Bug 87260 - devel/str uses the same va_list ap twice causing segfault
Summary: devel/str uses the same va_list ap twice causing segfault
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: Normal Affects Only Me
Assignee: Marcus Alves Grando
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2005-10-11 17:10 UTC by Vasil Dimov
Modified: 2005-10-11 18:02 UTC (History)
1 user (show)

See Also:


Attachments
str-ap.diff (1.13 KB, patch)
2005-10-11 17:10 UTC, Vasil Dimov
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Vasil Dimov 2005-10-11 17:10:15 UTC
I discovered the following bug in devel/str port on my brand new
architecture (amd64):

* String Parsing test in `make check' fails

* Example code from str(3) "Substitute Text in a String"
  the one with str_parse(var, "s/^(.+?):(.+)$/$1-%s-$2/", &new, subst);
  causes signal 11 to be delivered

Here is the backtrace of the above str_parse() call:

Program received signal SIGSEGV, Segmentation fault.
0x000000080063fe84 in str_len (
    s=0xffffffff804617d0 <Error reading address 0xffffffff804617d0: Bad address>) at str_basic.c:43
43	    while (*t++ != NUL)
#0  0x000000080063fe84 in str_len (
    s=0xffffffff804617d0 <Error reading address 0xffffffff804617d0: Bad address>) at str_basic.c:43
#1  0x00000008006447a2 in str_vformat (vbuff=0x7fffffffe6f0, 
    fmt=0x7fffffffe7d7 "s-%{2}R", ap=0x7fffffffe920) at str_format.c:886
#2  0x0000000800642b25 in str_parse_va (string=0x400a0c "foo:bar", 
    pattern=0x400a19 "s/^(.+?):(.+)$/$1-%s-$2/", ap=0x7fffffffe920)
    at str_parse.c:588
#3  0x0000000800641cb7 in str_parse (string=0x400a0c "foo:bar", 
    pattern=0x400a19 "s/^(.+?):(.+)$/$1-%s-$2/") at str_parse.c:268
#4  0x0000000000400942 in main (argc=1, argv=0x7fffffffeaa0) at tmp.c:29

the problem is that `ap' is used twice:
on str_parse.c:567 and str_parse.c:588, the first usage "exhausts" it
and makes it unusable (the actual exhaustion with va_arg is done in
str_vformat() in str_format.c).

The bug reveals itself only on amd64, it waits in ambush on i386.

How-To-Repeat: 
# uname -m
amd64

/usr/ports/devel/str# make check
Comment 1 Marcus Alves Grando freebsd_committer freebsd_triage 2005-10-11 17:35:48 UTC
Responsible Changed
From-To: freebsd-ports-bugs->mnag

I'll take it.
Comment 2 Marcus Alves Grando freebsd_committer freebsd_triage 2005-10-11 18:02:50 UTC
State Changed
From-To: open->closed

Committed. Thanks!