Bug 58317 - RHL9: trivial script causes expect to coredump
RHL9: trivial script causes expect to coredump
Product: Red Hat Linux
Classification: Retired
Component: tcltk (Show other bugs)
i386 Linux
medium Severity medium
: ---
: ---
Assigned To: Jens Petersen
: 105038 (view as bug list)
Depends On:
  Show dependency treegraph
Reported: 2002-01-14 01:05 EST by Jonathan Kamens
Modified: 2007-04-18 12:39 EDT (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2004-05-18 08:26:21 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
A patch which should fix the problem (593 bytes, patch)
2003-10-14 12:28 EDT, Bernd Schmidt
no flags Details | Diff

  None (edit)
Description Jonathan Kamens 2002-01-14 01:05:13 EST
This script causes expect to coredump:

#!/usr/bin/expect -f
spawn false
wait -i $spawn_id

This comment in exp_close in exp_command.c gives a hint about what's going

	    /* at this point esPtr may have been freed so don't touch it
               any longer */

Unfortunately, the esPtr which this comment says shouldn't be touched anymore is
in fact touched in the for loop in exp_close_all in exp_chan.c  This is as far
as I got at debugging this problem before running into the extent of my expect

Note that this simple modification to the script makes the coredump go away,
presumably by causing the channel to be removed from the list checked by
exp_close_all before the script exits:

#!/usr/bin/expect -f
spawn false
set timeout -1
expect eof
wait -i $spawn_id
Comment 1 Derek Tattersall 2002-04-12 20:34:36 EDT
This script causes expect to coredump in skipjack beta4 as well.
Comment 2 Derek Tattersall 2002-07-08 20:26:44 EDT
The script causes a core dump in Limbo re-0701.  However, ActiveTcl 
appears to have solved this problem.
Comment 3 Jens Petersen 2002-08-14 06:44:58 EDT
Thanks.  The problem is still present in expect-5.38.0 too.
Comment 4 Jens Petersen 2003-09-25 04:11:43 EDT
*** Bug 105038 has been marked as a duplicate of this bug. ***
Comment 5 Bernd Schmidt 2003-10-14 12:28:27 EDT
Created attachment 95168 [details]
A patch which should fix the problem
Comment 6 Bernd Schmidt 2003-10-14 12:30:20 EDT
This is a simple use-after-free problem which can be fixed by rewriting the loop
in exp_close_all.
Comment 8 Jens Petersen 2003-10-15 07:47:30 EDT
Thanks for the patch.  Who should I attribute it to btw?
Comment 9 Jens Petersen 2003-10-15 08:26:09 EDT
Actually it looks like this is already fixed in expect-5.39.0 afaict
from looking at the code.
Comment 10 Jens Petersen 2003-10-15 08:48:54 EDT
Should be fixed finally in tcltk-8.3.5-91 (ie expect-5.39.0-91).
Comment 11 Jens Petersen 2003-10-15 09:38:21 EDT
Actual fixed release number is -93.
Comment 14 Jens Petersen 2003-12-11 00:44:09 EST
Re-opening until package for RHL 9 available.

Note You need to log in before you can comment on or make changes to this bug.