Re: [slang-users] Possible SEGV in fixup_tgetstr()

["John E. Davis" <jed@xxxxxxxxxxx>]

Hi Jerry,

Jerry Meng <jerrytstng@xxxxxxxxx> wrote:
> Hello,
>
> "mc" is one application that uses the S-Lang library. While running mc on
> Ubuntu 22.04, we observed one crash as follows:
>
> Program received signal SIGSEGV, Segmentation fault.

You appear to have a corrupt terminfo file:

  $ infocmp -A ~/.terminfo xterm-256color
  "?", line 0, col 0: corrupt data found in convert_strings
  #       Reconstructed via infocmp from file: /home/jed/.terminfo/x/xterm-256color
  xterm-256color|xterm with 256 colors,
        am, bce, ccc, km, mc5i, mir, msgr, npc, xenl,
        colors#0x100, cols#80, it#8, lines#24, pairs#0x10000,
        bel=\r, cbt=Z, clear=H\E[2J, cr=\E[%i%p1%d;%p2%dr, csnm=<,
        csr=%i%p1%d;%p2%dr,
        getm=%?%p1%{8}%<%t3%p1%d%e%p1%{16}%<%t9%p1%{8}%-%d%e38;5;%p1%d%;m,
        kf36={8}%<%t4%p1%d%e%p1%{16}%<%t10%p1%{8}%-%d%e48;5;%p1%d%;m,
        meml=, s3ds=?69h\E[%i%p1%d;%p2%ds,
        setaf=%?%p1%{8}%<%t4%p1%d%e%p1%{16}%<%t10%p1%{8}%-%d%e48;5;%p1%d%;m,
        smgbp=?69h\E[%i%p1%ds, smglp=?69h\E[%i;%p1%ds, tbc=3g,
        u9=A,

Some of the string offsets in that file are invalid and slang
currently does not check their validity.  I will add the check and
release a patch.  But the root cause appears to be your terminfo file.

Thanks,
--John

>
> 0x00007ffde9052938 in fixup_tgetstr (what=0x5555556ca220 <error: Cannot
> access memory at address 0x5555556ca220>) at ./src/sldisply.c:2536
> (gdb) bt
> #0  0x00007ffde9052938 in fixup_tgetstr (what=0x5555556ca220 <error: Cannot
> access memory at address 0x5555556ca220>) at ./src/sldisply.c:2536
> #1  0x00007ffde9052a67 in tt_tgetstr (cap=0x7ffde90f384a "im") at
> ./src/sldisply.c:2592
> #2  0x00007ffde9052fcc in SLtt_initialize (term=0x7fffffffed31
> "xterm-256color") at ./src/sldisply.c:2780
> #3  0x00007ffde9052c6f in SLtt_get_terminfo () at ./src/sldisply.c:2680
> #4  0x00005555555735fe in ?? ()
> #5  0x00007ffde9429d90 in __libc_start_call_main
> (main=main@entry=0x555555571450,
> argc=argc@entry=1, argv=argv@entry=0x7fffffffe2c8)
>     at ../sysdeps/nptl/libc_start_call_main.h:58
> #6  0x00007ffde9429e40 in __libc_start_main_impl (main=0x555555571450,
> argc=1, argv=0x7fffffffe2c8, init=<optimized out>, fini=<optimized out>,
>     rtld_fini=<optimized out>, stack_end=0x7fffffffe2b8) at
> ../csu/libc-start.c:392
> #7  0x0000555555575135 in ?? ()hat uses the S-Lang library. While running
> mc on Ubuntu 22.04, we triggered one crash as followers:
>
>
> *The version information of mc and S-Lang:*
>
> GNU Midnight Commander 4.8.27
> Built with GLib 2.68.4
> Built with S-Lang 2.3.2 with terminfo database
> With builtin Editor and Aspell support
> With subshell support as default
> With support for background operations
> With mouse support on xterm and Linux console
> With support for X11 events
> With internationalization support
> With multiple codepages support
> With ext2fs attributes support
> Virtual File Systems:
>  cpiofs, tarfs, sfs, extfs, ext2undelfs, ftpfs, sftpfs, fish
> Data types:
>  char: 8; int: 32; long: 64; void *: 64; size_t: 64; off_t: 64;
>
>
> *The steps to reproduce this bug:*
>
> 1. Copy the attached file to ~/.terminfo/x/
> 2. Run mc
>
>
> ----
> Kind Regards,
> Jerry Meng
_______________________________________________
For list information, visit <http://jedsoft.org/slang/mailinglists.html>.