From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <9front-bounces@9front.inri.net>
X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on inbox.vuxu.org
X-Spam-Level: 
X-Spam-Status: No, score=-0.6 required=5.0 tests=DKIM_INVALID,DKIM_SIGNED,
	HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,T_SCC_BODY_TEXT_LINE
	autolearn=ham autolearn_force=no version=3.4.4
Received: from 9front.inri.net (9front.inri.net [168.235.81.73])
	by inbox.vuxu.org (Postfix) with ESMTP id D57D222DAF
	for <ml@inbox.vuxu.org>; Tue, 23 Jan 2024 18:42:51 +0100 (CET)
Received: from wopr.sciops.net ([216.126.196.60]) by 9front; Tue Jan 23 12:40:46 -0500 2024
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sciops.net; s=20210706;
	t=1706031621;
	h=from:from:reply-to:subject:subject:date:date:message-id:message-id:
	 to:to:cc:mime-version:mime-version:content-type:content-type:
	 content-transfer-encoding:content-transfer-encoding:  in-reply-to:in-reply-to;
	bh=yrIFoan077QwRIgkeNlmSHl5ORkdQBW/6GRVi/8BOtI=;
	b=FEY3R3exrK04CShe1LcGYy1UxVmeBVtYpvUHUEHxnBdweOcgSSW6v8XH1qkrKpCBczHcX0
	RJeoh8LAQdPwCgWvmXCC5YI64eIw66hycNlGGSpzgl35aT9GrCCIXvf6Y5wjKZveOq2nep
	UX49SL6A5bEk/OFhOGGRsgeDyAOFsUc=
Received: 
	by wopr.sciops.net (OpenSMTPD) with ESMTPSA id ab4ba739 (TLSv1.2:ECDHE-RSA-CHACHA20-POLY1305:256:NO)
	for <9front@9front.org>;
	Tue, 23 Jan 2024 09:40:20 -0800 (PST)
Message-ID: <1BB2A50064EC90776DDB56DBF7AF1DF8@wopr.sciops.net>
Date: Tue, 23 Jan 2024 18:40:37 +0100
From: qwx@sciops.net
To: 9front@9front.org
In-Reply-To: <b0233255-2f1f-4797-9f41-52ecedb7d4ef@posixcafe.org>
MIME-Version: 1.0
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
List-ID: <9front.9front.org>
List-Help: <http://lists.9front.org>
X-Glyph: ➈
X-Bullshit: patented compliant base singleton YAML reduce/map browser injection hosting 
Subject: Re: [9front] [PATCH] awk: don't write an extra NUL past the end of a block
Reply-To: 9front@9front.org
Precedence: bulk

On Tue Jan 23 17:53:35 +0100 2024, moody@posixcafe.org wrote:
> Can you provide an example input that would generate this crash?

Here's one:

; dd < /dev/zero -bs 4 -count 8k | tr '\x0' A | awk '{a=$1}'
8192+0 records in
8192+0 records out
mem user overflow
pool sbrkmem block 439db0
hdr 0a110c09 00008038 0020577c 00000000 41414141 41414141
tail 00000000 00000000 00000000 00000000 00000000 00000000 | ef2f00be 00008038
user data 41 41 41 41  41 41 41 00 | 00 f0 fa fe  00 00 00 00
panic: pool panic
sys: trap: fault read addr=0x0 pc=0x215070
awk 3897: suicide: sys: trap: fault read addr=0x0 pc=0x215070

; lstk
/proc/3897/text:amd64 plan 9 executable
acid: abort()+0x0 /sys/src/libc/9sys/abort.c:6
ppanic(fmt=0x40719b)+0x14b /sys/src/libc/port/malloc.c:166
	pv=0x417a18
	msg=0x420d90
	v=0x7fffffffea80
	n=0xffffea800000000a
panicblock(msg=0x4072ac,p=0x400c18,b=0x439db0)+0x52 /sys/src/libc/port/pool.c:718
blockcheck(b=0x439db0,p=0x400c18)+0x3f6 /sys/src/libc/port/pool.c:796
	t=0x441de0
	n=0x8038
	i=0x441de000000000
	q=0x441dc1
	a=0x439db0
	dsize=0x441dc500008009
	bq=0x441dc1
	eq=0x441dc5
arenamerge(p=0x400c18,bot=0x421a60,top=0x441df8)+0xf9 /sys/src/libc/port/pool.c:665
	newsize=0x215e7d000283f8
	btop=0x441e18
	bbot=0x439db0
poolnewarena(asize=0x8060,p=0x400c18)+0x1ec /sys/src/libc/port/pool.c:605
	a=0x441df8
	b=0x441e18
poolallocl(dsize=0x8009,p=0x400c18)+0x77 /sys/src/libc/port/pool.c:948
	bsize=0x21771e00008020
	ab=0x42f9f8
poolalloc(p=0x400c18,n=0x3ff0000000008009)+0x3c /sys/src/libc/port/pool.c:1190
	v=0x439dc0
malloc(size=0x8001)+0x20 /sys/src/libc/port/malloc.c:207
	v=0x208e3d
tostring(s=0x439dc0)+0x1d /sys/src/cmd/awk/tran.c:398
	p=0xa008
setsval(s=0x439dc0,vp=0x42f668)+0xee /sys/src/cmd/awk/tran.c:341
	fldno=0x417a1800000000
	t=0xe05c00417a18
assign(a=0x42f940,n=0xe038)+0xf5 /sys/src/cmd/awk/run.c:1141
	y=0x4263d0
	x=0x42f668
	yf=0x7fffffffee6b
	xf=0x8000
	v=0x8000
execute()+0xc4 /sys/src/cmd/awk/run.c:157
	a=0x42f928
	x=0x42f360
	nobj=0x20a78a0000e038
pastat(a=0x417fa0)+0x17 /sys/src/cmd/awk/run.c:1223
execute()+0xc4 /sys/src/cmd/awk/run.c:157
	a=0x42f968
	x=0xa000ffffee38
	nobj=0x2073300000e004
program(a=0x42f9c0)+0x14b /sys/src/cmd/awk/run.c:192
	x=0x2
execute()+0xc4 /sys/src/cmd/awk/run.c:157
	a=0x42f9a8
	x=0x40066e
	nobj=0x2070590000e003
run(a=0x42f9a8)+0x18 /sys/src/cmd/awk/run.c:131
main(argc=0x1,argv=0x7fffffffef98)+0x240 /sys/src/cmd/awk/main.c:169
	fs=0x0
	marg=0x0
_main+0x40 /sys/src/libc/amd64/main9.s:15


Doesn't happen with the patch.

Cheers,
qwx