Bug 236937 - libxo =xml Segmentation fault with a huge string (>30000)
Summary: libxo =xml Segmentation fault with a huge string (>30000)
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Only Me
Assignee: freebsd-bugs (Nobody)
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2019-04-01 14:59 UTC by Alfonso S. Siciliano
Modified: 2019-04-03 22:02 UTC (History)
3 users (show)

See Also:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Alfonso S. Siciliano freebsd_committer freebsd_triage 2019-04-01 14:59:39 UTC
I am adding libxo support to a 'sysctl(8)' clone, libxo=xml fails with a huge string (example "sysctl debug.witness.fullgraph"). The problem is reproducible and described by the file:

https://gitlab.com/alfix/nsysctl/blob/master/problem-xo-huge-string.c

(uname -a FreeBSD fbsd 13.0-CURRENT FreeBSD 13.0-CURRENT r345315 GENERIC  amd64)

Regards,
Alfonso
Comment 1 Phil Shafer freebsd_committer freebsd_triage 2019-04-02 02:04:25 UTC
I don't have this OID (debug.witness.fullgraph) but have munged your test problem to read a file an entire file and spew it as a single tag.  But I've not found the issue you are seeing.  I've tried sizes <1mb and it works fine.  I've guessing it might be related to the specific content.  Could you please send your "sysctl debug.witness.fullgraph" output (uuencoded, just to be safe) to phil@?

Thanks,
 Phil

P.s: My test driver is at:

   https://gist.github.com/philshafer/95fc4ab814091529fc0a132a49130d90
Comment 2 Alfonso S. Siciliano freebsd_committer freebsd_triage 2019-04-02 04:44:38 UTC
Thank you for your comment,

% sysctl -n debug.witness.fullgraph > oid-only-value.txt

The output is:
https://gitlab.com/alfix/nsysctl/blob/master/oid-only-value.txt
Raw:
https://gitlab.com/alfix/nsysctl/raw/master/oid-only-value.txt
(I' ll send an email, too)

The output of the drive:

% cc huge-string.c -o huge-string -lxo

% ./huge-string --libxo=text,pretty oid-only-value.txt 
3476034760

% ./huge-string --libxo=xml,pretty oid-only-value.txt
<valuelen>34760</valuelen>
Segmentation fault (core dumped)

Regards,
Alfonso
Comment 3 Phil Shafer freebsd_committer freebsd_triage 2019-04-02 05:17:54 UTC
I've reproduced this on freefall, though it does not SEGV on my boxes.  But it gives me someplace to start.  Tomorrow.

Thanks,
 Phil
Comment 4 Alfonso S. Siciliano freebsd_committer freebsd_triage 2019-04-02 06:56:16 UTC
Fixed (bug #236935, comment #5), Thank you

Alfonso
Comment 5 Alfonso S. Siciliano freebsd_committer freebsd_triage 2019-04-02 07:05:36 UTC
Closed before committing, 
Reopened, 

Sorry
Comment 6 commit-hook freebsd_committer freebsd_triage 2019-04-03 21:56:07 UTC
A commit references this bug:

Author: phil
Date: Wed Apr  3 21:55:41 UTC 2019
New revision: 345859
URL: https://svnweb.freebsd.org/changeset/base/345859

Log:
  Import libxo-1.0.2

  from 1.0.0:
      Add "continuation" flag, to allow multiple "xo" invocations in a single line of output (#58)
      Add --top-wrap to make top-level JSON wrappers
      Add --{open,close}-{list,instace} options
      Add xo_xml_leader(), to detect use of some bogus XML tags. It's still bad form, but it's a little safer now
      Avoid call to xo_write before xo_flush, since the latter calls the former
      Check return code from xo_flush_h properly (<0) (FreeBSD Bug 236935)
      For JSON output, avoid newline before a container's close brace (#62)
      Merge branch 'text_only' of https://github.com/zvr/libxo into zvr-text_only
      Use XO_USE_INT_RETURN_CODES, not USE_INT_RETURN_CODES
      add docs for --continuation
      add docs for --not-first
      call xo_state_set_flags before values and close containers; add XOIF_MADE_OUTPUT flag to track state; make proper empty JSON objects in xo_finish
      color_map code has to be #ifdef'd out, since the struct definition
      correct xo_flush_func_t (doesn't use xo_ssize_t)
      make depth change for --top-wrap only for JSON
      fix to handle --top-wrap in "xo" by being more consistent with handling trailing newlines
      fix to handle text-only version #64 (from zvr)
      fix xo_buf_has_room for round up to the next XO_BUFSIZ, not just add XO_BUFSIZ to the size (FreeBSD Bug 236937)
      update docs for new "xo" options
      update functions to use xo_ssize_t
      update test cases
  from 1.0.1:
      Add EINTEGRITY to .pot files under test/gettext/ (fix from FreeBSD)
  from 1.0.2:
      handle failure from xo_vnsprintf; don't add -1 to "rc"

  PR:		236937, 236935
  Submitted by:	phil
  Reported by:	Alfonso S. Siciliano <alfix86@gmail.com>
  MFC after:	2 weeks

