[Bug libc/15233] New: crash in tzset

[Bug libc/15233] New: crash in tzset

[nit_bng at yahoo dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15233

             Bug #: 15233
           Summary: crash in tzset
           Product: glibc
           Version: 2.8
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
        AssignedTo: unassigned@sourceware.org
        ReportedBy: nit_bng@yahoo.com
                CC: drepper.fsp@gmail.com
    Classification: Unclassified


Hi,
We are using glibc v2.8 and seeing the crash intermittently in tzset() being
called by strftime(). I searched on google and found many similar issues
(http://www.archivum.info/kde-bugs-dist@kde.org/2010-06/08363/%28Bug-210769%29-Plasma-random-crash-%28time-dataengine%29-%28libc-related-tzset-KSystemTimeZoneBackend-offset-KSystemTimeZoneBackend.html).

Out of these, many are closed as non-reproducible and other mentioning that it
is not observed after upgrading the glibc to 2.11. But none of them have
mentioned the root cause or fix of it.

Do we have more information on this (root cause and the fix)? Following is the
stack trace:

Stack Trace:
(signal 11 = Access of a NULL pointer or bad memeory location)
#0  0x00000035ca675218 in ?? () from ./lib64/libc.so.6
#1  0x00000035ca675726 in free () from ./lib64/libc.so.6
#2  0x00000035ca6646c1 in fclose () from ./lib64/libc.so.6
#3  0x00000035ca6914b2 in ?? () from ./lib64/libc.so.6
#4  0x00000035ca690640 in ?? () from ./lib64/libc.so.6
#5  0x00000035ca690970 in tzset () from ./lib64/libc.so.6
#6  0x00000035ca696405 in ?? () from ./lib64/libc.so.6
#7  0x00000035ca6ca0de in __vsyslog_chk () from ./lib64/libc.so.6
#8  0x00000035ca6ca700 in syslog () from ./lib64/libc.so.6

thanks

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/15233] crash in tzset

[aj at suse dot de]

http://sourceware.org/bugzilla/show_bug.cgi?id=15233

Andreas Jaeger <aj at suse dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING
                 CC|                            |aj at suse dot de

--- Comment #1 from Andreas Jaeger <aj at suse dot de> 2013-03-06 10:53:53 UTC ---
I don't remember this and the git log of tzset.c does not point out anything
obvious. If you have a self-contained, reproduceable test case that still fails
with current glibc, we'll look into it.

But we cannot help with glibc 2.8. If you're interested, feel free to generate
a diff between time/tzset.c from glibc 2.8 to 2.11 and check whether that
helps.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/15233] crash in tzset

[nit_bng at yahoo dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=15233

--- Comment #2 from nit_bng at yahoo dot com 2013-03-06 11:22:40 UTC ---
We don't have test steps to recreate it. We observed 2-3 times over a time. I
looked at difference in 2.8 and 2.11 for tzset.c and tzfile.c but doesn't find
anything obvious. I will look again in details.

Thanks, I just wanted to know if something like this was reported earlier to
this forum.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/15233] crash in tzset

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=15233

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
                 CC|                            |neleai at seznam dot cz
         Resolution|---                         |WORKSFORME

--- Comment #3 from Ondrej Bilka <neleai at seznam dot cz> ---
As previously stated a 2.8 is quite old and there is no reproducer closing.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/15233] crash in tzset

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=15233

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.