From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/4415 Path: news.gmane.org!not-for-mail From: David Wuertele Newsgroups: gmane.linux.lib.musl.general Subject: NULL deref SEGV in malloc.c:unbin() Date: Fri, 27 Dec 2013 18:35:00 +0000 (UTC) Message-ID: Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1388169333 14604 80.91.229.3 (27 Dec 2013 18:35:33 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Fri, 27 Dec 2013 18:35:33 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-4419-gllmg-musl=m.gmane.org@lists.openwall.com Fri Dec 27 19:35:40 2013 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1VwcG3-0002nZ-N1 for gllmg-musl@plane.gmane.org; Fri, 27 Dec 2013 19:35:39 +0100 Original-Received: (qmail 20312 invoked by uid 550); 27 Dec 2013 18:35:38 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 20304 invoked from network); 27 Dec 2013 18:35:38 -0000 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 34 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: sea.gmane.org User-Agent: Loom/3.14 (http://gmane.org/) X-Loom-IP: 205.234.27.227 (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36) Xref: news.gmane.org gmane.linux.lib.musl.general:4415 Archived-At: I wonder if anyone has hit this before? In unbin(), c->next->prev is set, but c->next is NULL. It happens repeatedly, and here's what gdb says: (gdb) b fopen Breakpoint 9 at 0x90f78: file src/stdio/fopen.c, line 13. (gdb) c Continuing. Breakpoint 9, fopen (filename=0xaabe4 "/etc/hosts", mode=0xaabf0 "r") at src/stdio/fopen.c:13 13 src/stdio/fopen.c: No such file or directory. in src/stdio/fopen.c (gdb) b unbin Breakpoint 10 at 0x8bc44: file src/malloc/malloc.c, line 239. (gdb) c Continuing. Breakpoint 10, unbin (c=0x21408b8, i=40) at src/malloc/malloc.c:239 239 src/malloc/malloc.c: No such file or directory. in src/malloc/malloc.c (gdb) print *c $6 = {psize = 2096, csize = 2097, next = 0x2140088, prev = 0x0} (gdb) s 241 in src/malloc/malloc.c (gdb) Program received signal SIGSEGV, Segmentation fault. 0x0008bcc0 in unbin (c=0x21408b8, i=40) at src/malloc/malloc.c:241 241 in src/malloc/malloc.c (gdb) The root cause was not obvious on scanning the source. Is this perhaps something that's already been fixed? Dave