Bug 158875 – x11-apps/xconsole-1.0.2 segfaults

• Status: RESOLVED UPSTREAM
• Product: Gentoo Linux

[Description fernercc 2006-12-22 18:23:05 UTC]

(gdb) file /usr/bin/xconsole
Reading symbols from /usr/bin/xconsole...done.
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) run
Starting program: /usr/bin/xconsole 

Program received signal SIGSEGV, Segmentation fault.
0x00002b6886796900 in strcpy () from /lib/libc.so.6

[Comment 1 Jakub Moc (RETIRED) 2006-12-23 01:07:47 UTC]

emerge --info, please...

[Comment 2 Jakub Moc (RETIRED) 2006-12-23 07:22:14 UTC]

*** Bug 158916 has been marked as a duplicate of this bug. ***

[Comment 3 Jakub Moc (RETIRED) 2006-12-23 07:25:29 UTC]

*** Bug 157845 has been marked as a duplicate of this bug. ***

[Comment 4 fernercc 2006-12-23 07:27:31 UTC]

Sorry about reopening this bug 5 times :P 

I am still new to bugzilla. :D Thanks you for your patience.


##########################################################################
Portage 2.1.1-r2 (default-linux/amd64/2006.1, gcc-4.1.1, glibc-2.4-r3, 2.6.19-gentoo-r2 x86_64)
=================================================================
System uname: 2.6.19-gentoo-r2 x86_64 AMD Turion(tm) 64 Mobile Technology ML-37
Gentoo Base System version 1.12.1
Last Sync: Fri, 22 Dec 2006 20:00:01 +0000
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.3.7, 2.0.30
dev-lang/python:     2.4.3-r4
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.60
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=athlon64 -ggdb"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/share/X11/xkb"
CONFIG_PROTECT_MASK="/etc/env.d /etc/env.d/java/ /etc/gconf /etc/java-config/vms/ /etc/revdep-rebuild /etc/terminfo"
CXXFLAGS="-march=athlon64 -ggdb"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks metadata-transfer sandbox sfperms strict"
GENTOO_MIRRORS="http://mirror.datapipe.net/gentoo "
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="amd64 X aac acpi alsa alsa_pcm_plugins_adpcm alsa_pcm_plugins_alaw alsa_pcm_plugins_asym alsa_pcm_plugins_copy alsa_pcm_plugins_dmix alsa_pcm_plugins_dshare alsa_pcm_plugins_dsnoop alsa_pcm_plugins_empty alsa_pcm_plugins_extplug alsa_pcm_plugins_file alsa_pcm_plugins_hooks alsa_pcm_plugins_iec958 alsa_pcm_plugins_ioplug alsa_pcm_plugins_ladspa alsa_pcm_plugins_lfloat alsa_pcm_plugins_linear alsa_pcm_plugins_meter alsa_pcm_plugins_mulaw alsa_pcm_plugins_multi alsa_pcm_plugins_null alsa_pcm_plugins_plug alsa_pcm_plugins_rate alsa_pcm_plugins_route alsa_pcm_plugins_share alsa_pcm_plugins_shm alsa_pcm_plugins_softvol apm avahi berkdb bitmap-fonts bzip2 cdr cli cracklib crypt cups dlloader dri dvb dvd dvdr elibc_glibc fortran gdbm gif gnome gpm gtk gtk2 hal iconv input_devices_keyboard input_devices_mouse ipv6 isdnlog java javascript jpeg jpeg2k kernel_linux libg++ madwifi mp3 mpeg ncurses nls nptl nptlonly nsplugin ogg openal pam pcmcia pcntl pcre perl png ppds pppd python readline reflection session spl ssl szip tcpd truetype-fonts type1-fonts udev unicode usb userland_GNU video_cards_radeon wifi xml xorg xpm zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 5 Joshua Baergen (RETIRED) 2006-12-23 09:32:04 UTC]

I see the issue as well.  Could you run 'bt full' in GDB after xconsole dies and post the results here?

