Date: Tue, 29 Oct 1996 03:07:23 +1100 (EST) From: David Nugent <davidn@sdev.usn.blaze.net.au> To: FreeBSD-gnats-submit@freebsd.org Subject: bin/1916: List management bug in last, shows up with /etc/malloc.conf -> AJ Message-ID: <199610281607.DAA10189@sdev.usn.blaze.net.au> Resent-Message-ID: <199610281610.IAA04237@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 1916 >Category: bin >Synopsis: A linked list bug in last.c causes last to dump core >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Oct 28 08:10:01 PST 1996 >Last-Modified: >Originator: David Nugent - davidn@blaze.net.au >Organization: Unique Computing, Melbourne, Australia >Release: FreeBSD 2.2-CURRENT i386 >Environment: Under some circumstances, last from -current dumps core. A sample wtmp file (uuencoded attached below) demonstrates the problem. >Description: A pointer is free(3)'ed, and subsequently used in the wtmp() function in last.c. With MALLOC_OPTIONS set to AJ, the contents of the memory pointed to by the free pointer are no longer valid, causing a core dump. >How-To-Repeat: Run 'last' on the attached wtmp. >Fix: Diff attached: *** /usr/src/usr.bin/last/last.c.orig Tue Oct 29 02:57:23 1996 --- /usr/src/usr.bin/last/last.c Tue Oct 29 02:59:10 1996 *************** *** 191,199 **** */ if (bp->ut_line[0] == '~' && !bp->ut_line[1]) { /* everybody just logged out */ ! for (tt = ttylist.lh_first; tt; tt = tt->list.le_next) { LIST_REMOVE(tt, list); free(tt); } currentout = -bp->ut_time; crmsg = strncmp(bp->ut_name, "shutdown", --- 191,202 ---- */ if (bp->ut_line[0] == '~' && !bp->ut_line[1]) { /* everybody just logged out */ ! tt = ttylist.lh_first; ! while (tt) { ! struct ttytab * tn = tt->list.le_next; LIST_REMOVE(tt, list); free(tt); + tt = tn; } currentout = -bp->ut_time; crmsg = strncmp(bp->ut_name, "shutdown", Encoded wtmp which demonstrates the problem. begin 644 wtmp.gz M'XL(`,'1=#(``XV=>U1591J'R0NB96EC7E`;M=%)2Q00D$30(R(B*)*:<A4\ M$$<)#@IJ6AJC>$WQDH"7RD0S=$C%U*S)IIN*MU1(K6598V7EJ`F890H=8<O> M&=]^WF^U9O7';Y[W]]Z^O<_I9!D9ST[U<')RFIR6EN%4S_EA?[C'+.WOIR1G M9EC3IJ7>K;GFT&1H'-7Y7=.X"S2]07/'S^3$A'I=MSRD<U1YM3G$L5P-&FO\ M5)OU+YD[.74\I.>ETH0?XMQ+CS"G,C"BKLXJ3=>@".Q%[K`(S/UF9@3V/<9G M'.8UP:&A?MW4.&9U=NX[#NO32M.8S;.OIO$TT20$U&KZF&@^'\"Y7[2,PQI6 M6,9A+ZY;=#^J\ZM%SXLT9K/QJX7[E1G(_=H[6*^/JH8?