Bug 310071
| Summary: | Widec set_field_buffer fails with 'double free or corruption' error | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Victor Julien <victor> |
| Component: | ncurses | Assignee: | Miroslav Lichvar <mlichvar> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | low | ||
| Version: | 7 | CC: | dickey |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | i686 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | 5.6-9.20070812.fc7 | Doc Type: | Bug Fix |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2007-11-05 15:06:45 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Attachments: | |||
|
Description
Victor Julien
2007-09-27 22:15:14 UTC
Created attachment 209101 [details]
Source to reproduce error.
Created attachment 209111 [details]
valgrind log
This chunk seems to be relevant (but the previous time that line
changed was in 2004/05/30, which was before ncurses 5.5):
20070317
+ corrected length of temporary buffer in wide-character version
of set_field_buffer() (related to report by Bryan Christ).
--- frm_driver.c 2007/02/04 00:28:38 1.78
+++ frm_driver.c 2007/03/12 21:49:00 1.79
@@ -32,7 +32,7 @@
#include "form.priv.h"
-MODULE_ID("$Id: frm_driver.c,v 1.77 2007/02/03 23:37:46 tom Exp $")
+MODULE_ID("$Id: frm_driver.c,v 1.78 2007/02/04 00:28:38 tom Exp $")
/*----------------------------------------------------------------------------
This is the core module of the form library. It contains the majority
@@ -4274,7 +4274,7 @@
wclear(field->working);
mvwaddstr(field->working, 0, 0, value);
- if ((widevalue = (FIELD_CELL *)calloc(len, sizeof(FIELD_CELL))) == 0)
+ if ((widevalue = (FIELD_CELL *)calloc(len + 1, sizeof(FIELD_CELL))) == 0)
{
RETURN(E_SYSTEM_ERROR);
}
I can confirm that the fix from Thomas E. Dickey solves the problem. I've updated the package to upstream patch 20070812 which includes the patch. ncurses-5.6-7.20070812.fc7 should land in updates testing repository soon. ncurses-5.6-7.20070812.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update ncurses' Thanks for your efforts so far! The set_field_buffer issue seems to be solved with ncurses-5.6-7.20070812.fc7, but I did see another and possibly related issue with field_buffer. I'll try to investigate and create example code tomorrow. Here is valgrind output: ==2781== Invalid write of size 1 ==2781== at 0x403F799: winnstr (in /usr/lib/libncursesw.so.5.6) ==2781== by 0x401C093: field_buffer (in /usr/lib/libformw.so.5.6) ==2781== by 0x80649F4: rulebar_setcolor (in /usr/bin/vuurmuur_conf) ==2781== by 0x806EBD9: rules_form (in /usr/bin/vuurmuur_conf) ==2781== by 0x809F391: main_menu (in /usr/bin/vuurmuur_conf) ==2781== by 0x804E71B: main (in /usr/bin/vuurmuur_conf) ==2781== Address 0x47DA595 is 0 bytes after a block of size 5 alloc'd ==2781== at 0x40054E5: malloc (vg_replace_malloc.c:149) ==2781== by 0x401BFF1: field_buffer (in /usr/lib/libformw.so.5.6) ==2781== by 0x80649F4: rulebar_setcolor (in /usr/bin/vuurmuur_conf) ==2781== by 0x806EBD9: rules_form (in /usr/bin/vuurmuur_conf) ==2781== by 0x809F391: main_menu (in /usr/bin/vuurmuur_conf) ==2781== by 0x804E71B: main (in /usr/bin/vuurmuur_conf) Where can I pick up a src.rpm to be able to enable debug symbols? Here are all rpms for the package: http://koji.fedoraproject.org/koji/buildinfo?buildID=20177 Created attachment 221091 [details]
Code to demonstrate field_buffer issue
Created attachment 221101 [details]
Valgrind output for field_buffer issue
This patch seems to fix it. Thomas, is it correct?
