Bug 93841 - [patch] fix seg fault with dmesg(8)
Summary: [patch] fix seg fault with dmesg(8)
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 6.1-PRERELEASE
Hardware: Any Any
: Normal Affects Only Me
Assignee: dwmalone
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2006-02-25 22:40 UTC by Stephen Montgomery-Smith
Modified: 2006-08-21 13:45 UTC (History)
0 users

See Also:


Attachments
file.diff (310 bytes, patch)
2006-02-25 22:40 UTC, Stephen Montgomery-Smith
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Stephen Montgomery-Smith 2006-02-25 22:40:06 UTC
My video card issues some really weird messages to the message buffer, e.g.

<
2>>

When the message buffer has such problems, dmesg will seg fault.

How-To-Repeat: 
I'm not sure how anyone else could mimic this problem.
Comment 1 Stephen Montgomery-Smith 2006-02-25 22:57:56 UTC
Actually my suggested fix isn't going to work in every situation.  How 
about:

--- dmesg.c-orig	Sat Feb 25 16:26:18 2006
+++ dmesg.c	Sat Feb 25 16:52:11 2006
@@ -184,7 +184,8 @@
  			    errno == 0) {
  				if (LOG_FAC(pri) != LOG_KERN && !all)
  					continue;
-				p = q + 1;
+				if (q < nextp)
+					p = q + 1;
  			}
  		}



(This patch is unlikely to apply cleanly because my mail client has 
probably messed it up.)
Comment 2 Stephen Montgomery-Smith 2006-02-26 17:59:32 UTC
And this is a slightly cleaner way to fix the problem.

--- dmesg.c-orig	Sat Feb 25 16:26:18 2006
+++ dmesg.c	Sat Feb 25 17:06:55 2006
@@ -180,8 +180,8 @@
  		if (*p == '<') {
  			errno = 0;
  			pri = strtol(p + 1, &q, 10);
-			if (*q == '>' && pri >= 0 && pri < INT_MAX &&
-			    errno == 0) {
+			if (q < nextp && *q == '>' && pri >= 0 &&
+			    pri < INT_MAX && errno == 0) {
  				if (LOG_FAC(pri) != LOG_KERN && !all)
  					continue;
  				p = q + 1;

Another possibility is to change the first if statement above to 
something like

if (p* == '<' && !isspace(*(p+1))) {

but that might or might not have an undesired effect, because I don't 
know if you mean to delete stuff like
< 2>
Comment 3 dwmalone 2006-02-27 14:38:01 UTC
Hi Stephen,

I would favour a fix of:

	if (p* == '<' && isdigit(*(p+1))) {

Does this look OK to you?

	David.
Comment 4 Stephen Montgomery-Smith 2006-02-27 15:36:35 UTC
David Malone wrote:
> Hi Stephen,
> 
> I would favour a fix of:
> 
> 	if (p* == '<' && isdigit(*(p+1))) {
> 
> Does this look OK to you?
> 
> 	David.

It looks great to me.

-- 

Stephen Montgomery-Smith
stephen@math.missouri.edu
http://www.math.missouri.edu/~stephen
Comment 5 dwmalone freebsd_committer freebsd_triage 2006-02-27 19:13:58 UTC
Responsible Changed
From-To: freebsd-bugs->dwmalone

I've committed something to -current which should fix the problem. I'll 
MFC in a couple of weeks if there are no objections.
Comment 6 dwmalone freebsd_committer freebsd_triage 2006-08-21 13:44:50 UTC
State Changed
From-To: open->closed

Now fixed in -current, RELENG_6 and RELENG_5. Thanks for the 
patch, 

David.