#N;<OQ[,L;[5-+XF M&O^@6DU?$\V,(>QG>RCW?4>H[D=U]H;J?E3G0.@XO,>.AO*,G0KEO,Z&<M^' MA[&?V##>TQUA['GQ"/:\9`3W8MD(SLLGG/-:'<Y^CH_D62T=R7-X9B37L%>$ MOLLJS<W1^IV@T@3'<`W'3^#<'T[F^^?19*[/C53./?]9OL/?S>*^=]O*?CRV M,B>AB.<GHXAK>*:(_7Q9Q'ZV;V<_']=J[,98Z9FV%*.XDT&C.JNW<UY7MG-> M#^ZHU<2;>.ZT@^^-A)TZ1W4F[&3/R3MY#O<7\^XLW<V<HMU<GZ<.\KM-S$'. M:]I!CC73$$MUO$LX5M\2KD^_$IY5BR!62`G/QK`2WIU3Q]G/V>/LI^T)KG/' M$SP;EYI%XCW_=O-(O.=/=(S$W)N.BZSS;$N=9*LOKR\,&M69;8W$&KYLC<1^ ME5DYUN=6KH]E:!36YXF1ND9U.D<P)VMT%.Y.]S<YEH>F,:MA@$-#-0PV<%0G MS,!1S<;[MZ)PG@]J&K-YWEX5A?UJ>C@:[XVU/T5CG4,N16/N(PT:E9_1`DZ< M0T.]B#=H5'4N<8GA=P"#1G62FS(GI2ESE@LX+PDX>0+.6DUC-C_[#!K5>5_3 MF,W8?H-&=0YH&K-]/V+0J,Y105ZSF^M^5/O>L#7[J6C+]7G;C7-_QXWS>L^- M^_Z10:/*ZZ!#0[MS0A#KE(&CVJ_`7NQG>"_F'.S-G*.]]5ZH-*W=.58O;]Z= MJ4\P)\*?/=O\F7,]D#E.@SGWV4'<]T[!/,]=@WDV[FC,[@3?<-ZO5J.X/A^. MY?H<&<NYCXGDO*(BF?-X-'L^'<.>_Q?#?GK%LI]E5I[G=HDQ==]YJC29-LYK MS3.<U_YG>%:?3.<Y[#"'Z]-Y#N?>8P[[B1;$VC*/<[<LY1KZYC(G.)<][\CC MV<A:RW6>MY9SOZVAO-JMX[RZKF//;ZQC/T7KV(_'1O8S8"/[&5'(?D85LI\& M6]A/LRWLQU;$?M**V$]I&?LY5\9^9IQG/R^<9S\_.<>BG^N:QFPONMP?ZY&4 M8>_KZ>E5=R=X]/9T<_=Q\W+\;\TKV`8O7:,Z6=ZQF'L+OUC,O8U?+.Y@&S_. M_?_]8K&&!P2<8WZ<EU=_SNN)_NQGCS_[.>//L4H"V+-1H_*S<"#[63F09\S; MPIH^@]CS^D">C4V!7)_;&LH]*8AS3PUBSTN"V,^*H-K]\G+O7=\.UOQ?OS-H M5*=*BV7V.>Z],%VC.AU2.7>O-.[I/].Y7[X&C>J=)$#`N:,Q_3PX7=<H/YM/ M9\Z%F<RY,9/S&O,\YS5J%G.27]![JOR^Y7(L?KYXJ#*V[KU7U=._5^D:U=E5 MQ9S_"#@7G>*0<U73F-7PQ89Q./,K-8W9=P[Y#>-PYE]MR'X^,6A4O2@1<(X) M_)0).)<%G`H!)Z`1<P(;,6=.(Z[/?`'G\<;,Z=TX#G=GH*8Q_;SS4!S>">5M MXG`'[?WC<"\RGN*]F.[0T+.IYUC.:^!8WHO;&GJ>/A"MQU)Y=HWF?BUV:!S/ M0<\^OD[U/2M];FM^G*!K5.>:IO'U5G,LR;I&=88E\_RTM_.L+K9SOU;8^1[+ MLW-/\^S<K\;I/,\MTKE?4R9S?79.Y;WH]AQ[#I_#GL=IFG@33>-LSNO"/*ZS M;0'[&;.(ZS/BI1K-GWXOD9EJ2\],U#7?Y.L:U7%>S77>]LI?8QGVHF:C[BOD M6*T+>5;G%_+=LJB0=V=)(?<BIY#OGY6%O(,E@EC'"O49,]/0/'<IYOGI6<RS M&E;,,W:XN+Z^>[BYW_[+Q\W[]B?_X+>X[V%O\8R%[N$:OEK-N=NRQ^.,;;XU M'G/?='\\?M\;XZIK5"<J,A[G.4'3F,WSTYK&K#XO:1JSW)='Q6,-<Z,X5J6` M<UW`&1W-G)CH>)SGJ]9X[.G@B5SG_T[B6!>G<)WCYK(?ZURNSZ6E7)^K2SFO M:I<$S,O_O@3<T[TM$W">0QY)P/H,?R0!/8_6-&;/Y?A'.*_?=ND<U?FBG/V< M+>=8WP@X3A7,:5C!',]KS/&YQIQD`6>2@/.L@),EX!P0<`YK&K/=^<6@47XG M(_!SMHK]G*M*P'U?Y#2A;G<RTM(FUQ?+O]$$W*\P36/FV:_)!/0\H`ESQ@HX M,0+."0&G3,#Y7L#Y2<!IZ<*<AUR88Q-P4@2<(@%GAX#3XU[FN-W+'(N`,TS3 MF-WSU2TXUH?M.