From owner-freebsd-ports-bugs@FreeBSD.ORG Wed Nov 9 11:50:14 2005 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5BDA916A41F for ; Wed, 9 Nov 2005 11:50:14 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id C640A43D49 for ; Wed, 9 Nov 2005 11:50:13 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.3/8.13.3) with ESMTP id jA9BoDS6027688 for ; Wed, 9 Nov 2005 11:50:13 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.3/8.13.1/Submit) id jA9BoD6P027687; Wed, 9 Nov 2005 11:50:13 GMT (envelope-from gnats) Resent-Date: Wed, 9 Nov 2005 11:50:13 GMT Resent-Message-Id: <200511091150.jA9BoD6P027687@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, vd@datamax.bg Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9C9AA16A41F; Wed, 9 Nov 2005 11:48:25 +0000 (GMT) (envelope-from vd@datamax.bg) Received: from jengal.datamax.bg (jengal.datamax.bg [82.103.104.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 1E44E43D45; Wed, 9 Nov 2005 11:48:24 +0000 (GMT) (envelope-from vd@datamax.bg) Received: from qlovarnika.bg.datamax (qlovarnika.bg.datamax [192.168.10.2]) by jengal.datamax.bg (Postfix) with SMTP id 4A801B830; Wed, 9 Nov 2005 13:48:23 +0200 (EET) Received: (nullmailer pid 41555 invoked by uid 1002); Wed, 09 Nov 2005 11:48:23 -0000 Message-Id: <20051109114823.GA2512@qlovarnika.bg.datamax> Date: Wed, 9 Nov 2005 13:48:23 +0200 From: Vasil Dimov To: FreeBSD-gnats-submit@FreeBSD.org X-Send-Pr-Version: 3.113 Cc: bug-libextractor@gnu.org, kevlo@FreeBSD.org Subject: ports/88716: [patch] fix textproc/libextractor double free() bug X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: vd@datamax.bg List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 09 Nov 2005 11:50:14 -0000 >Number: 88716 >Category: ports >Synopsis: [patch] textproc/libextractor fix double free() bug >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Nov 09 11:50:13 GMT 2005 >Closed-Date: >Last-Modified: >Originator: Vasil Dimov >Release: FreeBSD 6.0-STABLE amd64 >Organization: DataMax >Environment: System: FreeBSD qlovarnika.bg.datamax 6.0-STABLE FreeBSD 6.0-STABLE #0: Tue Nov 8 09:24:59 EET 2005 root@qlovarnika.bg.datamax:/usr/obj/usr/src/sys/QLOVARNIKA amd64 >Description: Problem: `make check' for textproc/libextractor fails: ... make check-TESTS lt-trivialtest in free(): error: chunk is already free Abort trap (core dumped) FAIL: trivialtest PASS: keywordlisttest lt-plugintest in free(): error: chunk is already free Abort trap (core dumped) FAIL: plugintest lt-multiload in free(): error: chunk is already free Abort trap (core dumped) FAIL: multiload ========================================= 3 of 4 tests failed Please report to bug-libextractor@gnu.org ========================================= ... (NOTE: options AJ are set via malloc.conf(3)) Lets look closer to one of the failing progs: $ cd libextractor-0.5.6a/src/test $ ./.libs/lt-trivialtest lt-trivialtest in free(): error: chunk is already free Abort trap: 6 (core dumped) $ gdb is useless here, because it segfaults itself, so I used printfs to locate the problem. the following is self-explanatory trace of the program, created by inserting printfs in the appropriate places: (the prog is being run via electricfence to make it crash as soon as possible) $ ./.libs/lt-trivialtest extractor.c:216 le_ltdl_init begin extractor.c:253 le_ltdl_init end trivialtest.c:24 main begin extractor.c:216 le_ltdl_init begin extractor.c:235 le_ltdl_init old_dlsearchpath=0x801122fcc extractor.c:237 le_ltdl_init old_dlsearchpath=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:253 le_ltdl_init end extractor.c:258 le_ltdl_fini begin ltdl.c:4058 lt_dlsetsearchpath search_path=0x801122fcc ltdl.c:4060 lt_dlsetsearchpath