Bug 517369

Summary: wish aborts on start-up
Product: [Fedora] Fedora Reporter: Tim Waugh <twaugh>
Component: tclAssignee: Nikola Pajkovsky <npajkovs>
Status: CLOSED RAWHIDE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: low    
Version: rawhideCC: dhoward, npajkovs, wart
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2009-08-13 18:16:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Tim Waugh 2009-08-13 16:15:13 UTC 
Description of problem:
When I run 'wish' from the command line I get a stack trace from glibc.

Version-Release number of selected component (if applicable):
tk-8.5.7-1.fc12.x86_64

How reproducible:
100%

Steps to Reproduce:
1.wish
  
Actual results:
*** buffer overflow detected ***: wish terminated
======= Backtrace: =========
/lib64/libc.so.6(__fortify_fail+0x37)[0x7f2b1a03ff17]
/lib64/libc.so.6[0x7f2b1a03de80]
/usr/lib64/libtcl8.5.so[0x7f2b1b44c8a9]
/usr/lib64/libtcl8.5.so[0x7f2b1b44bfe5]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so[0x7f2b1b3fa22a]
/usr/lib64/libtcl8.5.so[0x7f2b1b402289]
/usr/lib64/libtcl8.5.so(TclEvalObjEx+0x196)[0x7f2b1b3b2c56]
/usr/lib64/libtcl8.5.so[0x7f2b1b3c4bb8]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b20af]
/usr/lib64/libtcl8.5.so(Tcl_FSEvalFileEx+0x241)[0x7f2b1b41e7f1]
/usr/lib64/libtcl8.5.so[0x7f2b1b3c92f5]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so(Tcl_EvalObjv+0x43)[0x7f2b1b3b29f3]
/usr/lib64/libtcl8.5.so(TclEvalObjEx+0x2f2)[0x7f2b1b3b2db2]
/usr/lib64/libtcl8.5.so[0x7f2b1b43c7df]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so[0x7f2b1b3fa22a]
/usr/lib64/libtcl8.5.so(TclObjInterpProcCore+0x378)[0x7f2b1b43beb8]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so(Tcl_EvalObjv+0x43)[0x7f2b1b3b29f3]
/usr/lib64/libtcl8.5.so(TclEvalObjEx+0x2f2)[0x7f2b1b3b2db2]
/usr/lib64/libtcl8.5.so[0x7f2b1b43c7df]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so[0x7f2b1b3fa22a]
/usr/lib64/libtcl8.5.so(TclObjInterpProcCore+0x378)[0x7f2b1b43beb8]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b1927]
/usr/lib64/libtcl8.5.so[0x7f2b1b3fa22a]
/usr/lib64/libtcl8.5.so(TclObjInterpProcCore+0x378)[0x7f2b1b43beb8]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b17d7]
/usr/lib64/libtcl8.5.so[0x7f2b1b3b20af]
/usr/lib64/libtcl8.5.so(Tcl_Eval+0x1d)[0x7f2b1b3b27ed]
/usr/lib64/libtk8.5.so[0x7f2b1b7016de]
wish(Tcl_AppInit+0x16)[0x4009a6]
/usr/lib64/libtk8.5.so(Tk_MainEx+0x290)[0x7f2b1b6f3c50]
wish(main+0x2c)[0x400a2c]
/lib64/libc.so.6(__libc_start_main+0xfd)[0x7f2b19f64b8d]
wish[0x4008c9]
======= Memory map: ========
00400000-00401000 r-xp 00000000 fd:01 93921                              /usr/bin/wish8.5
00600000-00601000 rw-p 00000000 fd:01 93921                              /usr/bin/wish8.5
018c5000-019e9000 rw-p 00000000 00:00 0                                  [heap]
7f2b14406000-7f2b14420000 r-xp 00000000 fd:01 180                        /lib64/libgcc_s-4.4.1-20090725.so.1
