From: Abhidnya Joshi <abhidnyachirmule@gmail.com>
To: Florian Weimer <fweimer@redhat.com>
Cc: libc-locales@sourceware.org
Subject: Re: Crash in gconv_db.c
Date: Tue, 19 Nov 2019 14:05:00 -0000 [thread overview]
Message-ID: <CALmqtCVKqf53j7=SbUA-k8jHu4AydsoFfN6SZVX8Hv=iYVBLuQ@mail.gmail.com> (raw)
In-Reply-To: <877e42cqfo.fsf@oldenburg2.str.redhat.com>
I tried to experiment again. When I run conversions via readdir, I can
see counter increasing as below:
(gdb) c
Continuing.
[Switching to Thread 0x7f936d472700 (LWP 16095)]
Breakpoint 1, find_derivation (toset=toset@entry=0x7f936d46e990
"UTF-16LE//", toset_expand=0x0, fromset=fromset@entry=0x7f936d46e970
"UTF-8//",
fromset_expand=fromset_expand@entry=0x7f9392c17ae8
"ISO-10646/UTF8/", handle=handle@entry=0x7f936d46e900,
nsteps=nsteps@entry=0x7f936d46e910) at gconv_db.c:426
426 gconv_db.c: No such file or directory.
(gdb) s
0x00007f93948e62be in increment_counter (nsteps=2,
steps=0x7f9392c18500) at gconv_db.c:410
410 in gconv_db.c
(gdb) p *(&(steps[0]))
$1 = {__shlib_handle = 0x0, __modname = 0x0, __counter = 1782250,
__from_name = 0x7f9392c18c50 "ISO-10646/UTF8/", __to_name =
0x7f9394a41431 "INTERNAL",
__fct = 0x7f93948eace0 <__gconv_transform_utf8_internal>,
__btowc_fct = 0x7f93948e84b0 <__gconv_btwoc_ascii>, __init_fct = 0x0,
__end_fct = 0x0, __min_needed_from = 1,
__max_needed_from = 6, __min_needed_to = 4, __max_needed_to = 4,
__stateful = 0, __data = 0x0}
(gdb) q
After some time when I stopped readdirs, I saw counter back to very low count:
(gdb) b increment_counter
Breakpoint 1 at 0x7f93948e62be
(gdb) c
Continuing.
[Switching to Thread 0x7f938e0e6700 (LWP 22822)]
Breakpoint 1, find_derivation (toset=toset@entry=0x7f938e0e3160
"UTF-8//", toset_expand=0x7f9392c17ae8 "ISO-10646/UTF8/",
fromset=fromset@entry=0x7f938e0e3140 "WCHAR_T//",
fromset_expand=fromset_expand@entry=0x7f9392c17a2a "INTERNAL",
handle=handle@entry=0x7f938e0e30d0,
nsteps=nsteps@entry=0x7f938e0e30e0) at gconv_db.c:426
426 gconv_db.c: No such file or directory.
(gdb) s
0x00007f93948e62be in increment_counter (nsteps=1, steps=0x6a8d90) at
gconv_db.c:410
410 in gconv_db.c
(gdb) p *(&(steps[0]))
$1 = {__shlib_handle = 0x0, __modname = 0x0, __counter = 26,
__from_name = 0x6a8e00 "INTERNAL", __to_name = 0x6a8e20
"ISO-10646/UTF8/",
__fct = 0x7f93948ea200 <__gconv_transform_internal_utf8>,
__btowc_fct = 0x0, __init_fct = 0x0, __end_fct = 0x0,
__min_needed_from = 4, __max_needed_from = 4, __min_needed_to = 1,
__max_needed_to = 6, __stateful = 0, __data = 0x0}
I have few questions after looking at this behaviour:
1. Is there a chance of __counter getting integer overflow and getting
reset to 0 (after 2^32)?
2. When do we see steps getting freed? Is it via free_derivation?
Thanks
Abhidnya
On Thu, Nov 14, 2019 at 11:04 PM Florian Weimer <fweimer@redhat.com> wrote:
>
> * Abhidnya Joshi:
>
> > Is there a possibility of integer overflow? I can see that counter
> > keeps increasing even after icon_open, iconv and iconv_close is used
> > in a sequence but multiple times for encoding.
>
> There could be. The reference counter handling is strange. I haven't
> seen this particular bug, but I wouldn't be surprised if it existed.
>
> Thanks,
> Florian
>
next prev parent reply other threads:[~2019-11-19 14:05 UTC|newest]
Thread overview: 17+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-11 16:05 Abhidnya Joshi
2019-11-11 16:19 ` Florian Weimer
2019-11-11 16:47 ` Abhidnya Joshi
[not found] ` <CALmqtCVBCb2vJ+XNb6WZa1csNZaisLmqoG5nTn-QUU0MO=UbPw@mail.gmail.com>
2019-11-14 17:34 ` Florian Weimer
2019-11-19 14:05 ` Abhidnya Joshi [this message]
2019-11-28 18:47 ` Abhidnya Joshi
2019-12-12 15:58 ` Florian Weimer
2019-12-20 15:05 ` Abhidnya Joshi
2019-12-20 15:16 ` Florian Weimer
2019-12-20 15:40 ` Abhidnya Joshi
2019-12-20 15:43 ` Florian Weimer
2019-12-20 15:53 ` Abhidnya Joshi
2019-12-20 16:09 ` Florian Weimer
2019-12-20 16:42 ` Abhidnya Joshi
2019-12-20 16:47 ` Florian Weimer
2019-12-20 17:18 ` Abhidnya Joshi
2019-12-20 18:39 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CALmqtCVKqf53j7=SbUA-k8jHu4AydsoFfN6SZVX8Hv=iYVBLuQ@mail.gmail.com' \
--to=abhidnyachirmule@gmail.com \
--cc=fweimer@redhat.com \
--cc=libc-locales@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).