Re: Using systemd-249's libnss_systemd.so.2 triggers a crash in bash-5.1's malloc.c

[Julien Moutinho]

Le lun. 04 oct. 2021 10h34 +0200, Andreas Schwab a écrit :
> Here is a patch:
Thanks Andreas, that particular crash disappears with this patch.
However the crash after _nss_systemd_getpwuid_r() is still happening for me,
and valgrind can still find a similar crash after source_builtin():

$ nix -L build .#bash5-with-bash-malloc
$ valgrind result/bin/bash -c '. /dev/null'
> ==547049== Memcheck, a memory error detector
> ==547049== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
> ==547049== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
> ==547049== Command: result/bin/bash -c .\ /dev/null
> ==547049== 
> ==547049== Invalid free() / delete / delete[] / realloc()
> ==547049==    at 0x483F8E9: free (in 
> /nix/store/7s7hzqaf5imxmpjlxh2n6fs7ixml98ya-valgrind-3.16.1/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
> ==547049==    by 0x47330F: xfree (xmalloc.c:150)
> ==547049==    by 0x4644FA: unwind_frame_run_internal (unwind_prot.c:325)
> ==547049==    by 0x4640B6: without_interrupts (unwind_prot.c:117)
> ==547049==    by 0x464656: run_unwind_frame (unwind_prot.c:143)
> ==547049==    by 0x483E59: source_builtin (source.def:197)
> ==547049==    by 0x430960: execute_builtin (execute_cmd.c:4828)
> ==547049==    by 0x4377AC: execute_builtin_or_function (execute_cmd.c:5341)
> ==547049==    by 0x433DC4: execute_simple_command (execute_cmd.c:4597)
> ==547049==    by 0x434A03: execute_command_internal (execute_cmd.c:846)
> ==547049==    by 0x479E75: parse_and_execute (evalstring.c:495)
> ==547049==    by 0x41C0A5: run_one_command (shell.c:1440)
> ==547049==  Address 0x4051f70 is in the brk data segment 0x4033000-0x4055fff
> ==547049== 
> ==547049== 
> ==547049== HEAP SUMMARY:
> ==547049==     in use at exit: 0 bytes in 0 blocks
> ==547049==   total heap usage: 2,410 allocs, 2,411 frees, 156,759 bytes 
> allocated
> ==547049== 
> ==547049== All heap blocks were freed -- no leaks are possible
> ==547049== 
> ==547049== For lists of detected and suppressed errors, rerun with: -s
> ==547049== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)