7f2b14420000-7f2b1461f000 ---p 0001a000 fd:01 180                        /lib64/libgcc_s-4.4.1-20090725.so.1
7f2b1461f000-7f2b14620000 rw-p 00019000 fd:01 180                        /lib64/libgcc_s-4.4.1-20090725.so.1
7f2b14620000-7f2b1462c000 r-xp 00000000 fd:01 3514                       /lib64/libnss_files-2.10.90.so
7f2b1462c000-7f2b1482b000 ---p 0000c000 fd:01 3514                       /lib64/libnss_files-2.10.90.so
7f2b1482b000-7f2b1482c000 r--p 0000b000 fd:01 3514                       /lib64/libnss_files-2.10.90.so
7f2b1482c000-7f2b1482d000 rw-p 0000c000 fd:01 3514                       /lib64/libnss_files-2.10.90.so
7f2b1482d000-7f2b19901000 r--p 00000000 fd:01 81083                      /usr/lib/locale/locale-archive
7f2b19901000-7f2b19903000 r-xp 00000000 fd:01 5468                       /usr/lib64/libXau.so.6.0.0
7f2b19903000-7f2b19b02000 ---p 00002000 fd:01 5468                       /usr/lib64/libXau.so.6.0.0
7f2b19b02000-7f2b19b03000 rw-p 00001000 fd:01 5468                       /usr/lib64/libXau.so.6.0.0
7f2b19b03000-7f2b19b29000 r-xp 00000000 fd:01 4583                       /lib64/libexpat.so.1.5.2
7f2b19b29000-7f2b19d28000 ---p 00026000 fd:01 4583                       /lib64/libexpat.so.1.5.2
7f2b19d28000-7f2b19d2b000 rw-p 00025000 fd:01 4583                       /lib64/libexpat.so.1.5.2
7f2b19d2b000-7f2b19d46000 r-xp 00000000 fd:01 6556                       /usr/lib64/libxcb.so.1.1.0
7f2b19d46000-7f2b19f45000 ---p 0001b000 fd:01 6556                       /usr/lib64/libxcb.so.1.1.0
7f2b19f45000-7f2b19f46000 rw-p 0001a000 fd:01 6556                       /usr/lib64/libxcb.so.1.1.0
7f2b19f46000-7f2b1a0b9000 r-xp 00000000 fd:01 3498                       /lib64/libc-2.10.90.so
7f2b1a0b9000-7f2b1a2b9000 ---p 00173000 fd:01 3498                       /lib64/libc-2.10.90.so
7f2b1a2b9000-7f2b1a2bd000 r--p 00173000 fd:01 3498                       /lib64/libc-2.10.90.so
7f2b1a2bd000-7f2b1a2be000 rw-p 00177000 fd:01 3498                       /lib64/libc-2.10.90.so
7f2b1a2be000-7f2b1a2c3000 rw-p 00000000 00:00 0 
7f2b1a2c3000-7f2b1a347000 r-xp 00000000 fd:01 3506                       /lib64/libm-2.10.90.so
7f2b1a347000-7f2b1a546000 ---p 00084000 fd:01 3506                       /lib64/libm-2.10.90.so
7f2b1a546000-7f2b1a547000 r--p 00083000 fd:01 3506                       /lib64/libm-2.10.90.so
7f2b1a547000-7f2b1a548000 rw-p 00084000 fd:01 3506                       /lib64/libm-2.10.90.so
7f2b1a548000-7f2b1a54a000 r-xp 00000000 fd:01 3504                       /lib64/libdl-2.10.90.so
7f2b1a54a000-7f2b1a74a000 ---p 00002000 fd:01 3504                       /lib64/libdl-2.10.90.so
7f2b1a74a000-7f2b1a74b000 r--p 00002000 fd:01 3504                       /lib64/libdl-2.10.90.so
7f2b1a74b000-7f2b1a74c000 rw-p 00003000 fd:01 3504                       /lib64/libdl-2.10.90.so