--- ncurses-5.6/form/frm_driver.c.fieldbuf
+++ ncurses-5.6/form/frm_driver.c
@@ -4476,7 +4476,7 @@ field_buffer(const FIELD *field, int buf
{
wclear(field->working);
mvwadd_wchnstr(field->working, 0, 0, data, size);
- mvwinnstr(field->working, 0, 0, result, (int)need + 1);
+ mvwinnstr(field->working, 0, 0, result, (int)need);
}
#else
result = Address_Of_Nth_Buffer(field, buffer);
That seems to be correct - the extra count is the trailing null which is always added to the buffer. Thanks. I'll prepare an updated package. ncurses-5.6-8.20070812.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update ncurses' This update fixes the field_buffer issue as well. I can now run my application in valgrind without a single error. Thanks a lot for your efforts Miroslav and Thomas! I ran into a new and I suspect again related issue. When using fields, extra buffers can be used (nbuffers). When using one extra buffer things work fine, but with two I'm getting errors again. I will attach two sources to show the problem. This problem occurs on Ubuntu's ncurses 5.5 as well btw. Valgrind output: ==3893== 1 errors in context 1 of 4: ==3893== Invalid read of size 4 ==3893== at 0x4044FFD: field_buffer (frm_driver.c:4475) ==3893== by 0x8049004: main (main2.c:114) ==3893== Address 0x413F268 is 0 bytes after a block of size 8 alloc'd ==3893== at 0x4004824: calloc (vg_replace_malloc.c:279) ==3893== by 0x4042D49: new_field (fld_def.c:308) ==3893== by 0x8048DCF: main (main2.c:50) ==3893== ==3893== 1 errors in context 2 of 4: ==3893== Invalid write of size 4 ==3893== at 0x4044FF5: field_buffer (frm_driver.c:4472) ==3893== by 0x8049004: main (main2.c:114) ==3893== Address 0x413F268 is 0 bytes after a block of size 8 alloc'd ==3893== at 0x4004824: calloc (vg_replace_malloc.c:279) ==3893== by 0x4042D49: new_field (fld_def.c:308) ==3893== by 0x8048DCF: main (main2.c:50) ==3893== ==3893== 1 errors in context 3 of 4: ==3893== Invalid read of size 4 ==3893== at 0x4044FD5: field_buffer (frm_driver.c:4470) ==3893== by 0x8049004: main (main2.c:114) ==3893== Address 0x413F268 is 0 bytes after a block of size 8 alloc'd ==3893== at 0x4004824: calloc (vg_replace_malloc.c:279) ==3893== by 0x4042D49: new_field (fld_def.c:308) ==3893== by 0x8048DCF: main (main2.c:50) ==3893== ==3893== 2 errors in context 4 of 4: ==3893== Invalid read of size 4 ==3893== at 0x40429B0: free_field (fld_def.c:389) ==3893== by 0x804904D: main (main2.c:122) ==3893== Address 0x413F268 is 0 bytes after a block of size 8 alloc'd ==3893== at 0x4004824: calloc (vg_replace_malloc.c:279) ==3893== by 0x4042D49: new_field (fld_def.c:308) ==3893== by 0x8048DCF: main (main2.c:50) Created attachment 225361 [details]
this one uses one buffer and works
Created attachment 225371 [details]
this one uses two buffers and fails (in valgrind)
Created attachment 225441 [details]
Patch to allocate nbuf + 1 working buffers in new_field()
Looks like another oneliner. I guess I'll wait with updating for few days to
see if more show up ;-).
I suppose so (these are 2-3 year old changes). Sadly that means that even when they are fixed upstream and in Fedora the functionality is really not usable since distro's like Debian seem to refuse to fix this type of bug (not security related) in their stable releases... :( Thomas is the suggested fix correct? If so I'll try bugging Debian and Ubuntu with it as well... hopefully they will prove me wrong :) Thanks a lot! Miroslav, your fix seems to work. I'm still developing the code using it, so you may want to wait a little longer to see if more pops up... Thanks again! It looks okay - seems that was untouched since early 2005 (implemented in mid-2004). ncurses-5.6-9.20070812.fc7 has been pushed to the Fedora 7 testing repository. If problems still persist, please make note of it in this bug report. If you want to test the update, you can install it with su -c 'yum --enablerepo=updates-testing update ncurses' I tested it and it works fine. Thanks a lot! ncurses-5.6-9.20070812.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report. |