search_path=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:274 le_ltdl_fini end trivialtest.c:28 main between extractor.c:216 le_ltdl_init begin extractor.c:235 le_ltdl_init old_dlsearchpath=0x802cd3fcc extractor.c:237 le_ltdl_init old_dlsearchpath=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:253 le_ltdl_init end extractor.c:258 le_ltdl_fini begin ltdl.c:4058 lt_dlsetsearchpath search_path=0x802cd3fcc ltdl.c:4060 lt_dlsetsearchpath search_path=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:274 le_ltdl_fini end trivialtest.c:31 main end extractor.c:258 le_ltdl_fini begin ltdl.c:4058 lt_dlsetsearchpath search_path=0x802cd3fcc Bus error: 10 (core dumped) $ You see, the destructor le_ltdl_fini() is being called "unexpectedly" when the program exits, but search_path=0x802cd3fcc has already been free()d by the previous invocation. Fix: it seems quite trivial, we just need to old_dlsearchpath = NULL after free()ing it - lt_dlsetsearchpath() is checking if called with NULL pointer and we are calling free() only if old_dlsearchpath is non-NULL. With the included patch, output of trivialtest looks like: $ ./.libs/lt-trivialtest extractor.c:216 le_ltdl_init begin extractor.c:253 le_ltdl_init end trivialtest.c:24 main begin extractor.c:216 le_ltdl_init begin extractor.c:235 le_ltdl_init old_dlsearchpath=0x801122fcc extractor.c:237 le_ltdl_init old_dlsearchpath=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:253 le_ltdl_init end extractor.c:258 le_ltdl_fini begin ltdl.c:4058 lt_dlsetsearchpath search_path=0x801122fcc ltdl.c:4060 lt_dlsetsearchpath search_path=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:274 le_ltdl_fini end trivialtest.c:28 main between extractor.c:216 le_ltdl_init begin extractor.c:235 le_ltdl_init old_dlsearchpath=0x802cd3fcc extractor.c:237 le_ltdl_init old_dlsearchpath=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:253 le_ltdl_init end extractor.c:258 le_ltdl_fini begin ltdl.c:4058 lt_dlsetsearchpath search_path=0x802cd3fcc ltdl.c:4060 lt_dlsetsearchpath search_path=/usr/lib/libextractor:/usr/local/lib/libextractor extractor.c:274 le_ltdl_fini end trivialtest.c:31 main end extractor.c:258 le_ltdl_fini begin ltdl.c:4058 lt_dlsetsearchpath search_path=0x0 ltdl.c:4060 lt_dlsetsearchpath search_path=(null) extractor.c:274 le_ltdl_fini end $ And of-course... $ make check ... ================== All 4 tests passed ================== $ >How-To-Repeat: export MALLOC_OPTIONS=AJ cd /usr/ports/textproc/libextractor make check >Fix: --- libextractor_free.diff begins here --- diff -urN --exclude=CVS libextractor.orig/Makefile libextractor/Makefile --- libextractor.orig/Makefile Sun Nov 6 02:20:45 2005 +++ libextractor/Makefile Wed Nov 9 12:55:44 2005 @@ -7,7 +7,7 @@ PORTNAME= libextractor PORTVERSION= 0.5.6a -PORTREVISION= 1 +PORTREVISION= 2 CATEGORIES= textproc MASTER_SITES= http://gnunet.org/libextractor/download/ \ ${MASTER_SITE_GNU} diff -urN --exclude=CVS libextractor.orig/files/patch-src::main::extractor.c libextractor/files/patch-src::main::extractor.c --- libextractor.orig/files/patch-src::main::extractor.c Thu Jan 1 02:00:00 1970 +++ libextractor/files/patch-src::main::extractor.c Wed Nov 9 12:02:48 2005 @@ -0,0 +1,14 @@ +--- src/main/extractor.c.orig Wed Nov 9 11:57:54 2005 ++++ src/main/extractor.c Wed Nov 9 11:58:31 2005 +@@ -246,8 +246,10 @@ + + void __attribute__ ((destructor)) le_ltdl_fini(void) { + lt_dlsetsearchpath(old_dlsearchpath); +- if (old_dlsearchpath != NULL) ++ if (old_dlsearchpath != NULL) { + free(old_dlsearchpath); ++ old_dlsearchpath = NULL; ++ } + #ifdef MINGW + ShutdownWinEnv(); + #endif --- libextractor_free.diff ends here --- >Release-Note: >Audit-Trail: >Unformatted: