Subject: segmentation fault in pico.c

From: Georgi Kuzmanov <[email-masked]>
Date: Fri, 12 Jan 2001 15:46:03 +0000 (GMT)

There is an occasional condition which makes pine/pilot/pico cause a
segmentation fault.  I have noticed that, more often than not, it occurs
whenever I try to navigate the file system and select for
attachment/editing/deletion a file with some of the following properties:

- it is outside the home directory
- it has a relatively deep pathname (three or more directories preceding
    the basename in the absolute path)
- its name is relatively long, and it possibly contains spaces

I am not sure which of the above factors contribute to the problem, and
which are irrelevant.

I investigated the problem using gdb 4.16 and pilot from pine4.31 compiled
with a native gcc-2.95.2 on a sun4m SPARC Solaris 2.6.  It appears that
the problem manifests itself following a call to malloc() in pico.c:1297
from register_key called from display.c:2539 (wkeyhelp). This is not a
guarantee that the problem lies in the implementation of register_key(),
but that is where it manifests itself.

Listed below is the output of two gdb sessions - the first one examining
the core file dumped by pilot after receiving the segmentation fault, and
the second one running pilot to the point in register_key() where the
segmentation fault occurs, with some data inspected and references to
source files and lines in pine4.31.

Apparently, _smalloc() is a part of the libc implementation of malloc().
I have included a disassembled version with an arrow pointing to the
address where the segfault occurred, along with a dump of register
contents, for anyone who knows SPARC assembly.

Georgi Kuzmanov

First Debugging Session
=======================
gdb pilot
(gdb) bt
#0  0xef745af0 in _smalloc ()
#1  0xef745b38 in malloc ()
#2  0x344b0 in register_key (i=3, rval=364620, label=0x408b0 "",
    label_printer=0, row=0, col=0, len=0, kn=0x0, kl=0x0) at pico.c:1296
#3  0x27ebc in wkeyhelp (keymenu=0xefffec40) at display.c:2539
#4  0x259d4 in mlyesno (
    prompt=0xefffee38 "Delete file \"/var/tmp/gk/dd/ThisIsAVeryLongFileName.txt\"", dflt=0) at display.c:1181
#5  0x1964c in FileBrowse (dir=0xeffff0a8 "/home/georgi", dirlen=256,
    fn=0xeffff1a8 "", fnlen=256, sz=0x0, flags=-268440048) at browse.c:818
#6  0x18018 in main (argc=1, argv=0xeffff32c) at pilot.c:132
(gdb) info f 0
Stack frame at 0xefffe860:
 pc = 0xef745af0 in _smalloc; saved pc 0xef745b38
 called by frame at 0xefffe8c0
 Arglist at 0xefffe860, args:
 Locals at 0xefffe860
(gdb) info f 1
Stack frame at 0xefffe8c0:
 pc = 0xef745b38 in malloc; saved pc 0x344b0
 called by frame at 0xefffe930, caller of frame at 0xefffe860
 Arglist at 0xefffe8c0, args:
 Locals at 0xefffe8c0
(gdb) info f 2
Stack frame at 0xefffe930:
 pc = 0x344b0 in register_key (pico.c:1296); saved pc 0x27ebc
 called by frame at 0xefffebe0, caller of frame at 0xefffe8c0
 source language c.
 Arglist at 0xefffe930, args: i=3, rval=364620, label=0x408b0 "",
    label_printer=0, row=0, col=0, len=0, kn=0x0, kl=0x0
 Locals at 0xefffe930
(gdb) info f 3
Stack frame at 0xefffebe0:
 pc = 0x27ebc in wkeyhelp (display.c:2539); saved pc 0x259d4
 called by frame at 0xefffedb0, caller of frame at 0xefffe930
 source language c.
 Arglist at 0xefffebe0, args: keymenu=0xefffec40
 Locals at 0xefffebe0
(gdb) info f 4
Stack frame at 0xefffedb0:
 pc = 0x259d4 in mlyesno (display.c:1181); saved pc 0x1964c
 called by frame at 0xeffff048, caller of frame at 0xefffebe0
 source language c.
 Arglist at 0xefffedb0, args:
    prompt=0xefffee38 "Delete file \"/var/tmp/gk/dd/ThisIsAVeryLongFileName.txt\"", dflt=0
 Locals at 0xefffedb0
(gdb) info f 5
Stack frame at 0xeffff048:
 pc = 0x1964c in FileBrowse (browse.c:818); saved pc 0x18018
 called by frame at 0xeffff2c8, caller of frame at 0xefffedb0
 source language c.
 Arglist at 0xeffff048, args: dir=0xeffff0a8 "/home/georgi", dirlen=256,
    fn=0xeffff1a8 "", fnlen=256, sz=0x0, flags=-268440048
 Locals at 0xeffff048
(gdb) info f 6
Stack frame at 0xeffff2c8:
 pc = 0x18018 in main (pilot.c:132); saved pc 0x17d8c
 caller of frame at 0xeffff048
 source language c.
 Arglist at 0xeffff2c8, args: argc=1, argv=0xeffff32c
 Locals at 0xeffff2c8

