intermittent crash with makewhatisdb -a

intermittent crash with makewhatisdb -a

[Anthony J. Bentley]

Certain filenames will cause intermittent crashing with makewhatisdb -a.
For example, on a fresh amd64 OpenBSD -current install, I can do this:

# touch /usr/share/man/1234567890.1234
$ makewhatis -an
Segmentation fault

backtrace:

Program received signal SIGSEGV, Segmentation fault.
strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:124
124             movq    (%rax),%rdx             /* get bytes to check */
Current language:  auto; currently asm
(gdb) bt
#0  strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:124
#1  0x00000028b921cf1d in *_libc_strdup (
    str=0x27e803ae7b '' <repeats 200 times>...)
    at /usr/src/lib/libc/string/strdup.c:44
#2  0x00000025e0818c79 in mandoc_strdup (ptr=Variable "ptr" is not available.
) at mandoc_aux.c:100
#3  0x00000025e0844a8f in mlink_add (mlink=0x286734e000, st=0x28a5526890)
    at mandocdb.c:910
#4  0x00000025e0845611 in treescan () at mandocdb.c:685
#5  0x00000025e0848caa in mandocdb (argc=0, argv=0x7f7ffffd6c78)
    at mandocdb.c:515
#6  0x00000025e082c844 in main (argc=2, argv=0x7f7ffffd6c68) at main.c:142

-- 
Anthony J. Bentley
--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv

Re: intermittent crash with makewhatisdb -a

[Ingo Schwarze]

Hi Anthony,

Anthony J. Bentley wrote on Fri, Oct 09, 2015 at 10:36:57PM -0600:

> Certain filenames will cause intermittent crashing with makewhatisdb -a.
> For example, on a fresh amd64 OpenBSD -current install, I can do this:
> 
> # touch /usr/share/man/1234567890.1234
> $ makewhatis -an
> Segmentation fault
> 
> backtrace:
> 
> Program received signal SIGSEGV, Segmentation fault.
> strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:124
> 124             movq    (%rax),%rdx             /* get bytes to check */
> Current language:  auto; currently asm
> (gdb) bt
> #0  strlen () at /usr/src/lib/libc/arch/amd64/string/strlen.S:124
> #1  0x00000028b921cf1d in *_libc_strdup (
>     str=0x27e803ae7b '' <repeats 200 times>...)
>     at /usr/src/lib/libc/string/strdup.c:44
> #2  0x00000025e0818c79 in mandoc_strdup (ptr=Variable "ptr" is not available.
> ) at mandoc_aux.c:100
> #3  0x00000025e0844a8f in mlink_add (mlink=0x286734e000, st=0x28a5526890)
>     at mandocdb.c:910
> #4  0x00000025e0845611 in treescan () at mandocdb.c:685
> #5  0x00000025e0848caa in mandocdb (argc=0, argv=0x7f7ffffd6c78)
>     at mandocdb.c:515
> #6  0x00000025e082c844 in main (argc=2, argv=0x7f7ffffd6c68) at main.c:142

Fixed with the following patch; thanks for reporting!
  Ingo


Log message:
Clear dform and dsec when exiting a first-level directory in treescan().
Fixes a segfault reported by bentley@.
While here, do some style cleanup in the same function.

Index: mandocdb.c
===================================================================
RCS file: /cvs/src/usr.bin/mandoc/mandocdb.c,v
retrieving revision 1.152
diff -u -p -r1.152 mandocdb.c
--- mandocdb.c	12 Oct 2015 00:07:27 -0000	1.152
+++ mandocdb.c	12 Oct 2015 00:29:45 -0000
@@ -699,13 +699,16 @@ treescan(void)
 			 * If we're not in use_all, enforce it.
 			 */
 			cp = ff->fts_name;
-			if (FTS_DP == ff->fts_info)
+			if (ff->fts_info == FTS_DP) {
+				dform = FORM_NONE;
+				dsec = NULL;
 				break;
+			}
 
 			if (0 == strncmp(cp, "man", 3)) {
 				dform = FORM_SRC;
 				dsec = cp + 3;
 			} else if (0 == strncmp(cp, "cat", 3)) {
 				dform = FORM_CAT;
 				dsec = cp + 3;
 			} else {
--
 To unsubscribe send an email to tech+unsubscribe@mdocml.bsd.lv