cvs rdiff -t consistently crashes with SEGV when processing files in an Attic directory

[James Cribb]

The attached Bourne shell script consistently reproduces the problem.  
The second attached file is the output from the script on our Linux host.

A GDB backtrace of the core file from cvs seems to show the SEGV occurs 
in __libc_free().  Possibly malloc()-ed memory is being free()-ed twice?



=========================================================================
This e-mail is sent for the sole attention of the identified addressee
and its contents are provided for information purposes only. Fortis 
Clearing Sydney Pty Ltd makes no warranty or representation as to the 
accuracy and completeness of any information and does not assume whatever
commitment hereby. Legally binding obligations can only arise for, or be 
entered into on behalf of, Fortis Clearing Sydney Pty Ltd by means of 
a written instrument, signed by two duly authorised representatives of 
Fortis Clearing Sydney Pty Ltd. Fortis Clearing Sydney Pty Ltd excludes 
any liability whatsoever for any direct or consequential loss arising 
from the use of, or reliance on, this e-mail or its contents.
=========================================================================

#!/bin/sh -v
#----------------------------------------------------------------------
# Demonstrates a (memory management?) bug in CVS "rdiff -t" subcommand.
# "cvs rdiff -t" gets a SEGV when examining files in an Attic directory.
# This means subsequent files/directories will not be rdiff-ed.
#----------------------------------------------------------------------

# Somewhere to work
mkdir /tmp/cvs-rdiff-bug
cd /tmp/cvs-rdiff-bug

# Create repository
CVSROOT=`pwd`/repository
export CVSROOT
cvs init

# Create a module "m" with files "foo" and "d/bar"
mkdir m
cd m
echo foo >foo
mkdir d
echo bar >d/bar
cvs import -m'Initial import' m vendor initial
cd ..
rm -r m

# Remove "foo"
cvs get m
cd m
rm foo
cvs rm foo
cvs commit -m'Removed' foo

# Modify "d/bar"
echo foo >d/bar
cvs commit -m'Changed' d/bar

# Crash before showing d/bar diffs
cvs rdiff -t m

# Show d/bar diffs, i.e., what we miss out on because of the crash.
cvs rdiff -t m/d

#----------------------------------------------------------------------
# System details
cvs -version

rpm -qf `which cvs`
rpm -q kernel
uname -a
head -1 /etc/issue

#!/bin/sh -v
#----------------------------------------------------------------------
# Demonstrates a (memory management?) bug in CVS "rdiff -t" subcommand.
# "cvs rdiff -t" gets a SEGV when examining files in an Attic directory.
# This means subsequent files/directories will not be rdiff-ed.
#----------------------------------------------------------------------

# Somewhere to work
mkdir /tmp/cvs-rdiff-bug
cd /tmp/cvs-rdiff-bug

# Create repository
CVSROOT=`pwd`/repository
pwd
export CVSROOT
cvs init

# Create a module "m" with files "foo" and "d/bar"
mkdir m
cd m
echo foo >foo
mkdir d
echo bar >d/bar
cvs import -m'Initial import' m vendor initial
N m/foo
cvs import: Importing /tmp/cvs-rdiff-bug/repository/m/d
N m/d/bar

No conflicts created by this import

cd ..
rm -r m

# Remove "foo"
cvs get m
cvs checkout: Updating m
U m/foo
cvs checkout: Updating m/d
U m/d/bar
cd m
rm foo
cvs rm foo
cvs remove: scheduling `foo' for removal
cvs remove: use 'cvs commit' to remove this file permanently
cvs commit -m'Removed' foo
Removing foo;
/tmp/cvs-rdiff-bug/repository/m/foo,v  <--  foo
new revision: delete; previous revision: 1.1.1.1
done

# Modify "d/bar"
echo foo >d/bar
cvs commit -m'Changed' d/bar
Checking in d/bar;
/tmp/cvs-rdiff-bug/repository/m/d/bar,v  <--  bar
new revision: 1.2; previous revision: 1.1
done

# Crash before showing d/bar diffs
cvs rdiff -t m
cvs rdiff: Diffing m
./cvs_rdiff-t_bug_demo.sh: line 39: 11761 Segmentation fault      (core dumped) 
cvs rdiff -t m

# Show d/bar diffs, i.e., what we miss out on because of the crash.
cvs rdiff -t m/d
cvs rdiff: Diffing m/d
Index: m/d/bar
diff -c m/d/bar:1.1.1.1 m/d/bar:1.2
*** m/d/bar:1.1.1.1     Wed Mar 26 11:54:11 2003
--- m/d/bar     Wed Mar 26 11:54:12 2003
***************
*** 1 ****
! bar
--- 1 ----
! foo

#----------------------------------------------------------------------
# System details
cvs -version

Concurrent Versions System (CVS) 1.11.2 (client/server)

Copyright (c) 1989-2001 Brian Berliner, david d `zoo' zuhn, 
                        Jeff Polk, and other authors

CVS may be copied only under the terms of the GNU General Public License,
a copy of which can be found with the CVS distribution kit.

Specify the --help option for further information about CVS

rpm -qf `which cvs`
which cvs
cvs-1.11.2-5
rpm -q kernel
kernel-2.4.2-2
uname -a
Linux svlx-fcs062 2.4.19 #3 SMP Fri Jan 10 13:42:32 EST 2003 i686 unknown
head -1 /etc/issue
Red Hat Linux release 7.1 (Seawolf)