Re: Bug#700354: info: segfault on tab completion on large terminals

[Norbert Preining]

Hi Karl, hi all,

we got a bug report concerning (g)info segfaulting in big terminals.
I can reproduce it here with 95 and 96.

I build .96 and run it under the debugger, and got the following
backtrace, the free segfault is in 
        (maybe_)free (window->log_line_no);

Program received signal SIGSEGV, Segmentation fault.
*__GI___libc_free (mem=0x746963696c706d69) at malloc.c:3709
3709    malloc.c: No such file or directory.
(gdb) bt
#0  *__GI___libc_free (mem=0x746963696c706d69) at malloc.c:3709
#1  0x000000000041fac6 in recalculate_line_starts (address@hidden) at 
window.c:866
#2  0x000000000041fafc in window_set_node_of_window (window=0x67c060, 
node=0x67e560) at window.c:621
#3  0x000000000041ff3f in window_make_window (node=0x67e560) at window.c:311
#4  0x0000000000406f59 in ea_possible_completions (window=<optimized out>, 
count=<optimized out>, key=<optimized out>) at echo-area.c:1042
#5  0x0000000000419c39 in info_dispatch_on_key (key=9 '\t', map=<optimized 
out>) at session.c:5130
#6  0x000000000041a87d in info_read_and_dispatch () at session.c:227
#7  0x00000000004071e0 in info_read_completing_internal (address@hidden, 
prompt=<optimized out>, address@hidden, address@hidden) at echo-area.c:836
#8  0x0000000000407377 in info_read_maybe_completing (address@hidden, 
prompt=<optimized out>, address@hidden) at echo-area.c:911
#9  0x0000000000409ac6 in do_info_index_search (window=0x66f300, count=1, 
search_string=0x0) at indices.c:220
#10 0x0000000000419c39 in info_dispatch_on_key (key=105 'i', map=<optimized 
out>) at session.c:5130
#11 0x000000000041a87d in info_read_and_dispatch () at session.c:227
#12 0x000000000041a930 in info_session () at session.c:175
#13 0x000000000041a999 in display_startup_message_and_start () at session.c:166
#14 0x000000000041a9b7 in begin_info_session (address@hidden) at session.c:153
#15 0x0000000000403e97 in main (argc=<optimized out>, argv=0x7fffffffe178) at 
info.c:522

It seems really depending on the big terminal size, as with a normal sized
window I couldn't reproduce that.

Note that we are building with the following options to gcc:
-D_FORTIFY_SOURCE=2  -g -O2 -fstack-protector --param=ssp-buffer-size=4 
-Wformat -Werror=format-security -MT

(don't ask me what they mean, they are generated by dpkg-whatever)

All the best

Norbert

On Di, 12 Feb 2013, Peter De Wachter wrote:
> This version of info sometimes crashes when using tab completion. It only
> happens with some info files, and seemingly only on large terminals. This
> doesn't occur with the version from unstable (4.13a.dfsg.1-10).
> 
> To reproduce, take large terminal, for example:
> 
>       $ echo $LINES $COLUMNS
>       64 208
> 
> Start info with the make info file from make-doc 3.81-5.1:
> 
>       $ info make
> 
> Enter these keystrokes:
> 
>       i p TAB TAB
> 
> Result: segfault.

------------------------------------------------------------------------
PREINING, Norbert                               http://www.preining.info
JAIST, Japan                                 TeX Live & Debian Developer
DSA: 0x09C5B094   fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
------------------------------------------------------------------------