From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <glibc-bugs-return-5629-listarch-glibc-bugs=sources.redhat.com@sourceware.org>
Received: (qmail 2433 invoked by alias); 3 Nov 2006 23:56:26 -0000
Received: (qmail 2418 invoked by uid 48); 3 Nov 2006 23:56:17 -0000
Date: Fri, 03 Nov 2006 23:56:00 -0000
From: "schaudhu at blackrock dot com" <sourceware-bugzilla@sourceware.org>
To: glibc-bugs@sources.redhat.com
Message-ID: <20061103235615.3457.schaudhu@blackrock.com>
Reply-To: sourceware-bugzilla@sourceware.org
Subject: [Bug libc/3457] New: popen fails in sighandler after double free or corruption
X-Bugzilla-Reason: CC
Mailing-List: contact glibc-bugs-help@sourceware.org; run by ezmlm
Precedence: bulk
List-Subscribe: <mailto:glibc-bugs-subscribe@sourceware.org>
List-Post: <mailto:glibc-bugs@sourceware.org>
List-Help: <mailto:glibc-bugs-help@sourceware.org>, <http://sourceware.org/lists.html#faqs>
Sender: glibc-bugs-owner@sourceware.org
X-SW-Source: 2006-11/txt/msg00008.txt.bz2
List-Id: <glibc-bugs.sourceware.org>

Please examine the following atomic example:

#include <iostream>
#include <signal.h>
#include <sys/signal.h>

using std::cout;
using std::endl;

void handler( int sig, siginfo_t *info, void *ctx )
{
    cout << "Got " << sig << " signal." << endl;
    popen( "/bin/ps", "r" );

    cout << "Finished." << endl;
}

int main()
{
    struct sigaction action;

    action.sa_sigaction = &handler;
    sigfillset( &action.sa_mask );
    action.sa_flags = SA_RESETHAND | SA_SIGINFO | SA_ONSTACK;

    sigaction( SIGABRT, &action, NULL );
    sigaction( SIGQUIT, &action, NULL );
    sigaction( SIGILL, &action, NULL );
    sigaction( SIGTRAP, &action, NULL );
    sigaction( SIGABRT, &action, NULL );
    sigaction( SIGFPE, &action, NULL );
    sigaction( SIGBUS, &action, NULL );
    sigaction( SIGSEGV, &action, NULL );
    sigaction( SIGSYS, &action, NULL );
    sigaction( SIGXCPU, &action, NULL );
    sigaction( SIGXFSZ, &action, NULL );

    void *p = ::malloc( 1 );
    ::free( p );
    ::free( p );

    return 0;
}

With older versions of glibc, this produces:

Got 11 signal.
Finished.
Segmentation fault (core dumped)


With newer versions of glibc, this HANGS after producing:

*** glibc detected *** double free or corruption (fasttop): 0x0804a008 ***
Got 6 signal.


The only way to terminate it is to forcibly kill the process.  Using system() 
instead of popen() works okay.  Can someone please investigate?

Thanks!

-- 
           Summary: popen fails in sighandler after double free or
                    corruption
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: schaudhu at blackrock dot com
                CC: glibc-bugs at sources dot redhat dot com,schaudhu at
                    blackrock dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=3457

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.