public inbox for glibc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug libc/10100] New: Regression in hsearch_r(): Segmentation fault over internal invariant violation
@ 2009-04-24 14:51 khoroshilov at linuxtesting dot org
2009-04-24 18:22 ` [Bug libc/10100] " drepper at redhat dot com
0 siblings, 1 reply; 3+ messages in thread
From: khoroshilov at linuxtesting dot org @ 2009-04-24 14:51 UTC (permalink / raw)
To: glibc-bugs
The modifications of hsearch_r() (see bug#6966) in glibc-2.9 leads to
segmentation faults in some circumstances as a consequence of internal invariant
violation.
Description of the hsearch_r in glibc sources reads:
We use an trick to speed up the lookup. The table is created by hcreate
with one more element available. This enables us to use the index zero
special. *This index will never be used because we store the first hash
index in the field used where zero means not used.* Every other value
means used. The used field can be used as a first fast comparison for
equality of the stored and the parameter value. This helps to prevent
unnecessary expensive calls of strcmp.
But the new version stores hash value in the 'used' field instead of table
index, which can be zero. As a result this invariant can be violated and
dereference of uninitialized memory may happen. An example demonstrating the
issue is available here:
http://linuxtesting.org/results/report?num=S0791
Quick fix may be:
hval = len;
count = len;
while (count-- > 0)
{
hval <<= 4;
hval += item.key[count];
}
+ /* make sure hash value is not zero */
+ if (!hval) hval = 1;
/* First hash function: simply take the modul but prevent zero. */
idx = hval % htab->size + 1;
But if zero table index is not used special in the new scheme, why do we need to
allocate extra element? So, long term solution requires some more investigation.
--
Summary: Regression in hsearch_r(): Segmentation fault over
internal invariant violation
Product: glibc
Version: unspecified
Status: NEW
Severity: normal
Priority: P2
Component: libc
AssignedTo: drepper at redhat dot com
ReportedBy: khoroshilov at linuxtesting dot org
CC: glibc-bugs at sources dot redhat dot com
http://sourceware.org/bugzilla/show_bug.cgi?id=10100
------- You are receiving this mail because: -------
You are on the CC list for the bug, or are watching someone who is.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-07-01 20:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
[not found] <bug-10100-131@http.sourceware.org/bugzilla/>
2014-05-27 3:00 ` [Bug libc/10100] Regression in hsearch_r(): Segmentation fault over internal invariant violation 2947868523 at qq dot com
2014-07-01 20:37 ` fweimer at redhat dot com
2009-04-24 14:51 [Bug libc/10100] New: " khoroshilov at linuxtesting dot org
2009-04-24 18:22 ` [Bug libc/10100] " drepper at redhat dot com
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).