-8G[9@SRE77J-[GQ[HR9Z$K^WE1P"D0<#8+.+\(.#<$')?V MS/E;>[VGRM\>M.>^1W=@3F4GP?QH&B\33N/.ND9UFG;68ZER#]$T9L\4_\=T MC8I38-?O<.5O4R?S/3\^D^NS<R[W?4LV]_W-;.;L%W`."3AG!9QS`D[`/.8, MFL><KO.9TWT^<R;-Y_O'+N"L$/A9)>!T6,!^NBQ@3J"`$[*`=V>40X._21;X M23)P5-^3G%_`>_J#P'.;A<QQ7<@<#P''2\!)$7#L`LXKBYCSVB*>PZA5W*_* M7,'S*Y<Y50+./7G,R<UCSAH!YV4!IT#`J1!PK@LXG^8SYV0^<VX)./>L%KS7 MK6/.`4UC]AD_?!\_N\]\P,_<@H_YF=O]4^;XG>']:GZ68ZWYDF.M_Y(Y10+. M=@'G!P'GHH!S6<"Y*N!4"SC.7S%GY%?,&27@-#C/[V--SO->^)SGN[=?K<9N MG/F[__E.P;>Z1G5^_HYG=6=C:]T.JLXU36/VSTJJ'!IZOK=TMJ*?5LY6_AV: M,_O9((C5I(D5>]%<TYC>8]UJ-';CC-W][R\O[:EK5"?3C3FSW)BSVITY&]R9 M<UK`N2G@C/=@CLV#.6L%G`(!YY:`T\B3.;,\F;-`P/FW@'-0P+GNQ9P'O9ES MRH=WYZUMO#OO;M-W1W7V;>-[XY[=@EW>S??&]-WL^><]O.\W]EKQG23LM!6? M.V&W=([J)%=SK)1JKL^%[HE8YTJ'AOS<T#1F\W-'8];W&P8_JGY=ZI&(]WQE MCT3LUYC'$K&&1QY+Q'[MZ<FY;W-+Q%Z$61)Q#I,LW*\""\?:9.%>O&'AOK]A MX7Z-'\1Y/3V(/0\)8LZP(.;$"#CC@WA^!@1S#;."F9,MX"P7</)K-7_Z;<84 M:^)4H^8C@T9UGAK*?L8.93\QFL;L<]S#(;I&=8:$,&>8@+-+P'E;P"D1<(Z& M<`W+0KB&IP6<CX;QG3`\E/,:%<J[<UM#^_YC*._7E5"N874HUV=WF'Y'J9X% MQZ/Y'DN?QL^"J=/T>UX5Z]'I'"L@BV,-RN)G2N!)?C:%G&1.?!ES)CLT21EV M7]_>'O7]WJ_FCXA;U3^I3J,ZNQT:\C-[9!+6,$O3F/X^7-.8S7.VIC';BT4& MCJKO.8)8JQT:VM,U!HUJOYI4/8U^BAHDHY]B@T:Y7YK&;`<GWI>,N_S.IF2< M^46O)^,<7OF&\QK1TX9Y/6G0J,[/0YES3=.8S4^_$!O6QS^$_23,L.%>O#"# M_>1H&K/=V:AIS/9TZPRNS\X9G-<Q`>>DP;-JYM>WFXAY%6L:,S\N]HFX7P\X M-+3+;>T<R]7`4>U[KH&CJL\KFL9LQC;9)^(N.YV9B'M:_17G5>XU"7OQBZ8Q MF^??-(U9[L[>DS"OJ/Q)N!=?9Z2@YV\UC>EG:H-&-3^7'!K\,ZL%L7XW<)3_ M3LV_V$^/N1RK178*]J)U=@KV8L>\%)S5[S2-V1PVR$G!^0G,84Z(@%.:P_7Y M.H?K<T'`J<KA?C58QGD=6<9Y71=P?A=P6B_GO-HNY_IT6,Y^7%:PGW,KF%.9 MSYR^&_A.N+"19_ZW3]C/_/!4K&'LNE2L8>(ZYM@TC=F[UDR#1G5F"?SD"?RL M%7`V"SA;#!K5[GPJX!P7^%FVGCFYZYDS[37F//<:YY6X@3DY&YBS4L"Y*.!< M$7`>+.#ZM"U@3F<!YQ\"3K>-S.FQD3F[!)R]`D[?3<SQV\2<E0).GJ8QN^OZ MOYZ*=^;0UW6.*M;B8IVCTO3=EXKO;!<^TS4JSN7/.*]'3W->[J<YK\#3'"M? MP&GU.=?GWN^Y[_V\TM"/GZ8QJW.@0T/OJV$:QZR&$0:.ZGVU4N.8W2VW#!K5 MJ39H5#5LZ,T<OP#F!`2D84^;#>!>7!S$G,^&I-5\S^;MHVON_BZN?(FN49VJ M)6DX8Q<VL^?6I5S#=J4\&QU+N<Y=2VOR\NGCZUWWYS_KN7O46%B8;:_3*&,M MK-5X^?HJ.4=7Z!K5Z;+*SN]L/NEX1R5I&K/<M^Y/Q]EP.9R./6U6EHX]G5R> MCOW*+$_'W)\O3\>[9;:!H]KW.0X-_O<X!'Z6&3BJ^\>S@GOA5\$]/=ET"O;K .@Q,9'G\`3-'?,.!J``"! ` end >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199610281607.DAA10189>