Bug 93841

Summary: [patch] fix seg fault with dmesg(8)
Product: Base System Reporter: Stephen Montgomery-Smith <stephen>
Component: binAssignee: dwmalone
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 6.1-PRERELEASE   
Hardware: Any   
OS: Any   
Attachments:
Description Flags
file.diff none

Description Stephen Montgomery-Smith 2006-02-25 22:40:06 UTC 
My video card issues some really weird messages to the message buffer, e.g.

<
2>>

When the message buffer has such problems, dmesg will seg fault.

How-To-Repeat: 
I'm not sure how anyone else could mimic this problem.
Comment 1 Stephen Montgomery-Smith 2006-02-25 22:57:56 UTC 
Actually my suggested fix isn't going to work in every situation.  How 
about:

--- dmesg.c-orig	Sat Feb 25 16:26:18 2006
+++ dmesg.c	Sat Feb 25 16:52:11 2006
@@ -184,7 +184,8 @@
  			    errno == 0) {
  				if (LOG_FAC(pri) != LOG_KERN && !all)
  					continue;
-				p = q + 1;
+				if (q < nextp)
+					p = q + 1;
  			}
  		}



(This patch is unlikely to apply cleanly because my mail client has 
probably messed it up.)
Comment 2 Stephen Montgomery-Smith 2006-02-26 17:59:32 UTC 
And this is a slightly cleaner way to fix the problem.

--- dmesg.c-orig	Sat Feb 25 16:26:18 2006
+++ dmesg.c	Sat Feb 25 17:06:55 2006
@@ -180,8 +180,8 @@
  		if (*p == '<') {
  			errno = 0;
  			pri = strtol(p + 1, &q, 10);
-			if (*q == '>' && pri >= 0 && pri < INT_MAX &&
-			    errno == 0) {
+			if (q < nextp && *q == '>' && pri >= 0 &&
+			    pri < INT_MAX && errno == 0) {
  				if (LOG_FAC(pri) != LOG_KERN && !all)
  					continue;
  				p = q + 1;

Another possibility is to change the first if statement above to 
something like

if (p* == '<' && !isspace(*(p+1))) {

but that might or might not have an undesired effect, because I don't 
know if you mean to delete stuff like
< 2>
Comment 3 dwmalone 2006-02-27 14:38:01 UTC 
Hi Stephen,

I would favour a fix of:

	if (p* == '<' && isdigit(*(p+1))) {

Does this look OK to you?

	David.
Comment 4 Stephen Montgomery-Smith 2006-02-27 15:36:35 UTC 
David Malone wrote:
> Hi Stephen,
> 
> I would favour a fix of:
> 
> 	if (p* == '<' && isdigit(*(p+1))) {
> 
> Does this look OK to you?
> 
> 	David.

It looks great to me.

-- 

Stephen Montgomery-Smith
stephen@math.missouri.edu
http://www.math.missouri.edu/~stephen
Comment 5 dwmalone freebsd_committer freebsd_triage 2006-02-27 19:13:58 UTC 
Responsible Changed
From-To: freebsd-bugs->dwmalone

I've committed something to -current which should fix the problem. I'll 
MFC in a couple of weeks if there are no objections.
Comment 6 dwmalone freebsd_committer freebsd_triage 2006-08-21 13:44:50 UTC 
State Changed
From-To: open->closed

Now fixed in -current, RELENG_6 and RELENG_5. Thanks for the 
patch, 

David.