[Bug libc/18662] New: __GI__IO_str_underflow in __tz_convert path

[Bug libc/18662] New: __GI__IO_str_underflow in __tz_convert path

[anand.bhat at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

            Bug ID: 18662
           Summary: __GI__IO_str_underflow in __tz_convert path
           Product: glibc
           Version: 2.21
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: anand.bhat at gmail dot com
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

I hit the above issue after an overnight run. Software that I use uses
localtime_r to get timestamp for logging events. 
Code that is used is:
void get_time_tz(char *time_string)
{
    time_t t = time(0);
    struct tm *lt = NULL;
    struct tm lt1;


    t = time(&t);
    lt = localtime_r(&t, &lt1);
    strftime(time_string, TIMEFORMAT_LEN, "%Y-%m-%dT%H:%M:%S.%s%z", &lt1);

    return;
}


Stacktrace of the thread that caused underflow is as follows:#0
__GI__IO_str_underflow (fp=0x7f9d948bea40) at strops.c:169

#1 0x00007f9d971c92fe in __GI__IO_default_uflow (fp=0x7f9d948bea40)at
genops.c:435

#2 0x00007f9d971a95b8 in _IO_vfscanf_internal (s=s@entry=0x7f9d948bea40,
format=format@entry=0x7f9d972da8c9 "%hu%n:%hu%n:%hu%n",
argptr=argptr@entry=0x7f9d948beb68, errp=errp@entry=0x0) at vfscanf.c:1750

#3 0x00007f9d971be647 in _IO_vsscanf (string=0x116c5e4 "5:30",

format=0x7f9d972da8c9 "%hu%n:%hu%n:%hu%n", args=args@entry=0x7f9d948beb68)

at iovsscanf.c:44

#4 0x00007f9d971b8d77 in __sscanf (s=s@entry=0x116c5e4 "5:30",

format=format@entry=0x7f9d972da8c9 "%hu%n:%hu%n:%hu%n") at sscanf.c:32

#5 0x00007f9d97208688 in __tzset_parse_tz (tz=0x116c5e4 "5:30") at tzset.c:211

#6 0x00007f9d9720b02d in __tzfile_compute (timer=1436677916,

use_localtime=use_localtime@entry=1,

leap_correct=leap_correct@entry=0x7f9d948bed58,

leap_hit=leap_hit@entry=0x7f9d948bed54, tp=tp@entry=0x7f9d948bedb0)

at tzfile.c:673

#7 0x00007f9d97209a65 in __tz_convert (timer=0x7f9d948beda0, use_localtime=1,

tp=0x7f9d948bedb0) at tzset.c:635


This issue was seen after 10+ hours of run.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18662] __GI__IO_str_underflow in __tz_convert path

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

Andreas Schwab <schwab@linux-m68k.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |WAITING

--- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
What exactly is the issue?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18662] __GI__IO_str_underflow in __tz_convert path

[anand.bhat at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

--- Comment #2 from Anand Bhat <anand.bhat at gmail dot com> ---
Calling threads continuously spins in the __GI_IO_str_underflow taking more
than 100% of CPU.

Main issue is there is an underflow in __tz_convert path which is dangerous
as it is widely used function.

Regards,
Anand




On Mon, Jul 13, 2015 at 1:30 PM, schwab@linux-m68k.org <
sourceware-bugzilla@sourceware.org> wrote:

> https://sourceware.org/bugzilla/show_bug.cgi?id=18662
>
> Andreas Schwab <schwab@linux-m68k.org> changed:
>
>            What    |Removed                     |Added
>
> ----------------------------------------------------------------------------
>              Status|NEW                         |WAITING
>
> --- Comment #1 from Andreas Schwab <schwab@linux-m68k.org> ---
> What exactly is the issue?
>
> --
> You are receiving this mail because:
> You reported the bug.
>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18662] __GI__IO_str_underflow in __tz_convert path

[schwab@linux-m68k.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

--- Comment #3 from Andreas Schwab <schwab@linux-m68k.org> ---
 __GI__IO_str_underflow should just return EOF and cause _IO_vsscanf to stop
parsing.  Why doesn't it do that?

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18662] __GI__IO_str_underflow in __tz_convert path

[anand.bhat at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

--- Comment #4 from Anand Bhat <anand.bhat at gmail dot com> ---
Not sure. I see that the thread spins in the underflow function.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18662] __GI__IO_str_underflow in __tz_convert path

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18662] __GI__IO_str_underflow in __tz_convert path

[ppluzhnikov at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18662

Paul Pluzhnikov <ppluzhnikov at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
                 CC|                            |ppluzhnikov at google dot com
         Resolution|---                         |WORKSFORME

--- Comment #5 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
(In reply to Anand Bhat from comment #4)
> Not sure. I see that the thread spins in the underflow function.

Unless you can provide a reproducible test case, there is not much we can do.

Test your software with Address Santizer or valgrind -- chances are the bug is
elsewhere and is corruption stdio state.

-- 
You are receiving this mail because:
You are on the CC list for the bug.