[Bug libc/18333] New: FAIL: timezone/tst-tzset (segmentation fault)

[Bug libc/18333] New: FAIL: timezone/tst-tzset (segmentation fault)

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

            Bug ID: 18333
           Summary: FAIL: timezone/tst-tzset (segmentation fault)
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: hjl.tools at gmail dot com
                CC: drepper.fsp at gmail dot com, fweimer at redhat dot com
  Target Milestone: ---

On x32, I got

(gdb) r --direct
Starting program:
/export/build/gnu/glibc-x32/build-x86_64-linux/timezone/tst-tzset --direct

Program received signal SIGSEGV, Segmentation fault.
0xf7a95a23 in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0)
    at malloc.c:3979
3979            unlink(nextchunk, bck, fwd);
(gdb) bt
#0  0xf7a95a23 in _int_free (av=<optimized out>, p=<optimized out>, 
    have_lock=0) at malloc.c:3979
#1  0xf7a9a2cb in __GI___libc_free (mem=<optimized out>) at malloc.c:2949
#2  0xf7a840a8 in _IO_new_fclose (fp=<optimized out>) at iofclose.c:85
#3  0xf7ad3213 in __tzfile_read (file=<optimized out>, 
    file@entry=0x6042a3 "/tmp/tst-tzset-Jr2s0j", extra=extra@entry=0, 
    extrap=extrap@entry=0x0) at tzfile.c:450
#4  0xf7ad2299 in tzset_internal (explicit=1, always=1) at tzset.c:447
#5  __tzset () at tzset.c:600
#6  0x0040180b in test_tz_file (size=4294967290) at tst-tzset.c:108
#7  0x004019a4 in do_test () at tst-tzset.c:164
#8  0x004011fc in main (argc=<optimized out>, argv=<optimized out>)
    at ../test-skeleton.c:356
(gdb) 

On x86-64, I got

==22306== Memcheck, a memory error detector
==22306== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==22306== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==22306== Command: ./build-x86_64-linux/timezone/tst-tzset --direct
==22306== 
==22306== Invalid read of size 1
==22306==    at 0x4C2CB82: strlen (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==22306==    by 0x4EDEAEF: update_vars (tzset.c:161)
==22306==    by 0x4EDF1B8: __tzset_parse_tz (tzset.c:386)
==22306==    by 0x4EDF5E1: tzset (tzset.c:591)
==22306==    by 0x401F0D: do_test (tst-tzset.c:196)
==22306==    by 0x4016D6: main (test-skeleton.c:356)
==22306==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==22306== 
==22306== 
==22306== Process terminating with default action of signal 11 (SIGSEGV)
==22306==  Access not within mapped region at address 0x0
==22306==    at 0x4C2CB82: strlen (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==22306==    by 0x4EDEAEF: update_vars (tzset.c:161)
==22306==    by 0x4EDF1B8: __tzset_parse_tz (tzset.c:386)
==22306==    by 0x4EDF5E1: tzset (tzset.c:591)
==22306==    by 0x401F0D: do_test (tst-tzset.c:196)
==22306==    by 0x4016D6: main (test-skeleton.c:356)
==22306==  If you believe this happened as a result of a stack
==22306==  overflow in your program's main thread (unlikely but
==22306==  possible), you can try to increase the size of the
==22306==  main thread stack using the --main-stacksize= flag.
==22306==  The main thread stack size used in this run was 8388608.
==22306== 
==22306== HEAP SUMMARY:
==22306==     in use at exit: 67,108,929 bytes in 3 blocks
==22306==   total heap usage: 84 allocs, 81 frees, 559,940,347 bytes allocated
==22306== 
==22306== LEAK SUMMARY:
==22306==    definitely lost: 0 bytes in 0 blocks
==22306==    indirectly lost: 0 bytes in 0 blocks
==22306==      possibly lost: 0 bytes in 0 blocks
==22306==    still reachable: 67,108,929 bytes in 3 blocks
==22306==         suppressed: 0 bytes in 0 blocks
==22306== Rerun with --leak-check=full to see details of leaked memory
==22306== 
==22306== For counts of detected and suppressed errors, rerun with: -v
==22306== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
[1]    22306 segmentation fault (core dumped)  valgrind
./build-x86_64-linux/timezone/tst-tzset --direct

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |2.21

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
With this patch:

diff --git a/timezone/tst-tzset.c b/timezone/tst-tzset.c
index aefcc76..4aff73c 100644
--- a/timezone/tst-tzset.c
+++ b/timezone/tst-tzset.c
@@ -184,7 +184,7 @@ do_test (void)
   return 1;
       }
     tzset ();
-
+#if 0
     memset (value, '0', length);
     value[0] = '<';
     value[length - 1] = '>';
@@ -194,6 +194,7 @@ do_test (void)
   return 1;
       }
     tzset ();
+#endif
   }

   return errors > 0;