[Comment 6 fernercc 2006-12-23 15:57:56 UTC]

(gdb) file /usr/bin/xconsole
Reading symbols from /usr/bin/xconsole...done.
Using host libthread_db library "/lib/libthread_db.so.1".
(gdb) run
Starting program: /usr/bin/xconsole 

Program received signal SIGSEGV, Segmentation fault.
0x00002b308b5e7900 in strcpy () from /lib/libc.so.6
(gdb) bt full
#0  0x00002b308b5e7900 in strcpy () from /lib/libc.so.6
No symbol table info available.
#1  0x0000000000402e27 in get_pty (pty=0x504cdc, tty=0x504cd8, ttydev=0x504ce0 "", ptydev=0x504d20 "") at xconsole.c:834
No locals.
#2  0x0000000000401c12 in OpenConsole () at xconsole.c:274
        sbuf = {st_dev = 0, st_ino = 4204345, st_nlink = 4203239, st_mode = 0, st_uid = 0, st_gid = 70, pad0 = 0, st_rdev = 5334912, st_size = 140733728558848, 
  st_blksize = 0, st_blocks = 4204345, st_atim = {tv_sec = 4203239, tv_nsec = 0}, st_mtim = {tv_sec = 47487490588546, tv_nsec = 0}, st_ctim = {tv_sec = 0, 
    tv_nsec = 0}, __unused = {4203239, 526, 526}}
#3  0x0000000000402a68 in main (argc=1, argv=0x7fff1fe60fe8) at xconsole.c:688
        arglist = {{name = 0x503e8d "iconic", value = 5262505}, {name = 0x100000000 <Address 0x100000000 out of bounds>, value = 47487486669656}, {
    name = 0x7fff1fe60f60 "&#65533;3&#65533;g&#65533;~\n&#65533;9l\030&#65533;)*\n&#65533;", value = 47487486668800}, {name = 0x400f7c "__libc_start_main", value = 72057594037927936}, {name = 0x0, value = 0}, {
    name = 0x0, value = 0}, {name = 0x0, value = 47487487716256}, {
    name = 0x402ea0 "L\211d$&#65533;L\211l$&#65533;I\211&#65533;L\211t$&#65533;L\211|$&#65533;I\211&#65533;H\211\\$&#65533;H\211l$&#65533;H\203&#65533;8A\211&#65533;&#65533;(&#65533;&#65533;&#65533;H\215\005!\006\020", value = 4200203}, {name = 0x0, 
    value = 4206288}, {name = 0x0, value = 47487487716256}}
        num_args = 1
(gdb) 

[Comment 7 Joshua Baergen (RETIRED) 2007-01-13 19:10:11 UTC]

If I save the value of ptsname to an intermediate pointer, gdb says that the address that is pointed to is out of bounds.

Toolchain, do you know of any issues with ptsname on amd64?

[Comment 8 SpanKY 2007-01-13 21:30:38 UTC]

last time this came up it was because the source code sucked

run `emerge xconsole >& log` on a 64bit machine and post the log as an attachment

[Comment 9 Joshua Baergen (RETIRED) 2007-01-14 16:38:11 UTC]

(In reply to comment #8)
> last time this came up it was because the source code sucked
> 
> run `emerge xconsole >& log` on a 64bit machine and post the log as an
> attachment
> 

Ah, I didn't notice this warning before.  Makes it all obvious:

xconsole.c: In function ‘get_pty’:
xconsole.c:834: warning: cast to pointer from integer of different size

This is where it's segfaulting, since it's sign-extending the 32-bit value.

I'll still attach the log, but it's not very interesting.

[Comment 10 Joshua Baergen (RETIRED) 2007-01-14 16:38:45 UTC]

Created attachment 106955 [details]
log

xconsole compile log on 64-bit

[Comment 11 Kevin F. Quinn (RETIRED) 2007-01-14 19:28:21 UTC]

(In reply to comment #9)
> xconsole.c: In function ‘get_pty’:
> xconsole.c:834: warning: cast to pointer from integer of different size

Portage people - perhaps this warning would be a good candidate for the new QA checks in misc-functions.sh?

(actually, it'd be cool if these strings were defined outside of portage, perhaps in the profile directory, or from a file names in a make.conf variable - then we could add to them without updating portage all the time).

[Comment 12 SpanKY 2007-01-15 14:38:09 UTC]

i already added support for that check ... in fact, here's the QA output:

 * QA Notice: Package has poor programming practices which may compile
 *            but will almost certainly crash on 64bit architectures.
 * Function `ptsname' implicitly converted to pointer at xconsole.c:834

[Comment 13 Joshua Baergen (RETIRED) 2007-01-27 19:38:50 UTC]

Found the upstream bug.  I've attached a patch there that fixes the segfault.

[Comment 14 Jakub Moc (RETIRED) 2007-04-15 08:15:53 UTC]

*** Bug 174606 has been marked as a duplicate of this bug. ***