NetBSD Problem Report #47306

From cheusov@tut.by  Mon Dec 10 14:04:56 2012
Return-Path: <cheusov@tut.by>
Received: from mail.netbsd.org (mail.netbsd.org [149.20.53.66])
	by www.NetBSD.org (Postfix) with ESMTP id 62FDA63E4E4
	for <gnats-bugs@gnats.netbsd.org>; Mon, 10 Dec 2012 14:04:56 +0000 (UTC)
Message-Id: <s931uey57gl.fsf@cheusov.imb.invention.com>
Date: Mon, 10 Dec 2012 17:04:42 +0300
From: cheusov@tut.by
To: gnats-bugs@gnats.NetBSD.org
Subject: awk: segmentation fault (cat -> execute -> array)
X-Send-Pr-Version: 3.95

>Number:         47306
>Category:       bin
>Synopsis:       awk: segmentation fault (cat -> execute -> array)
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people
>State:          closed
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Dec 10 14:05:00 +0000 2012
>Closed-Date:    Sat Jul 21 21:11:18 +0000 2018
>Last-Modified:  Sat Jul 21 21:30:02 +0000 2018
>Originator:     Aleksey Cheusov
>Release:        NetBSD 6.0.0_PATCH
>Organization:
>Environment:
System: NetBSD cheusov.imb.invention.com 6.0.0_PATCH NetBSD 6.0.0_PATCH (GENERIC) #3: Fri Dec 7 11:55:38 FET 2012 cheusov@cheusov.imb.invention.com:/srv/obj/sys/arch/i386/compile/GENERIC i386
Architecture: i386
Machine: i386
>Description:
awk segfaults, see "How-To-Repeat:" section.
The problem is SUBSEP variable is first initialized in tran.c:syminit
and then '\034' is replaced with NULL here

   setfval (vp=0xbb913240, f=2)
       at /srv/src_netbsd6/external/historical/nawk/bin/../dist/tran.c:311
   311             vp->tval &= ~STR;       /* mark string invalid */

(gdb) bt
#0  setfval (vp=0xbb913240, f=2)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/tran.c:311
#1  0x0805444e in incrdecr (a=0xbb91a290, n=326)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1099
#2  0x08052345 in execute (u=0xbb91a280)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#3  0x080546f1 in cat (a=0xbb91a2d0, q=343)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1174
#4  0x08052345 in execute (u=0xbb91a2c0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#5  0x080546e3 in cat (a=0xbb91a370, q=343)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1173
#6  0x08052345 in execute (u=0xbb91a360)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#7  0x08052a0c in array (a=0xbb91a390, n=264)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:477
#8  0x08052345 in execute (u=0xbb91a380)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#9  0x08054494 in assign (a=0xbb91a3d0, n=312)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1111
#10 0x08052345 in execute (u=0xbb91a3c0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#11 0x080547f2 in pastat (a=0xbb91a3f0, n=259)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1203
#12 0x08052345 in execute (u=0xbb91a3e0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#13 0x08052daa in program (a=0xbb91a410, n=258)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:198
#14 0x08052345 in execute (u=0xbb91a400)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#15 0x08055d0f in run (a=0xbb91a400)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:141
#16 0x0805186f in main (argc=1, argv=<optimized out>)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/main.c:219
(gdb)


>How-To-Repeat:
0 cheusov>cat > in
1
1 2
0 cheusov>awk '1{ arr[$1 SUBSEP $2 SUBSEP ++cnt[$1]]=1}' < in
Segmentation fault (core dumped)
139 cheusov>gdb -q awk awk.core
Reading symbols from /usr/bin/awk...Reading symbols from /usr/libdata/debug/usr/bin/awk.debug...done.
done.
[New process 1]
Core was generated by `awk'.
Program terminated with signal 11, Segmentation fault.
#0  0x080529be in array (a=0xbb91d330, n=264)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:469
469             int nsub = strlen(*SUBSEP);
(gdb) bt
#0  0x080529be in array (a=0xbb91d330, n=264)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:469
#1  0x08052345 in execute (u=0xbb91d320)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#2  0x080546f1 in cat (a=0xbb91d350, q=343)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1174
#3  0x08052345 in execute (u=0xbb91d340)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#4  0x08052a0c in array (a=0xbb91d370, n=264)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:477
#5  0x08052345 in execute (u=0xbb91d360)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#6  0x08054494 in assign (a=0xbb91d3b0, n=312)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1111
#7  0x08052345 in execute (u=0xbb91d3a0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#8  0x080547f2 in pastat (a=0xbb91d3d0, n=259)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:1203
#9  0x08052345 in execute (u=0xbb91d3c0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#10 0x08052daa in program (a=0xbb91d3f0, n=258)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:198
#11 0x08052345 in execute (u=0xbb91d3e0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:166
#12 0x08055d0f in run (a=0xbb91d3e0)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:141
#13 0x0805186f in main (argc=1, argv=<optimized out>)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/main.c:219
(gdb) frame 0
#0  0x080529be in array (a=0xbb91d330, n=264)
    at /srv/src_netbsd6/external/historical/nawk/bin/../dist/run.c:469
469             int nsub = strlen(*SUBSEP);
(gdb) p SUBSEP
$1 = (char **) 0xbb913248
(gdb) p *SUBSEP
$2 = 0x0
(gdb) q
0 cheusov>

>Fix:

>Release-Note:

>Audit-Trail:
From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47306 CVS commit: src/external/historical/nawk/dist
Date: Mon, 10 Dec 2012 14:49:05 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Mon Dec 10 19:49:05 UTC 2012

 Modified Files:
 	src/external/historical/nawk/dist: tran.c

 Log Message:
 PR/47306: Aleksey Cheusov: Don't free strings of symbols where we maintain
 pointers to.


 To generate a diff of this commit:
 cvs rdiff -u -r1.5 -r1.6 src/external/historical/nawk/dist/tran.c

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

From: "Christos Zoulas" <christos@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc: 
Subject: PR/47306 CVS commit: src/tests/usr.bin/awk
Date: Mon, 10 Dec 2012 15:30:06 -0500

 Module Name:	src
 Committed By:	christos
 Date:		Mon Dec 10 20:30:06 UTC 2012

 Modified Files:
 	src/tests/usr.bin/awk: t_awk.sh

 Log Message:
 add a test case for PR/47306


 To generate a diff of this commit:
 cvs rdiff -u -r1.4 -r1.5 src/tests/usr.bin/awk/t_awk.sh

 Please note that diffs are not public domain; they are subject to the
 copyright notices on the relevant files.

State-Changed-From-To: open->closed
State-Changed-By: dholland@NetBSD.org
State-Changed-When: Sat, 21 Jul 2018 21:11:18 +0000
State-Changed-Why:
fixed in head before -7 was branched, -6 is now EOL


From: David Holland <dholland-bugs@netbsd.org>
To: gnats-bugs@netbsd.org
Cc: 
Subject: Re: bin/47306 (awk: segmentation fault (cat -> execute -> array))
Date: Sat, 21 Jul 2018 21:27:46 +0000

 On Sat, Jul 21, 2018 at 09:11:19PM +0000, dholland@NetBSD.org wrote:
  > fixed in head before -7 was branched, -6 is now EOL

 Minor correction: I believe -6 will remain non-EOL for a month now
 that -8 is out (like we did with -5)... nevertheless this issue is now
 dead, it's not getting pulled up to -6 at this stage regardless.

 -- 
 David A. Holland
 dholland@netbsd.org

>Unformatted:

Home	PR Database Search