell.com | -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c5 Michael Gorse <mgorse@suse.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |mgorse@suse.com --- Comment #5 from Michael Gorse <mgorse@suse.com> 2013-09-27 20:01:21 UTC --- I've filed SR#201207 to add the upstream patch for the buffer overflow. It is in git master but not 2.23.2. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c6 --- Comment #6 from Dave Gilbert <dave@treblig.org> 2013-09-27 20:26:15 UTC --- Hi Michael, Thanks - there are a few git commits which probably need to be added together: 1ef2db5a5672e09fa1337099b7d9d6ab61c19bdc - more: fix buffer overflow c36407293d63d428af176097527df89d623bc74f - more: check for buffer size when write multibyte char 418cb4b3bb7a61aec62ebe91194f7722ea608842 - more: guarantee space for multibyte Dave -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c7 --- Comment #7 from Bernhard Wiedemann <bwiedemann@suse.com> 2013-09-27 23:01:52 CEST --- This is an autogenerated message for OBS integration: This bug (829720) was mentioned in https://build.opensuse.org/request/show/201216 Factory / util-linux -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
https://bugzilla.novell.com/show_bug.cgi?id=829720 https://bugzilla.novell.com/show_bug.cgi?id=829720#c8 --- Comment #8 from Michael Gorse <mgorse@suse.com> 2013-09-27 22:09:42 UTC --- Thanks, Dave. I wasn't totally sure whether those patches were needed or not. Anyway, I've submitted request#201241 to add them. -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are on the CC list for the bug.
participants (1)
-
bugzilla_noreply＠novell.com