Date: Wed, 28 Jan 2004 14:30:24 -0800 (PST) From: Jan-Espen Pettersen <sigsegv@leakingmemory.org> To: freebsd-bugs@FreeBSD.org Subject: Re: bin/61690: fsdb seqfaults in cmd. parsing routine Message-ID: <200401282230.i0SMUOI5046903@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
The following reply was made to PR bin/61690; it has been noted by GNATS.
From: Jan-Espen Pettersen <sigsegv@leakingmemory.org>
To: freebsd-gnats-submit@FreeBSD.org, hsn@netmag.cz
Cc: sigsegv@leakingmemory.org
Subject: Re: bin/61690: fsdb seqfaults in cmd. parsing routine
Date: Wed, 28 Jan 2004 23:26:36 +0100
Debug info from gdb:
(gdb) run /dev/ad0s1a
Starting program: /usr/obj/usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdb
/dev/ad0s1a
** /dev/ad0s1a (NO WRITE)
Editing file system `/dev/ad0s1a'
Last Mounted on /
current inode: directory
I=2 MODE=40755 SIZE=512
MTIME=Jan 25 14:26:13 2004 [0 nsec]
CTIME=Jan 25 14:26:13 2004 [0 nsec]
ATIME=Jan 28 03:01:06 2004 [0 nsec]
OWNER=root GRP=wheel LINKCNT=24 FLAGS=0 BLKCNT=4 GEN=7aca51f8
fsdb (inum: 2)> help test
Breakpoint 1, recrack (line=0x80c6060 "help test\n", argc=0xbfbfeb0c,
argc_max=1)
at /usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdbutil.c:82
82 for (p = line, i = 0; p != NULL && i < 8 && i < argc_max -
1; i++) {
(gdb) bt
#0 recrack (line=0x80c6060 "help test\n", argc=0xbfbfeb0c, argc_max=1)
at /usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdbutil.c:82
#1 0x08049a33 in cmdloop () at
/usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdb.c:260
#2 0x08049664 in main (argc=1, argv=0xbfbfeb74) at
/usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdb.c:107
#3 0x08049452 in _start ()
(gdb) next
90 argv[i] = argv[i - 1] + strlen(argv[i - 1]) + 1;
(gdb)
Program received signal SIGSEGV, Segmentation fault.
0x281032f9 in strlen () from /lib/libc.so.5
(gdb) bt full
#0 0x281032f9 in strlen () from /lib/libc.so.5
No symbol table info available.
#1 0xbfbfeb70 in ?? ()
No symbol table info available.
#2 0x08049a33 in cmdloop () at
/usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdb.c:260
line = 0x80c6060 "help test\n"
elline = 0x80cb800 "help test\n"
cmd_argc = 2
rval = 0
known = 0
cmd_argv = (char **) 0x80618a0
cmdp = (struct cmdtable *) 0x80602a0
hist = (History *) 0x80b0140
elptr = (EditLine *) 0x80c5000
he = {num = 1, str = 0x80c6050 "help test\n"}
#3 0x08049664 in main (argc=1, argv=0xbfbfeb74) at
/usr/src/FreeBSD-CURRENT/sbin/fsdb/fsdb.c:107
ch = -1
rval = 2
fsys = 0xbfbfec98 "/dev/ad0s1a"
#4 0x08049452 in _start ()
No symbol table info available.
Patch:
http://www.leakingmemory.org/patches/fsdb/fsdb_segf.diff
The crash is caused by an underflow where i = 0, and an attempt to read
at argv[i - 1].
Regards,
Jan-Espen Pettersen
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200401282230.i0SMUOI5046903>