Re: Crash in gconv_db.c

[Abhidnya Joshi <abhidnyachirmule@gmail.com>]

Hi Florian,

step[0] is a problem. When we tried to reproduce this, during runs, we
did check counter of step[0] in between. It actually got increased to
2^32 and then got set back to 0.
This is only with first entry of step which is for some INTERNAL thing.

I am not sure I understand the way steps are calculated using
find_derivation but this is what I see as the sequence of APIs.
iconv_open called to convert to UTF-16 followed by iconv and then
iconv_close. If you want more details about withing iconv_open, which
APIs are getting called in our environment,
I will try to collect that using GDB.

We use this sequence for each name which is part of readdir reply. Its
actually not at all specific to readdir. encoding is used to send any
chars on wire as part of SMB protocol.
Because with readdir, it is easy to reproduce. Customer too saw issues
during readdir.

Thanks and regards
Abhidnya Joshi

On Fri, Dec 20, 2019 at 9:39 PM Florian Weimer <fweimer@redhat.com> wrote:
>
> * Abhidnya Joshi:
>
> > The gconv_steps looked like below:
> >
> > (gdb) p *(&step[1])
> > $4 = {__shlib_handle = 0x7f028853b240, __modname = 0x7f028853b270
> > "/usr/lib64/gconv/UTF-16.so", __counter = 1, __from_name =
> > 0x7f028abca431 "INTERNAL",
> >   __to_name = 0x7f028853b220 "UTF-16LE//", __fct = 0x59e0be5c0391534f,
> > __btowc_fct = 0xa7e5bbe252f1534f, __init_fct = 0x59e0be5c1c91534f,
> > __end_fct = 0x59e0be5c03b1534f,
> >   __min_needed_from = 4, __max_needed_from = 4, __min_needed_to = 2,
> > __max_needed_to = 4, __stateful = 0, __data = 0x9bd320}
> > (gdb) p *(&step[0])
> > $5 = {__shlib_handle = 0x0, __modname = 0x0, __counter = 1,
> > __from_name = 0x7f028853b890 "ISO-10646/UTF8/", __to_name =
> > 0x7f028abca431 "INTERNAL",
> >   __fct = 0x7f028aa73ce0 <__gconv_transform_utf8_internal>,
> > __btowc_fct = 0x7f028aa714b0 <__gconv_btwoc_ascii>, __init_fct = 0x0,
> > __end_fct = 0x0, __min_needed_from = 1,
> >   __max_needed_from = 6, __min_needed_to = 4, __max_needed_to = 4,
> > __stateful = 0, __data = 0x0}
> > (gdb)
>
> Since both __counter values are 1, I'm not sure there is a counter
> overflow?
>
> What I meant is that it would be nice to have a sequence of glibc API
> calls which clearly demonstrate this behavior.  I can't reproduce this
> with an obvious sequence of iconv calls in a loop.
>
> Thanks,
> Florian
>