[Bug libc/3457] New: popen fails in sighandler after double free or corruption

[Bug libc/3457] New: popen fails in sighandler after double free or corruption

[schaudhu at blackrock dot com]

Please examine the following atomic example:

#include <iostream>
#include <signal.h>
#include <sys/signal.h>

using std::cout;
using std::endl;

void handler( int sig, siginfo_t *info, void *ctx )
{
    cout << "Got " << sig << " signal." << endl;
    popen( "/bin/ps", "r" );

    cout << "Finished." << endl;
}

int main()
{
    struct sigaction action;

    action.sa_sigaction = &handler;
    sigfillset( &action.sa_mask );
    action.sa_flags = SA_RESETHAND | SA_SIGINFO | SA_ONSTACK;

    sigaction( SIGABRT, &action, NULL );
    sigaction( SIGQUIT, &action, NULL );
    sigaction( SIGILL, &action, NULL );
    sigaction( SIGTRAP, &action, NULL );
    sigaction( SIGABRT, &action, NULL );
    sigaction( SIGFPE, &action, NULL );
    sigaction( SIGBUS, &action, NULL );
    sigaction( SIGSEGV, &action, NULL );
    sigaction( SIGSYS, &action, NULL );
    sigaction( SIGXCPU, &action, NULL );
    sigaction( SIGXFSZ, &action, NULL );

    void *p = ::malloc( 1 );
    ::free( p );
    ::free( p );

    return 0;
}

With older versions of glibc, this produces:

Got 11 signal.
Finished.
Segmentation fault (core dumped)


With newer versions of glibc, this HANGS after producing:

*** glibc detected *** double free or corruption (fasttop): 0x0804a008 ***
Got 6 signal.


The only way to terminate it is to forcibly kill the process.  Using system() 
instead of popen() works okay.  Can someone please investigate?

Thanks!

-- 
           Summary: popen fails in sighandler after double free or
                    corruption
           Product: glibc
           Version: 2.4
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: drepper at redhat dot com
        ReportedBy: schaudhu at blackrock dot com
                CC: glibc-bugs at sources dot redhat dot com,schaudhu at
                    blackrock dot com


http://sourceware.org/bugzilla/show_bug.cgi?id=3457

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/3457] popen fails in sighandler after double free or corruption

[schaudhu at blackrock dot com]

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|2.4                         |unspecified


http://sourceware.org/bugzilla/show_bug.cgi?id=3457

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.

[Bug libc/3457] popen fails in sighandler after double free or corruption

[drepper at redhat dot com]

------- Additional Comments From drepper at redhat dot com  2006-11-04 00:02 -------
You cannot use any non-async safe function in a signal handler.  The small list
of functions which is allowed is listed in section 2.4.3 of the XSH volume of POSIX.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |INVALID


http://sourceware.org/bugzilla/show_bug.cgi?id=3457

------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.