Bug 181783

Summary: [PATCH] nslookup(1) segfaults after reading "^D"
Product: Base System Reporter: Fabian Keil <fk>
Component: binAssignee: Xin LI <delphij>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: Unspecified   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.txt none

Description Fabian Keil 2013-09-03 18:30:00 UTC
The attached patch prevents nslookup from segfaulting after reading a single "^D" when running in interactive mode and built with readline support.

Fix: Patch attached with submission follows:
How-To-Repeat: fk@r500 ~ $gdb76 --args nslookup
GNU gdb (GDB) 7.6 [GDB v7.6 for FreeBSD]
[...]
Reading symbols from /usr/bin/nslookup...done.
(gdb) r
Starting program: /usr/bin/nslookup 
[New LWP 101002]
> ^D[New Thread 802006800 (LWP 101058)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 802006800 (LWP 101058)]
strlen (str=0x0) at /usr/src/lib/libc/string/strlen.c:100
100		va = (*lp - mask01);
(gdb) where
#0  strlen (str=0x0) at /usr/src/lib/libc/string/strlen.c:100
#1  0x000000080149ef82 in strdup (str=0x0) at /usr/src/lib/libc/string/strdup.c:46
#2  0x00000008009eb529 in history_def_insert (ev=<optimized out>, str=0x0, h=<optimized out>) at /usr/src/lib/libedit/history.c:465
#3  history_def_enter (p=0x8024e7040, ev=0x7fffffbfdee0, str=0x0) at /usr/src/lib/libedit/history.c:497
#4  0x00000008009ebd71 in history (h=0x8024e5080, ev=0x7fffffbfdee0, fun=<optimized out>) at /usr/src/lib/libedit/history.c:953
#5  0x00000008009d7b18 in add_history (line=<optimized out>, line=<optimized out>) at /usr/src/lib/libedit/readline.c:1371
#6  0x000000000040efb5 in get_next_command () at /usr/src/usr.bin/nslookup/../../contrib/bind9/bin/dig/nslookup.c:770
#7  getinput (task=<optimized out>, event=<optimized out>) at /usr/src/usr.bin/nslookup/../../contrib/bind9/bin/dig/nslookup.c:869
#8  0x000000000054acaf in dispatch (manager=<optimized out>) at /usr/src/lib/bind/isc/../../../contrib/bind9/lib/isc/task.c:1116
#9  run (uap=0x802033000) at /usr/src/lib/bind/isc/../../../contrib/bind9/lib/isc/task.c:1286
#10 0x0000000800fee534 in thread_start (curthread=0x802006800) at /usr/src/lib/libthr/thread/thr_create.c:284
#11 0x0000000000000000 in ?? ()
Comment 1 Xin LI freebsd_committer freebsd_triage 2013-11-02 06:47:04 UTC
State Changed
From-To: open->closed

This was fixed differently as r255891 (HEAD) and 255934 (releng/9, 
releng/8). 


Comment 2 Xin LI freebsd_committer freebsd_triage 2013-11-02 06:47:04 UTC
Responsible Changed
From-To: freebsd-bugs->delphij

Take just in case.