Bug 573756 - segfaults in re-entrant gettext code
Summary: segfaults in re-entrant gettext code
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: glibc
Version: 4.8
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Andreas Schwab
QA Contact: qe-baseos-tools-bugs
URL:
Whiteboard:
Depends On:
Blocks: 485811 593290
TreeView+ depends on / blocked
 
Reported: 2010-03-15 17:49 UTC by Jeff Bastian
Modified: 2018-10-27 12:11 UTC (History)
6 users (show)

Fixed In Version: glibc-2.3.4-2.48
Doc Type: Bug Fix
Doc Text:
Due to insufficient locking, the use of the strerror() function in a multi-threaded application could cause the application to terminate unexpectedly with a segmentation fault in the gettext subsystem. This update includes backported patches that add the necessary locks to glibc, resolving this issue.
Clone Of: 439486
Environment:
Last Closed: 2011-02-16 14:29:36 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)
test program (1.15 KB, text/plain)
2010-03-15 17:49 UTC, Jeff Bastian
no flags Details
alternate test case (587 bytes, application/x-gzip)
2010-03-15 18:05 UTC, Jeff Bastian
no flags Details
backport of glibc-rh439486.patch (49.42 KB, patch)
2010-04-09 19:12 UTC, Jeff Bastian
jbastian: review? (jakub)
Details | Diff


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2011:0248 0 normal SHIPPED_LIVE glibc bug fix and enhancement update 2011-02-15 16:40:45 UTC

Description Jeff Bastian 2010-03-15 17:49:01 UTC
Created attachment 400274 [details]
test program

Description of problem:
Multithreaded apps can segfault in, e.g., strerror_r, if running in non-C locales like ja_JP.UTF-8.  This was fixed in RHEL 5 in bug 439486 but it's still a problem in RHEL 4.

Version-Release number of selected component (if applicable):
glibc-2.3.4-2.43.el4_8.2

How reproducible:
fairly often

Steps to Reproduce:
1. Compile the attached test program
   g++ -o test test.cpp -lpthread
2. ./test
  
Actual results:
child killed by signal 11

Expected results:
clean exit

Additional info:

Comment 1 Jeff Bastian 2010-03-15 18:05:38 UTC
Created attachment 400279 [details]
alternate test case

On a multi-CPU/multi-core system:

1. tar xzf strerror_r.tar.gz
2. cd strerror_r
3. make
4. ./test.sh

Occasionally you'll see an error message:
./test.sh: line 10: 29993 Segmentation fault      ./strerror_r

Comment 6 Jeff Bastian 2010-04-09 19:12:50 UTC
Created attachment 405622 [details]
backport of glibc-rh439486.patch

Attached is an attempt to backport glibc-rh439486.patch from RHEL 5 glibc.

This patch definitely should be reviewed because I had to backport some other very large changes to get it to compile.  These include:
   - a large portion of _nl_find_msg() in intl/dcigettext.c was re-written
   - _nl_init_domain_conv() and _nl_free_domain_conv() removed
       from intl/loadmsgcat.c
   - added struct converted_domain to gettextP.h
   - updated struct loaded_domain to use the struct converted_domain
   - added get_output_charset() internal function to dcigettext.c
   - included some more headers in gconv_int.h to clear some compiler warnings

In my testing with this patch, the test program in comment 0 succeeds every time.  I ran it in a loop 100 times and without the patch, it would fail approximately 50/100 times.  With the patch, it's successful all the time.
    let f=0
    for i in $(seq 1 100); do
        echo -n "$i : "
        if ./test ; then
            echo Passed
        else
            echo
            let f=f+1
        fi
    done
    echo
    echo "Failed $f times out of 100"

Comment 13 Jaromir Hradilek 2011-01-19 10:51:34 UTC
    Technical note added. If any revisions are required, please edit the "Technical Notes" field
    accordingly. All revisions will be proofread by the Engineering Content Services team.
    
    New Contents:
Due to insufficient locking, the use of the strerror() function in a multi-threaded application could cause the application to terminate unexpectedly with a segmentation fault in the gettext subsystem. This update includes backported patches that add the necessary locks to glibc, resolving this issue.

Comment 15 errata-xmlrpc 2011-02-16 14:29:36 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0248.html


Note You need to log in before you can comment on or make changes to this bug.