Bug 246465 - Minicom might dereference NULL pointer when it is suspended while exiting
Summary: Minicom might dereference NULL pointer when it is suspended while exiting
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: minicom
Version: rawhide
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Miroslav Lichvar
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-07-02 15:08 UTC by Lubomir Kundrak
Modified: 2007-11-30 22:12 UTC (History)
0 users

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-07-10 13:04:26 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)
Fix for minicom race conditions that can result in NULL dereference during shutdown (1.00 KB, patch)
2007-07-02 15:08 UTC, Lubomir Kundrak
no flags Details | Diff

Description Lubomir Kundrak 2007-07-02 15:08:20 UTC
Description of problem:

In case minicom is suspended by its user (e.g. after susp control sequence is
entered on the controlling terminal) it restores the alternate/saved screen
contents and goes to sleep. When it is awaken via SIGCONT, it attempts to
redraw its screen contents.

In case this is done during minicom's shutdowns, it might happen that the
structures describing the screen contents have been freed, and thus the
attempt to use them will result in a Segmentation Fault due to dereference
of the NULL pointer.

The relevant lines of code are:

 880 int main(int argc, char **argv)
...
1295 #ifdef SIGTSTP
1296   signal(SIGTSTP, shjump);
..
1299 #endif
....
1531   wclose(stdwin, 1);


 610 void wclose(WIN *win, int replace)
...
 622   if (win == stdwin) {
 623     win_end();
 624     return;
 625   }

2142 void win_end(void)
...
2165   gmap = NULL;

After mincicom reaches this line, sending a TSTP signal will trigger the
following:

 108 static void shjump(int dummy /* __attribute__((unused)) */)
...
 116   wreturn();

 692 void wreturn(void)
...
 716   e = gmap;
 717   for (y = 0; y <LINES; y++) {
 718     for(x = 0; x < COLS; x++) {
 719       _write(e->value, -1, x, y, e->attr, e->color);

And here the NULL pointer e is dereferenced.

Version-Release number of selected component (if applicable):

minicom-2.2-1.fc6

Additional info:

The attached patch tries to address the issue by deregistering custom signal
handlers before cleaning up structures used by minicom and adds an extra
safety check to SIGTSTP handler (that is "just in case" -- maybe unuseful).

Comment 1 Lubomir Kundrak 2007-07-02 15:08:21 UTC
Created attachment 158332 [details]
Fix for minicom race conditions that can result in NULL dereference during shutdown

Comment 2 Miroslav Lichvar 2007-07-10 13:04:26 UTC
Should be fixed in minicom-2.2-2.fc8. Thanks.


Note You need to log in before you can comment on or make changes to this bug.