Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEGV introduced between 20230804->20230808 #71

Closed
sthen opened this issue Oct 31, 2023 · 6 comments
Closed

SEGV introduced between 20230804->20230808 #71

sthen opened this issue Oct 31, 2023 · 6 comments

Comments

@sthen
Copy link

sthen commented Oct 31, 2023

Seen on OpenBSD -current amd64.

Seems there's a problem with the input buffer resizing done in ThomasDickey/mawk-snapshots@139ba08.

The initial report was from somebody using an ugly domain blocklist processor; here's a simpler reproducer:

$ yes | dd count=262144 bs=1 status=none > a
$ mawk '{ print $1 }' a
Segmentation fault (core dumped)
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000006640d67210e in fillbuff (fd=3, target=0x6662dd36000 <error: Cannot access memory at address 0x6662dd36000>, size=0) at fin.c:413
413         *target = 0;
(gdb) bt
#0  0x000006640d67210e in fillbuff (fd=3, target=0x6662dd36000 <error: Cannot access memory at address 0x6662dd36000>, size=0) at fin.c:413
#1  0x000006640d6714e2 in FINgets (fin=0x666a8410258, len_p=0x772ef7dedfb8) at fin.c:246
#2  0x000006640d6584e2 in execute (cdp=0x666a840ac78, sp=0x6640d67b248 <execute.missing+8>, fp=0x0) at execute.c:1188                                                                                     #3  0x000006640d65411d in main (argc=4, argv=0x772ef7dee108)
at main.c:71
@sthen
Copy link
Author

sthen commented Oct 31, 2023

(Seems triggered by any file above 256k)

@ThomasDickey
Copy link
Owner

thanks - with valgrind I can see a problem which may be the same issue.

@ThomasDickey
Copy link
Owner

simple fix (which works for the test cases I have at hand):

--- fin.c	2023/08/08 21:57:08	1.51
+++ fin.c	2023/10/31 21:10:12
@@ -410,7 +410,6 @@
 	}
 
   out:
-    *target = 0;
     return (size_t) (entry_size - size);
 }

@sthen
Copy link
Author

sthen commented Nov 2, 2023

Thanks - this works for the other cases I've tried too.

@ThomasDickey
Copy link
Owner

I applied that on top of some other fixes, and will probably upload a new snapshot today or tomorrow.

@ThomasDickey
Copy link
Owner

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants