From: Carlos O'Donell <carlos@redhat.com>
To: Hans Petter Selasky <hps@selasky.org>, libc-alpha@sourceware.org
Subject: Re: argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)
Date: Thu, 9 Apr 2020 17:32:27 -0400 [thread overview]
Message-ID: <804903a8-3b0e-941e-8f41-4c134d18d101@redhat.com> (raw)
In-Reply-To: <1d1c81d1-23cd-9a02-a059-a66c7146b396@selasky.org>
On 4/9/20 5:12 PM, Hans Petter Selasky wrote:
> Dear GNU libc people,
>
> I'm a FreeBSD developer and we have a port of some of your glibc code. I recently found a bug, which I'm not sure if you've fixed.
>
> The fix for FreeBSD is here:
> https://svnweb.freebsd.org/changeset/ports/531220
>
>> Log:
>> Fix segmentation fault when showing help text.
>> Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>> Backtrace:
>> #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>> hhstate=0x7fffffffe5d8) at argp-help.c:1164
>> #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>> #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>> name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>> #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>> name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>>
>
> It turns out the argp_help invoke _help with a NULL state. In some cases the state may be used when printing the help message, for example when running dvbv5-scan w/o any arguments in FreeBSD.
Do you have a distilled minimal C example that shows the crash?
I just want to make sure we understand exactly what dvbv5-scan
is doing with the API.
> Fix this by creating a dummy argp_state structure on the stack, and fill in the used arguments.
>
> I hope my fix is right. At least it fixes the issue for me.
In glibc we have:
1164 const char *tstr = real->doc ? dgettext (state == NULL ? NULL
1165 : state->root_argp->argp_domain,
1166 real->doc) : 0;
We are constantly checking for a NULL state and not using it.
It comes from this commit:
commit 400cc70af5972a50618702da02d18aee845ce542
Author: Ulrich Drepper <drepper@redhat.com>
Date: Wed May 10 06:39:15 2006 +0000
* io/ftw.c (open_dir_stream): Return right away if REALLOC fails.
[Coverity CID 229, 230]
* argp/argp-help.c (hol_entry_help): Handle STATE==NULL in ARG and
DGETTEXT calls.
(hol_help): Likewise. [Coverity CID 226, 227]
* string/argz-replace.c (__argz_replace): Unconditionally call
free on SRC. [Coverity CID 225]
* nis/nis_creategroup.c (nis_creategroup): No need to duplicate
the return value of __nis_default_owner and __nis_default_group,
it has been especially allocated. [Coverity CID 224]
The STATE=NULL part looks relevant.
Do you have this fix?
--
Cheers,
Carlos.
next prev parent reply other threads:[~2020-04-09 21:32 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <22128b83-2388-561f-7c26-8d097d6ca909@selasky.org>
2020-04-09 21:12 ` Hans Petter Selasky
2020-04-09 21:32 ` Carlos O'Donell [this message]
2020-04-10 11:12 ` Hans Petter Selasky
2020-04-10 13:55 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=804903a8-3b0e-941e-8f41-4c134d18d101@redhat.com \
--to=carlos@redhat.com \
--cc=hps@selasky.org \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).