[Bug libc/14716] New: memmem crash

[Bug libc/14716] New: memmem crash

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

             Bug #: 14716
           Summary: memmem crash
           Product: glibc
           Version: 2.17
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: unassigned@sourceware.org
        ReportedBy: jan.kratochvil@redhat.com
                CC: allan@archlinux.org, drepper.fsp@gmail.com,
                    eblake@redhat.com, hjl.tools@gmail.com,
                    law@redhat.com, maxim.kuvyrkov@gmail.com,
                    ppluzhnikov@google.com
        Depends on: 14602
    Classification: Unclassified


Created attachment 6683
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6683
GDB debug output

+++ This bug was initially created as a clone of Bug #14602 +++

glibc-2.16.90-24.fc19.x86_64
https://koji.fedoraproject.org/koji/buildinfo?buildID=359617

Core was generated by
`/unsafe/home/jkratoch/hammock/20121013Build-gdbcvs-rawhide/fedora-rawhide-x86_6'.
Program terminated with signal 11, Segmentation fault.
#0  two_way_short_needle (needle_len=<optimized out>, needle=<optimized out>,
haystack_len=<optimized out>, haystack=<optimized out>) at str-two-way.h:309
309                   != (haystack_char = CANON_ELEMENT (*phaystack++)))

Detailed debug dump attached.

I do not have it reproducible by hand, it happened during nightly builds.

Regression by:
glibc-2.16.90-23.fc19.x86_64 -> glibc-2.16.90-24.fc19.x86_64

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

--- Comment #1 from Jan Kratochvil <jan.kratochvil at redhat dot com> 2012-10-13 18:58:13 UTC ---
Created attachment 6684
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6684
.tar.xz of core file, gdb binary, rpm -qa (Fedora Rawhide 2012-10-12)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jan.kratochvil at redhat
                   |                            |dot com

--- Comment #2 from Jan Kratochvil <jan.kratochvil at redhat dot com> 2012-10-13 19:06:07 UTC ---
Reproduced it with FSF GDB HEAD:
cd gdb/testsuite; while runtest gdb.base/find.exp;do :;done

According to logs crashes also: gdb.python/py-inferior.exp

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> 2012-10-13 21:08:34 UTC ---
Can you provide GDB command line option to trigger this?

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> 2012-10-13 21:47:25 UTC ---
You can use a memmem wrapper to extract a testcase:

1. Copy simple_memmem from string/test-memmem.c in glibc.
2. Write a function to dump memmem input into a C source code, including
   address values.
3. Call simple_memmem to get correct result.
4. Compare result from memmem against simple_memmem.  If it fails,
   call the dumper to generate the testcase.
4. Link GDB against the memmem wrapper.

You can generate a testcase by

1. Dumper called on wrong result from memmem.
2. Run dumper by hand inside GDB when GDB segfaults

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #6683|0                           |1
        is obsolete|                            |
   Attachment #6684|0                           |1
        is obsolete|                            |

--- Comment #5 from Jan Kratochvil <jan.kratochvil at redhat dot com> 2012-10-14 06:21:54 UTC ---
Created attachment 6685
  --> http://sourceware.org/bugzilla/attachment.cgi?id=6685
.c crash reproducer.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[jan.kratochvil at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

Jan Kratochvil <jan.kratochvil at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[maxim.kuvyrkov at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

Maxim Kuvyrkov <maxim.kuvyrkov at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
         AssignedTo|unassigned at sourceware    |maxim.kuvyrkov at gmail dot
                   |dot org                     |com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[hjl.tools at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |2.17

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[maxim.kuvyrkov at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=14716

Maxim Kuvyrkov <maxim.kuvyrkov at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|                            |FIXED

--- Comment #6 from Maxim Kuvyrkov <maxim.kuvyrkov at gmail dot com> 2012-10-16 00:25:00 UTC ---
Fixed in e9f372520618161d7d73e028ca23818e83b88bbc.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/14716] memmem crash

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=14716

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.