argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Hans Petter Selasky <hps@selasky.org>]

[-- Attachment #1: Type: text/plain, Size: 1242 bytes --]

Dear GNU libc people,

I'm a FreeBSD developer and we have a port of some of your glibc code. I 
recently found a bug, which I'm not sure if you've fixed.

The fix for FreeBSD is here:
https://svnweb.freebsd.org/changeset/ports/531220

> Log:
>   Fix segmentation fault when showing help text.
>   Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>   
>   Backtrace:
>   #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>          hhstate=0x7fffffffe5d8) at argp-help.c:1164
>   #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>   #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>          name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>   #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>          name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>   

It turns out the argp_help invoke _help with a NULL state. In some cases 
the state may be used when printing the help message, for example when 
running dvbv5-scan w/o any arguments in FreeBSD.

Fix this by creating a dummy argp_state structure on the stack, and fill 
in the used arguments.

I hope my fix is right. At least it fixes the issue for me.

Thank you!

--HPS


[-- Attachment #2: patch-argp-help.c --]
[-- Type: text/x-csrc, Size: 441 bytes --]

--- argp-help.c.orig	2020-04-09 17:39:48 UTC
+++ argp-help.c
@@ -1704,7 +1704,10 @@ Try `%s --help' or `%s --usage' for more information.\
 void __argp_help (const struct argp *argp, FILE *stream,
 		  unsigned flags, char *name)
 {
-  _help (argp, 0, stream, flags, name);
+  struct argp_state state = {
+    .root_argp = argp,
+  };
+  _help (argp, &state, stream, flags, name);
 }
 #ifdef weak_alias
 weak_alias (__argp_help, argp_help)