Bug 7145 - bc severely mishandles large input strings
bc severely mishandles large input strings
Status: CLOSED RAWHIDE
Product: Red Hat Linux
Classification: Retired
Component: bc (Show other bugs)
6.1
All Linux
medium Severity medium
: ---
: ---
Assigned To: Trond Eivind Glomsrxd
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 1999-11-19 11:10 EST by James Manning
Modified: 2008-05-01 11:37 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2000-04-06 18:39:44 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description James Manning 1999-11-19 11:10:03 EST
Stock RH 6.1 (bc-1.05a-4)

Input strings below 127 characters in length work fine.

 - input strings between 127 and 254 characters, bc will segfault,
 - 255 characters it simply exits (no segfault, no answer)
 - 256 characters it gives no answer, but doesn't exit
 - 257 characters appears to spit out the first number in the string

(etc... it keeps getting weirder and weirder)

Here's me while trying to use it to add filesizes

[root@rtsa1 /root]# bc -lq
889494851+350818049+309390809+309421324+310826169+309039148+219752448+334228158+334399608+335729894+334104941+237438011+2323663
Segmentation fault (core dumped)
[root@rtsa1 /root]# bc -q
889494851+350818049+309390809+309421324+310826169+309039148+219752448+334228158+334399608+335729894+334104941+237438011+2323663
Segmentation fault (core dumped)
[root@rtsa1 /root]#

(gdb) bt
#0  0x400d7a93 in strncpy (s1=0x8056db9
"889494851+350818049+309390809+309421324+310826169+309039148+219752448+334228158+334399608+335729894+334104941+237438011+2323663",
    s2=0x8061ca0 "", n=4294967168) at ../sysdeps/generic/strncpy.c:82
#1  0x804a55a in strcpy () at ../sysdeps/generic/strcpy.c:30
#2  0x804ae39 in strcpy () at ../sysdeps/generic/strcpy.c:30
#3  0x804ac45 in strcpy () at ../sysdeps/generic/strcpy.c:30
#4  0x8049455 in strcpy () at ../sysdeps/generic/strcpy.c:30
#5  0x8049107 in strcpy () at ../sysdeps/generic/strcpy.c:30
#6  0x400921eb in __libc_start_main (main=0x8048f50 <strcpy+504>, argc=2,
argv=0xbffffd54, init=0x8048ab8 <_init>, fini=0x805060c <_fini>,
rtld_fini=0x4000a610 <_dl_fini>,
    stack_end=0xbffffd4c) at ../sysdeps/generic/libc-start.c:90
(gdb)

Program terminated with signal 11, Segmentation fault.

making > 256 chars invalid (and man page'ing that) would be fine, but
127-254 should really be valid lengths :)
Comment 1 Chih-Chung Chang 2000-03-31 13:38:59 EST
here is the fix:

--- scan.c~     Tue Apr 22 05:57:52 1997
+++ scan.c      Sat Apr  1 02:39:17 2000
@@ -228,7 +228,7 @@
 /* Variables to help interface readline with bc. */
 static char *rl_line = (char *)NULL;
 static char *rl_start = (char *)NULL;
-static char  rl_len = 0;
+static int  rl_len = 0;

 /* Definitions for readline access. */
 extern FILE *rl_instream;
--- scan.l~     Tue Apr 22 05:57:00 1997
+++ scan.l      Sat Apr  1 02:39:00 2000
@@ -60,7 +60,7 @@
 /* Variables to help interface readline with bc. */
 static char *rl_line = (char *)NULL;
 static char *rl_start = (char *)NULL;
-static char  rl_len = 0;
+static int  rl_len = 0;

 /* Definitions for readline access. */
 extern FILE *rl_instream;
Comment 2 Trond Eivind Glomsrxd 2000-04-06 18:39:59 EDT
A fixed RPM should be available in the next Raw Hide - thanks for the patch.

Note You need to log in before you can comment on or make changes to this bug.