Changes:
_U  head/contrib/libxo/
  head/contrib/libxo/configure.ac
  head/contrib/libxo/doc/api.rst
  head/contrib/libxo/doc/libxo-manual.html
  head/contrib/libxo/doc/xo.rst
  head/contrib/libxo/libxo/Makefile.am
  head/contrib/libxo/libxo/libxo.c
  head/contrib/libxo/libxo/xo.h
  head/contrib/libxo/libxo/xo_attr.3
  head/contrib/libxo/libxo/xo_buf.h
  head/contrib/libxo/libxo/xo_emit.3
  head/contrib/libxo/libxo/xo_emit_f.3
  head/contrib/libxo/libxo/xo_explicit.h
  head/contrib/libxo/libxo/xo_finish.3
  head/contrib/libxo/libxo/xo_flush.3
  head/contrib/libxo/libxo/xo_open_container.3
  head/contrib/libxo/libxo/xo_open_list.3
  head/contrib/libxo/libxo/xo_open_marker.3
  head/contrib/libxo/libxo/xo_set_writer.3
  head/contrib/libxo/tests/core/saved/test_01.J.out
  head/contrib/libxo/tests/core/saved/test_02.J.out
  head/contrib/libxo/tests/core/saved/test_03.J.out
  head/contrib/libxo/tests/core/saved/test_04.J.out
  head/contrib/libxo/tests/core/saved/test_05.J.out
  head/contrib/libxo/tests/core/saved/test_05.JP.out
  head/contrib/libxo/tests/core/saved/test_06.J.out
  head/contrib/libxo/tests/core/saved/test_07.J.out
  head/contrib/libxo/tests/core/saved/test_08.J.out
  head/contrib/libxo/tests/core/saved/test_09.J.out
  head/contrib/libxo/tests/core/saved/test_10.J.out
  head/contrib/libxo/tests/core/saved/test_11.J.out
  head/contrib/libxo/tests/core/saved/test_12.E.err
  head/contrib/libxo/tests/core/saved/test_12.E.out
  head/contrib/libxo/tests/core/saved/test_12.H.err
  head/contrib/libxo/tests/core/saved/test_12.H.out
  head/contrib/libxo/tests/core/saved/test_12.HIPx.err
  head/contrib/libxo/tests/core/saved/test_12.HIPx.out
  head/contrib/libxo/tests/core/saved/test_12.HP.err
  head/contrib/libxo/tests/core/saved/test_12.HP.out
  head/contrib/libxo/tests/core/saved/test_12.J.err
  head/contrib/libxo/tests/core/saved/test_12.J.out
  head/contrib/libxo/tests/core/saved/test_12.JP.err
  head/contrib/libxo/tests/core/saved/test_12.JP.out
  head/contrib/libxo/tests/core/saved/test_12.T.err
  head/contrib/libxo/tests/core/saved/test_12.T.out
  head/contrib/libxo/tests/core/saved/test_12.X.err
  head/contrib/libxo/tests/core/saved/test_12.X.out
  head/contrib/libxo/tests/core/saved/test_12.XP.err
  head/contrib/libxo/tests/core/saved/test_12.XP.out
  head/contrib/libxo/tests/core/test_12.c
  head/contrib/libxo/tests/gettext/po/pig_latin/strerror.po
  head/contrib/libxo/tests/gettext/saved/gt_01.J.out
  head/contrib/libxo/tests/xo/Makefile.am
  head/contrib/libxo/tests/xo/saved/xo_01.H.out
  head/contrib/libxo/tests/xo/saved/xo_01.HIPx.out
  head/contrib/libxo/tests/xo/saved/xo_01.HP.out
  head/contrib/libxo/tests/xo/saved/xo_01.J.out
  head/contrib/libxo/tests/xo/saved/xo_01.JP.out
  head/contrib/libxo/tests/xo/saved/xo_01.T.out
  head/contrib/libxo/tests/xo/saved/xo_02.H.err
  head/contrib/libxo/tests/xo/saved/xo_02.H.out
  head/contrib/libxo/tests/xo/saved/xo_02.HIPx.err
  head/contrib/libxo/tests/xo/saved/xo_02.HIPx.out
  head/contrib/libxo/tests/xo/saved/xo_02.HP.err
  head/contrib/libxo/tests/xo/saved/xo_02.HP.out
  head/contrib/libxo/tests/xo/saved/xo_02.J.err
  head/contrib/libxo/tests/xo/saved/xo_02.J.out
  head/contrib/libxo/tests/xo/saved/xo_02.JP.err
  head/contrib/libxo/tests/xo/saved/xo_02.JP.out
  head/contrib/libxo/tests/xo/saved/xo_02.T.err
  head/contrib/libxo/tests/xo/saved/xo_02.T.out
  head/contrib/libxo/tests/xo/saved/xo_02.X.err
  head/contrib/libxo/tests/xo/saved/xo_02.X.out
  head/contrib/libxo/tests/xo/saved/xo_02.XP.err
  head/contrib/libxo/tests/xo/saved/xo_02.XP.out
  head/contrib/libxo/tests/xo/xo_01.sh
  head/contrib/libxo/tests/xo/xo_02.sh
  head/contrib/libxo/xo/xo.1
  head/contrib/libxo/xo/xo.c
  head/lib/libxo/xo_config.h
  head/usr.bin/xohtml/xohtml.sh
Comment 7 Phil Shafer freebsd_committer freebsd_triage 2019-04-03 22:02:19 UTC
Fix is in libxo-1.0.0 and FreeBSD GRN 345859.

Thanks,
 Phil