Bug 205796 - [patch] math/xgraph - fix two Segmentation fault problems
Summary: [patch] math/xgraph - fix two Segmentation fault problems
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: amd64 Any
: --- Affects Some People
Assignee: freebsd-ports-bugs (Nobody)
Keywords: patch
Depends on:
Reported: 2016-01-02 10:55 UTC by uratan
Modified: 2019-07-31 19:59 UTC (History)
2 users (show)

See Also:

patchs, xgraph.c for problem-[1], xtb.h for problem-[2] (1.05 KB, patch)
2016-01-02 10:55 UTC, uratan
no flags Details | Diff
patch file for this issue (2.34 KB, patch)
2016-02-18 06:39 UTC, MIHIRA Sanpei Yoshiro
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description uratan 2016-01-02 10:55:20 UTC
Created attachment 164950 [details]
patchs, xgraph.c for problem-[1], xtb.h for problem-[2]

[1] uninitialized pointer access in main()

  Simply execute xgraph, it may make Segmentation fault.

  When calling init_X() from main(), an uninitilized pointer 'win_info'
  is referenced.  This may cause Segmentation fault according to its
  stack condition.

  Function init_X() will not use its parameter now, so simply remove the
  reference, see patch for xgraph.c.

[2] variable argument problem about xtb_vert(), xtb_hort(), when amd64

  When openning Hardcopy dialog, on amd64 environment, Segmentation fault
  will occur.

  Function xtb_vert() / xtb_hort() accept pointers by variable argument,
  and use mere 0 (defined as 'NE') for its end-of-list value.

  On amd64 environment,
  mere 0 is passed as a 4-byte-param (because it is an int value),
  but above functions take the params out as a pointer (8-byte at amd64),
  so end-of-list value is packed with some more 4-byte garbage and lost,
  it will make later Segmentation fault.

  To make the end-of-list value to 8-byte one, add a cast to the macro 'NE',
  see patch for xtb.h.
  This change will not have a bad influence for i386 or other environment,
  I wish...

 - * - * -

testing environment:
  |% uname -srm
  |FreeBSD 10.2-RELEASE amd64
  |% head /usr/ports/math/xgraph/Makefile
  |# Created by: asami
  |# $FreeBSD: tags/RELEASE_10_2_0/math/xgraph/Makefile 376508 2015-01-08 01:23:17Z
  | sanpei $
  |PORTNAME=       xgraph
  |CATEGORIES=     math print
  |MASTER_SITES=   ftp://ftp.cs.utoronto.ca/pub/radford/
  |DISTNAME=       xgraph-11
Comment 1 MIHIRA Sanpei Yoshiro freebsd_committer 2016-02-18 06:07:48 UTC
I reproduced this issue. Uratan's suggested point was changed with previous commit(rev.376508).
Now I handle this issue.
Comment 2 MIHIRA Sanpei Yoshiro freebsd_committer 2016-02-18 06:39:21 UTC
Created attachment 167138 [details]
patch file for this issue

I created new patch for ports/math/xgraph/files/patch-xgraph.c.
please replace this one and could you check this patch uratan-san.

If this patch solve this issue, please let me know and I will commit this.
Comment 3 uratan 2016-02-19 14:06:43 UTC

As for my first comment, my patch is against for Revision 376508 (of Makefile), I think, is it really corrected ?

MOCHIRON --- Of course,
OTETSUDAI --- aid you,
SIMASU, GA --- I will, but...
Comment 4 MIHIRA Sanpei Yoshiro freebsd_committer 2016-02-27 07:29:09 UTC
I tested with old-current enviroment. So now I installed 10.2-RELEASE/amd64 and my patch has still issue. But if I test your patch(against for Revision 376508), I also have issue(segmentation fault). 

Do you have any suggestion?
Comment 5 uratan 2016-03-06 12:13:04 UTC
I've setup plain 10.2R machine for evaluation, too.
And confirmed the circumstances.

Now we have 3 patch files:
 (0) patch-xgraph.c --- included in ports.txz of 10.2R,
                        placed in math/xgraph/files/.
 (1) patchs --- posted by me, has fixes for problem-[1] and [2].
 (2) patch-xgraph.c.sanpei-20141230 --- posted by sanpei-san.

Here, my (1) is incremental one after (0), and your (2) includes (0) maybe to replace it.
And (1) and (2) have a conflict about changes in main().
 (The cause of problem-[1] had come by (0), the change is not included in (2))

 (a) xgraph-11.tar.Z --> (0) --> core dumped (this is 10.2R default condition)
      |(gdb) backtrace
      |#0  0x0000000000403350 in main ()
 (b) xgraph-11.tar.Z --> (0) --> (1) ... works good at my environment

 (c) xgraph-11.tar.Z --> (2) --> ... core dumped when [Hardcopy] button pressed
      |(gdb) backtrace
      |#0  0x000000000040fdba in xtb_fmt_setpos ()
 (d) xgraph-11.tar.Z --> (2) --> (1:xtb.h only) ... works good at my environment

Would you please split my (1), discard about xgraph.c,
take only the fix for xtb.h ?
Comment 6 Rene Ladan freebsd_committer 2017-01-22 21:33:55 UTC
Maintainer reset.
Comment 7 commit-hook freebsd_committer 2019-07-31 19:58:59 UTC
A commit references this bug:

Author: arrowd
Date: Wed Jul 31 19:58:34 UTC 2019
New revision: 507732
URL: https://svnweb.freebsd.org/changeset/ports/507732

  math/xgraph: Apply patches to fix crashes.

  PR:		205796

Comment 8 Gleb Popov freebsd_committer 2019-07-31 19:59:16 UTC
I have pulled in all patches found in this PR.