Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 69356 - guile-1.6.4 and lower contains a use-after-free bug which causes segfaults
Summary: guile-1.6.4 and lower contains a use-after-free bug which causes segfaults
Status: RESOLVED UPSTREAM
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: [OLD] Library (show other bugs)
Hardware: All Linux
: High normal (vote)
Assignee: Gentoo Linux Gnome Desktop Team
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2004-10-28 23:47 UTC by Jonathan Briggs
Modified: 2005-03-10 00:32 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jonathan Briggs 2004-10-28 23:47:02 UTC
I recommend updating to the Guile 1.6.5 release where this bug is fixed.
This bug has caused me problems with my amd64 laptop where Gnome Solitare will segfault on start.

Reproducible: Always
Steps to Reproduce:
1. Get Gnome 2.8 and gnome-games on a amd64 system.
2. Click on Applications->Games->Solitare.

Actual Results:  
Segfault window pops up.

Expected Results:  
Run Solitare.
Comment 1 Mike Gardiner (RETIRED) gentoo-dev 2004-11-06 01:36:51 UTC
Call me crazy, but I don't have Applications -> Games -> Solitaire from gnome-games. I can't see any solitaire game provided by that package.

Comment 2 Jonathan Briggs 2004-11-06 13:48:42 UTC
Aisleriot (the Solitare games) only builds if you have guile installed.

emerge guile
emerge gnome-games

and you should have it.
Comment 3 Mike Gardiner (RETIRED) gentoo-dev 2004-11-06 19:05:17 UTC
Okay, thanks for that Jonathon. However I can't reproduce this on my x86 - I can play Aisleriot with no problems.

@amd64 team: could you please look?

@reporter: do you have a link to info on the use-after-freed bug?

Thanks
Comment 4 Simon Stelling (RETIRED) gentoo-dev 2004-11-07 02:07:55 UTC
sorry, i can't confirm this -> WORKSFORME.

can you please provide a emerge info and possibly a strace?
Comment 5 Jonathan Briggs 2004-11-07 08:40:58 UTC
The Guile bug is in the guile source in libguile/gc.c:2054
The scm_must_realloc function calls realloc() before calling check_mtrigger().  check_mtrigger() calls scm_igr() which calls scm_mark_subr_table() which uses the global variable scm_subr_table.

When scm_must_realloc() is used on scm_subr_table, it ends up using scm_subr_table after realloc has freed it.

http://www.gnu.org/software/guile/news.html contains notes about the 1.6.5 Guile release.  One note of interest is this:
"The use of scm_must_realloc() for memory which is scanned by GC could trigger a GC scan of a free()d block of memory. This has been fixed."
Comment 6 Leonardo Boshell (RETIRED) gentoo-dev 2005-03-10 00:32:33 UTC
Guile 1.6.6 and 1.6.7 are in the tree, taking care of this bug. The fix could be applied to older guile versions if the patch is provided.