BusyBox Bug and Patch Tracking
BusyBox
  

Viewing Issue Simple Details Jump to Notes ] View Advanced ] Issue History ] Print ]
ID Category Severity Reproducibility Date Submitted Last Update
0001407 [uClibc] Architecture Specific minor always 06-28-07 05:31 09-15-07 01:26
Reporter cmachine View Status public  
Assigned To uClibc
Priority normal Resolution fixed  
Status closed   Product Version 0.9.28
Summary 0001407: gen_wctype segmentation fault
Description Log:
./gen_wctype en_US
gen_collate.c:1461:2: warning: #warning need to update last in order and position or check
gen_collate.c:1547:2: warning: #warning devel code
gen_collate.c:1690:2: warning: #warning devel code
gen_collate.c:1811:2: warning: #warning need to add section to weight list?
gen_collate.c:1891:2: warning: #warning have to use rule for current section!!!
gen_collate.c:1942:2: warning: #warning devel code
gen_collate.c:1945:2: warning: #warning hack to get around hu_HU reorder-after problem
gen_collate.c:2352:2: warning: #warning devel code
gen_collate.c: In function 'dump_section':
gen_collate.c:2466: warning: unused variable 'i'
gen_collate.c:2618:2: warning: #warning fix the index2weight check!!
gen_collate.c:2655:2: warning: #warning check ko_kR and 9
gen_collate.c:2662:2: warning: #warning check ko_kR and 9
gen_collate.c:2686:2: warning: #warning check ko_kR and 9
gen_collate.c:2708:2: warning: #warning check
gen_collate.c:3193:2: warning: #warning handle UNDEFINED idx specially? what if in only some of derived?
gen_collate.c: In function 'finalize_base':
gen_collate.c:2601: warning: unused variable 'n'
gen_collate.c:2600: warning: unused variable 'p'
gen_collate.c: In function 'print_starter_all_node':
gen_collate.c:3253: warning: unused variable 'x'
gen_collate.c:3252: warning: unused variable 'n'
gen_collate.c:3251: warning: unused variable 'p'
gen_collate.c:3250: warning: unused variable 'ci'
typecount[ 0] = 95084 C_unclassified
typecount[ 1] = 88837 C_alpha_nonupper_nonlower
typecount[ 2] = 756 C_alpha_lower
typecount[ 3] = 4 C_alpha_upper_lower
typecount[ 4] = 745 C_alpha_upper
typecount[ 5] = 10 C_digit
typecount[ 6] = 11088 C_punct
typecount[ 7] = 2 C_graph
typecount[ 8] = 0 C_print_space_nonblank
typecount[ 9] = 15 C_print_space_blank
typecount[10] = 0 C_space_nonblank_noncntrl
typecount[11] = 0 C_space_blank_noncntrl
typecount[12] = 6 C_cntrl_space_nonblank
typecount[13] = 1 C_cntrl_space_blank
typecount[14] = 60 C_cntrl_nonspace
typecount[15] = 0 empty_slot
optimizing is* table..
gen_collate.c: In function 'add_rule':
gen_collate.c:3638: warning: unused variable 'j'
gen_collate.c: In function 'add_range_rule':
gen_collate.c:3715: warning: unused variable 'j'
gen_collate.c: In function 'dump_collate':
gen_collate.c:3939: warning: format '%d' expects type 'int', but argument 3 has type 'long unsigned int'
gen_collate.c: At top level:
gen_collate.c:3792: warning: 'dump_base_locale' defined but not used
gen_collate.c:3828: warning: 'dump_der_locale' defined but not used
gen_collate.c:850: warning: 'print_colnode' defined but not used
gen_collate.c:2584: warning: 'print_starter_node' defined but not used
gen_collate.c:3248: warning: 'print_starter_all_node' defined but not used
ishift 1 tshift 0 size 49441
ishift 2 tshift 0 size 25561
ishift 3 tshift 0 size 14365
ishift 4 tshift 0 size 9845
ishift 5 tshift 0 size 8453
ishift 6 tshift 0 size 7909
ishift 1 tshift 1 size 25302
ishift 2 tshift 1 size 13560
ishift 3 tshift 1 size 8228
ishift 4 tshift 1 size 5996
ishift 5 tshift 1 size 4956
ishift 6 tshift 1 size 4796
ishift 1 tshift 2 size 13746
ishift 2 tshift 2 size 8008
ishift 3 tshift 2 size 5356
ishift 4 tshift 2 size 4068
ishift 5 tshift 2 size 3604
ishift 1 tshift 3 size 8642
ishift 2 tshift 3 size 5780
ishift 3 tshift 3 size 4368
ishift 4 tshift 3 size 3752
ishift 5 tshift 3 size 3704
ishift 1 tshift 4 size 7070
ishift 2 tshift 4 size 5596
ishift 3 tshift 4 size 4904
ishift 4 tshift 4 size 4688
ishift 1 tshift 5 size 7078
ishift 2 tshift 5 size 6348
ishift 3 tshift 5 size 6048
ishift 4 tshift 5 size 5984
ishift 1 tshift 6 size 7222
ishift 2 tshift 6 size 6880
ishift 3 tshift 6 size 6752
ishift 4 tshift 6 size 6752
ishift 1 tshift 7 size 8016
ishift 2 tshift 7 size 7856
ishift 3 tshift 7 size 7808
ishift 1 tshift 8 size 10488
ishift 2 tshift 8 size 10416
ishift 3 tshift 8 size 10416
ishift 1 tshift 9 size 14472
ishift 2 tshift 9 size 14448
ishift 1 tshift 10 size 20560
ishift 2 tshift 10 size 20556
smallest = 3604
setting ishift 5 tshift 2
make: *** [wctables.h] &0001054;&0001096;&0001080;&0001073;&0001082;&0001072; &0001089;&0001077;&0001075;&0001084;&0001077;&0001085;&0001090;&0001080;&0001088;&0001086;&0001074;&0001072;&0001085;&0001080;&0001103; (core dumped)
make: *** Waiting for unfinished jobs....
Additional Information Crash is due to improper initialization of uniqblock array in newopt() in gen_wctype.c. As the result uniqblock[0] is used unintialized.

