Bug 246465 - Minicom might dereference NULL pointer when it is suspended while exiting
Minicom might dereference NULL pointer when it is suspended while exiting
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: minicom (Show other bugs)
rawhide
All Linux
low Severity low
: ---
: ---
Assigned To: Miroslav Lichvar
Fedora Extras Quality Assurance
: EasyFix
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-07-02 11:08 EDT by Lubomir Kundrak
Modified: 2007-11-30 17:12 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-07-10 09:04:26 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Fix for minicom race conditions that can result in NULL dereference during shutdown (1.00 KB, patch)
2007-07-02 11:08 EDT, Lubomir Kundrak
no flags Details | Diff

  None (edit)
Description Lubomir Kundrak 2007-07-02 11:08:20 EDT
Description of problem:

In case minicom is suspended by its user (e.g. after susp control sequence is
entered on the controlling terminal) it restores the alternate/saved screen
contents and goes to sleep. When it is awaken via SIGCONT, it attempts to
redraw its screen contents.

In case this is done during minicom's shutdowns, it might happen that the
structures describing the screen contents have been freed, and thus the
attempt to use them will result in a Segmentation Fault due to dereference
of the NULL pointer.

The relevant lines of code are:

 880 int main(int argc, char **argv)
...
1295 #ifdef SIGTSTP
1296   signal(SIGTSTP, shjump);
..
1299 #endif
....
1531   wclose(stdwin, 1);


 610 void wclose(WIN *win, int replace)
...
 622   if (win == stdwin) {
 623     win_end();
 624     return;
 625   }

2142 void win_end(void)
...
2165   gmap = NULL;

After mincicom reaches this line, sending a TSTP signal will trigger the
following:

 108 static void shjump(int dummy /* __attribute__((unused)) */)
...
 116   wreturn();

 692 void wreturn(void)
...
 716   e = gmap;
 717   for (y = 0; y <LINES; y++) {
 718     for(x = 0; x < COLS; x++) {
 719       _write(e->value, -1, x, y, e->attr, e->color);

And here the NULL pointer e is dereferenced.

Version-Release number of selected component (if applicable):

minicom-2.2-1.fc6

Additional info:

The attached patch tries to address the issue by deregistering custom signal
handlers before cleaning up structures used by minicom and adds an extra
safety check to SIGTSTP handler (that is "just in case" -- maybe unuseful).
Comment 1 Lubomir Kundrak 2007-07-02 11:08:21 EDT
Created attachment 158332 [details]
Fix for minicom race conditions that can result in NULL dereference during shutdown
Comment 2 Miroslav Lichvar 2007-07-10 09:04:26 EDT
Should be fixed in minicom-2.2-2.fc8. Thanks.

Note You need to log in before you can comment on or make changes to this bug.