I got

==20674== Memcheck, a memory error detector
==20674== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==20674== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info
==20674== Command: ./build-x86_64-linux/timezone/tst-tzset --direct
==20674== 
==20674== Syscall param unlink(pathname) points to unaddressable byte(s)
==20674==    at 0x4F11DD7: unlink (syscall-template.S:81)
==20674==    by 0x4E9B188: remove (remove.c:34)
==20674==    by 0x401B88: delete_temp_files (test-skeleton.c:102)
==20674==    by 0x4E6AEB1: __run_exit_handlers (exit.c:82)
==20674==    by 0x4E6AF04: exit (exit.c:104)
==20674==    by 0x4E558B6: (below main) (libc-start.c:323)
==20674==  Address 0x51d9450 is 0 bytes inside a block of size 22 free'd
==20674==    at 0x4C2ACE9: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==20674==    by 0x401E6F: do_test (tst-tzset.c:158)
==20674==    by 0x4016D6: main (test-skeleton.c:356)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |fweimer at redhat dot com
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

--- Comment #2 from Florian Weimer <fweimer at redhat dot com> ---
There are multiple issues here: a crash after a memory allocation failure in
tzset (which somehow appears to occur under valgrind).  In addition, the
tst-tzset test case contains an ill-fated attempt to avoid the create_temp_file
memory leak.  I'll fix the test harness to support this use case (existing code
will observe no difference).

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Florian Weimer <fweimer at redhat dot com> ---
Fixed in commit cc8dcf96e71dd643f929e32150904cd6ad69efa8 for glibc 2.22.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |REOPENED
         Resolution|FIXED                       |---

--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> ---
It isn't fixed on x32:

Program received signal SIGSEGV, Segmentation fault.
0xf7a9cb57 in _int_free (av=<optimized out>, p=0x604338, have_lock=0)
    at malloc.c:3979
3979            unlink(nextchunk, bck, fwd);
(gdb) bt
#0  0xf7a9cb57 in _int_free (av=<optimized out>, p=0x604338, have_lock=0)
    at malloc.c:3979
#1  0xf7a8b847 in _IO_new_fclose (fp=fp@entry=0x604340) at iofclose.c:85
#2  0xf7ad55b0 in __tzfile_read (file=<optimized out>, 
    file@entry=0x604303 "/tmp/tst-tzset-mTzsgZ", extra=extra@entry=0, 
    extrap=extrap@entry=0x0) at tzfile.c:461
#3  0xf7ad48ea in tzset_internal (explicit=1, always=1) at tzset.c:443
#4  __tzset () at tzset.c:596
#5  0x0040187e in test_tz_file (size=4294967290) at tst-tzset.c:108
#6  0x00401a24 in do_test () at tst-tzset.c:164
#7  0x0040123c in main (argc=<optimized out>, argv=<optimized out>)
    at ../test-skeleton.c:369
(gdb) 

You can build glibc for x32 on Ubuntu 14.04.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> ---
(gdb) bt
#0  __GI__IO_file_xsgetn (fp=<optimized out>, data=<optimized out>, 
    n=4294967295) at fileops.c:1434
#1  0xf7a95cdd in __GI___fread_unlocked (buf=<optimized out>, 
    size=size@entry=1, count=count@entry=4294967295, fp=fp@entry=0x604340)
    at iofread_u.c:44
#2  0xf7ad5a22 in __tzfile_read (file=<optimized out>, 
    file@entry=0x604303 "/tmp/tst-tzset-5VrVdp", extra=extra@entry=0, 
    extrap=extrap@entry=0x0) at tzfile.c:404
#3  0xf7ad48ea in tzset_internal (explicit=1, always=1) at tzset.c:443
#4  __tzset () at tzset.c:596
#5  0x00401eda in test_tz_file (size=4294967290) at tst-tzset.c:108
#6  0x0040205d in do_test () at tst-tzset.c:164
#7  0x00401a8e in main (argc=1, argv=0xffffcf18) at ../test-skeleton.c:369
(gdb) p count
$11 = -135168
(gdb) p (unsigned int) count
$12 = 4294832128
(gdb) 

If count is greater than SSIZE_MAX, the result is unspecified.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|REOPENED                    |RESOLVED
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.22

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed for 2.22.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://sourceware.org/bugz
                   |                            |illa/show_bug.cgi?id=17715

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18333] FAIL: timezone/tst-tzset (segmentation fault)

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18333

--- Comment #7 from Florian Weimer <fweimer at redhat dot com> ---
Subsequent fix is in commit 5cffc05ed5c7fea312f2822d388afc025d03c08a.

-- 
You are receiving this mail because:
You are on the CC list for the bug.