7f2b1a74c000-7f2b1a7e2000 r-xp 00000000 fd:01 4012                       /usr/lib64/libfreetype.so.6.3.20
7f2b1a7e2000-7f2b1a9e1000 ---p 00096000 fd:01 4012                       /usr/lib64/libfreetype.so.6.3.20
7f2b1a9e1000-7f2b1a9e7000 rw-p 00095000 fd:01 4012                       /usr/lib64/libfreetype.so.6.3.20
7f2b1a9e7000-7f2b1aa1b000 r-xp 00000000 fd:01 12756                      /usr/lib64/libfontconfig.so.1.4.1
7f2b1aa1b000-7f2b1ac1b000 ---p 00034000 fd:01 12756                      /usr/lib64/libfontconfig.so.1.4.1
7f2b1ac1b000-7f2b1ac1d000 rw-p 00034000 fd:01 12756                      /usr/lib64/libfontconfig.so.1.4.1
7f2b1ac1d000-7f2b1ac26000 r-xp 00000000 fd:01 6566                       /usr/lib64/libXrender.so.1.3.0
7f2b1ac26000-7f2b1ae26000 ---p 00009000 fd:01 6566                       /usr/lib64/libXrender.so.1.3.0
7f2b1ae26000-7f2b1ae27000 rw-p 00009000 fd:01 6566                       /usr/lib64/libXrender.so.1.3.0
7f2b1ae27000-7f2b1ae3b000 r-xp 00000000 fd:01 15574                      /usr/lib64/libXft.so.2.1.13
7f2b1ae3b000-7f2b1b03b000 ---p 00014000 fd:01 15574                      /usr/lib64/libXft.so.2.1.13
7f2b1b03b000-7f2b1b03c000 rw-p 00014000 fd:01 15574                      /usr/lib64/libXft.so.2.1.13
7f2b1b03c000-7f2b1b175000 r-xp 00000000 fd:01 6560                       /usr/lib64/libX11.so.6.2.0
7f2b1b175000-7f2b1b375000 ---p 00139000 fd:01 6560                       /usr/lib64/libX11.so.6.2.0
7f2b1b375000-7f2b1b37b000 rw-p 00139000 fd:01 6560                       /usr/lib64/libX11.so.6.2.0
7f2b1b37b000-7f2b1b498000 r-xp 00000000 fd:01 93472                      /usr/lib64/libtcl8.5.so
7f2b1b498000-7f2b1b698000 ---p 0011d000 fd:01 93472                      /usr/lib64/libtcl8.5.so
7f2b1b698000-7f2b1b6a3000 rw-p 0011d000 fd:01 93472                      /usr/lib64/libtcl8.5.so
7f2b1b6a3000-7f2b1b7cc000 r-xp 00000000 fd:01 93923                      /usr/lib64/libtk8.5.so
7f2b1b7cc000-7f2b1b9cc000 ---p 00129000 fd:01 93923                      /usr/lib64/libtk8.5.so
7f2b1b9cc000-7f2b1b9e9000 rw-p 00129000 fd:01 93923                      /usr/lib64/libtk8.5.so
7f2b1b9e9000-7f2b1ba09000 r-xp 00000000 fd:01 3491                       /lib64/ld-2.10.90.so
7f2b1bb1c000-7f2b1bb69000 rw-p 00000000 00:00 0 
7f2b1bbed000-7f2b1bbf4000 rw-p 00000000 00:00 0 
7f2b1bc07000-7f2b1bc08000 rw-p 00000000 00:00 0 
7f2b1bc08000-7f2b1bc09000 r--p 0001f000 fd:01 3491                       /lib64/ld-2.10.90.so
7f2b1bc09000-7f2b1bc0a000 rw-p 00020000 fd:01 3491                       /lib64/ld-2.10.90.so
7f2b1bc0a000-7f2b1bc0b000 rw-p 00000000 00:00 0 
7fff3625f000-7fff36274000 rw-p 00000000 00:00 0                          [stack]
7fff36320000-7fff36321000 r-xp 00000000 00:00 0                          [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0                  [vsyscall]
Aborted