uniqblock array is initialized here:
get_wctype.c:804
=======================================
    uniq = 1;
    uit[(ti[0]-ut)/blocksize] = 0;
    for (i=1 ; i < numblocks ; i++) {
        if (memcmp(ti[i-1], ti[i], blocksize) < 0) {
            if (++uniq > 255) {
                break;
            }
            uniqblock[uniq - 1] = i;
        }
#if 1
        else if (memcmp(ti[i-1], ti[i], blocksize) > 0) {
            printf("bad sort %i!\n", i);
            abort();
        }
#endif
        uit[(ti[i]-ut)/blocksize] = uniq - 1;
    }
=======================================
uniqblock initialized with statement
804: uniqblock[uniq - 1] = i;

uniq is initialized with 1 and on first iteration it is incremented up to 2 here:
808: if (++uniq > 255) {

So the first item of array being initialized is 1, ie uniqblock[0] is uninitialized, but later it is accessed here:
865: memcpy(tbl->ti + i * blocksize, ti[uniqblock[i]], blocksize);
making get_wctype crash.

Attached proposed patch

Attached Files  uclibc-0.9.28.3-get_wctype.patch [^] (478 bytes) 06-28-07 05:31

- Relationships

- Notes
(0002743)
vapier
09-15-07 01:26

this should already be fixed in 0.9.29
 

- Issue History
Date Modified Username Field Change
06-28-07 05:31 cmachine New Issue
06-28-07 05:31 cmachine Status new => assigned
06-28-07 05:31 cmachine Assigned To  => uClibc
06-28-07 05:31 cmachine File Added: uclibc-0.9.28.3-get_wctype.patch
09-15-07 01:26 vapier Note Added: 0002743
09-15-07 01:26 vapier Status assigned => closed
09-15-07 01:26 vapier Resolution open => fixed


Copyright © 2000 - 2006 Mantis Group
Powered by Mantis Bugtracker