Additional info:
gdb backtrace:

#0  0x00007ffff636d675 in raise () from /lib64/libc.so.6
#1  0x00007ffff636ee55 in abort () from /lib64/libc.so.6
#2  0x00007ffff63a9fd3 in __libc_message () from /lib64/libc.so.6
#3  0x00007ffff6433f17 in __fortify_fail () from /lib64/libc.so.6
#4  0x00007ffff6431e80 in __chk_fail () from /lib64/libc.so.6
#5  0x00007ffff78408a9 in strcpy (__src=<value optimized out>, 
    __dest=<value optimized out>) from /usr/lib64/libtcl8.5.so
#6  TraceVariableObjCmd (__src=<value optimized out>, 
    __dest=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclTrace.c:912
#7  0x00007ffff783ffe5 in Tcl_TraceObjCmd (dummy=<value optimized out>, 
    interp=0x604260, objc=6, objv=0x607170)
    at /usr/src/debug/tcl8.5.7/generic/tclTrace.c:249
#8  0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>, 
    length=-1, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#9  0x00007ffff77ee22a in TclExecuteByteCode (interp=0x604260, 
    codePtr=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclExecute.c:2348
#10 0x00007ffff77f6289 in TclCompEvalObj (interp=0x604260, objPtr=0x710af0, 
    invoker=0x6070d0, word=1)
    at /usr/src/debug/tcl8.5.7/generic/tclExecute.c:1474
#11 0x00007ffff77a6c56 in TclEvalObjEx (interp=0x604260, objPtr=0x710af0, 
    flags=0, invoker=0x6070d0, word=-163121408)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:5095
#12 0x00007ffff77b8bb8 in Tcl_SwitchObjCmd (dummy=<value optimized out>, 
    interp=<value optimized out>, objc=6, objv=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclCmdMZ.c:3863
#13 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0x6d0905 "switch -exact -- [tk windowingsystem] {\n    \"x11\" {\n\tevent add <<Cut>> <Control-Key-x> <Key-F20> <Control-Lock-Key-X>\n\tevent add <<Copy>> <Control-Key-c> <Key-F16> <Control-Lock-Key-C>\n\tevent add <<Pa"..., 
    length=1968, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#14 0x00007ffff77a60af in TclEvalEx (interp=0x604260, 
    script=<value optimized out>, numBytes=<value optimized out>, 
    flags=<value optimized out>, line=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:4338
#15 0x00007ffff78127f1 in Tcl_FSEvalFileEx (interp=0x604260, pathPtr=0x6c5c20, 
    encodingName=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclIOUtil.c:1814
#16 0x00007ffff77bd2f5 in Tcl_SourceObjCmd (dummy=<value optimized out>, 
    interp=0x604260, objc=<value optimized out>, objv=0x6c3400)
    at /usr/src/debug/tcl8.5.7/generic/tclCmdMZ.c:955
#17 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, command=0x0, 
    length=0, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#18 0x00007ffff77a69f3 in Tcl_EvalObjv (interp=0x2f54, objc=12116, objv=0x6, 
    flags=0) at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3886
#19 0x00007ffff77a6db2 in TclEvalObjEx (interp=0x604260, objPtr=0x6bf8a0, 
    flags=0, invoker=<value optimized out>, word=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:4983
#20 0x00007ffff78307df in Tcl_UplevelObjCmd (dummy=<value optimized out>, 
    interp=0x604260, objc=<value optimized out>, objv=0x606c58)
    at /usr/src/debug/tcl8.5.7/generic/tclProc.c:938
#21 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>, 
    length=-1, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#22 0x00007ffff77ee22a in TclExecuteByteCode (interp=0x604260, 
    codePtr=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclExecute.c:2348
#23 0x00007ffff782feb8 in TclObjInterpProcCore (interp=0x604260, 
    procNameObj=<value optimized out>, skip=<value optimized out>, 
    errorProc=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclProc.c:1748
#24 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, command=0x0, 
    length=0, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#25 0x00007ffff77a69f3 in Tcl_EvalObjv (interp=0x2f54, objc=12116, objv=0x6, 
    flags=0) at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3886
#26 0x00007ffff77a6db2 in TclEvalObjEx (interp=0x604260, objPtr=0x6a19b0, 
    flags=0, invoker=<value optimized out>, word=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:4983
#27 0x00007ffff78307df in Tcl_UplevelObjCmd (dummy=<value optimized out>, 
    interp=0x604260, objc=<value optimized out>, objv=0x606960)
    at /usr/src/debug/tcl8.5.7/generic/tclProc.c:938
#28 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>, 
    length=-1, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#29 0x00007ffff77ee22a in TclExecuteByteCode (interp=0x604260, 
    codePtr=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclExecute.c:2348
#30 0x00007ffff782feb8 in TclObjInterpProcCore (interp=0x604260, 
    procNameObj=<value optimized out>, skip=<value optimized out>, 
    errorProc=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclProc.c:1748
#31 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>, 
    length=-1, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#32 0x00007ffff77a5927 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0xffffffffffffffff <Address 0xffffffffffffffff out of bounds>, 
    length=-1, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3830
#33 0x00007ffff77ee22a in TclExecuteByteCode (interp=0x604260, 
    codePtr=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclExecute.c:2348
#34 0x00007ffff782feb8 in TclObjInterpProcCore (interp=0x604260, 
    procNameObj=<value optimized out>, skip=<value optimized out>, 
    errorProc=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclProc.c:1748
#35 0x00007ffff77a57d7 in TclEvalObjvInternal (interp=0x604260, 
    objc=<value optimized out>, objv=<value optimized out>, 
    command=0x7ffff7b99d8d "tkInit", length=6, flags=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:3690
#36 0x00007ffff77a60af in TclEvalEx (interp=0x604260, 
    script=<value optimized out>, numBytes=<value optimized out>, 
    flags=<value optimized out>, line=<value optimized out>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:4338
#37 0x00007ffff77a67ed in Tcl_Eval (interp=0x2f54, 
    script=0x2f54 <Address 0x2f54 out of bounds>)
    at /usr/src/debug/tcl8.5.7/generic/tclBasic.c:4823
#38 0x00007ffff7af56de in Initialize (interp=0x604260)
    at /usr/src/debug/tk8.5.7/generic/tkWindow.c:3252
#39 0x00000000004009a6 in Tcl_AppInit (interp=0x604260)
    at /usr/src/debug/tk8.5.7/unix/tkAppInit.c:98
#40 0x00007ffff7ae7c50 in Tk_MainEx (argc=-1, argv=<value optimized out>, 
    appInitProc=<value optimized out>, interp=0x604260)
    at /usr/src/debug/tk8.5.7/generic/tkMain.c:259
#41 0x0000000000400a2c in main (argc=1, argv=0x7fffffffe318)
    at /usr/src/debug/tk8.5.7/unix/tkAppInit.c:68
Comment 1 Tim Waugh 2009-08-13 18:16:27 UTC 
Oh, never mind, this is fixed in tcl-8.5.7-4.fc12.x86_64.