Second Debugging Session
========================
gdb pilot
Breakpoint 1, register_key (i=3, rval=2303, label=0x408b0 "", label_printer=0,
    row=0, col=0, len=0, kn=0x0, kl=0x0) at pico.c:1272
pico.c:1272:     menuitems[i].val   = rval;
(gdb) print menuitems[3]
$1 = {val = 2303, action = 0, tl = {r = 0, c = 0}, br = {r = 0, c = 0}, lbl = {
    r = 0, c = 0}, label = 0x5a018 "- Prev Pg", label_hiliter = 0, kncp = 0x0,
  klcp = 0x0, next = 0x0}
(gdb) break 1296
Breakpoint 2 at 0x34494: file pico.c, line 1296.
(gdb) cont
Continuing.

Breakpoint 2, register_key (i=3, rval=364620, label=0x408b0 "",
    label_printer=0, row=0, col=0, len=0, kn=0x0, kl=0x0) at pico.c:1296
pico.c:1296:     if(label
pico.c:1297:        && (menuitems[i].label =(char *)malloc((strlen(label)+1)*sizeof(char))))
(gdb) print menuitems[3]
$2 = {val = 2303, action = 0, tl = {r = 0, c = 0}, br = {r = 0, c = 0}, lbl = {
    r = 0, c = 0}, label = 0x0, label_hiliter = 0, kncp = 0x0, klcp = 0x0,
  next = 0x0}
(gdb) step

Program received signal SIGSEGV, Segmentation fault.
0xef745af0 in _smalloc ()
(gdb) print menuitems[3]
$3 = {val = 2303, action = 0, tl = {r = 0, c = 0}, br = {r = 0, c = 0}, lbl = {
    r = 0, c = 0}, label = 0x0, label_hiliter = 0, kncp = 0x0, klcp = 0x0,
  next = 0x0}
(gdb) bt
#0  0xef745af0 in _smalloc ()
#1  0xef745b38 in malloc ()
#2  0x344b0 in register_key (i=3, rval=364620, label=0x408b0 "",
    label_printer=0, row=0, col=0, len=0, kn=0x0, kl=0x0) at pico.c:1296
#3  0x27ebc in wkeyhelp (keymenu=0xefffec40) at display.c:2539
#4  0x259d4 in mlyesno (
    prompt=0xefffee38 "Delete file \"/var/tmp/gk/dd/ThisIsAVeryLongFileName.txt\"", dflt=0) at display.c:1181
#5  0x1964c in FileBrowse (dir=0xeffff0a8 "/home/georgi", dirlen=256,
    fn=0xeffff1a8 "", fnlen=256, sz=0x0, flags=-268440048) at browse.c:818
#6  0x18018 in main (argc=1, argv=0xeffff32c) at pilot.c:132

Disassembly of _smalloc:
========================
0xef745a68 <_smalloc>:          save  %sp, -96, %sp
0xef745a6c <_smalloc+4>:        call  0xef745a74 <_smalloc+12>
0xef745a70 <_smalloc+8>:        sethi  %hi(0x5d400), %o1
0xef745a74 <_smalloc+12>:       add  %o1, 0x314, %o1    ! 0x5d714 <_END_+17332>
0xef745a78 <_smalloc+16>:       add  %o1, %o7, %o3
0xef745a7c <_smalloc+20>:       cmp  %i0, 0
0xef745a80 <_smalloc+24>:       bne  0xef745a8c <_smalloc+36>
0xef745a84 <_smalloc+28>:       ld  [ %o3 + 0x5c0 ], %i1
0xef745a88 <_smalloc+32>:       mov  8, %i0
0xef745a8c <_smalloc+36>:       srl  %i0, 3, %o0
0xef745a90 <_smalloc+40>:       dec  %o0
0xef745a94 <_smalloc+44>:       sll  %o0, 2, %i2
0xef745a98 <_smalloc+48>:       ld  [ %i2 + %i1 ], %o1
0xef745a9c <_smalloc+52>:       cmp  %o1, 0
0xef745aa0 <_smalloc+56>:       bne  0xef745af0 <_smalloc+136>
0xef745aa4 <_smalloc+60>:       add  %i0, 8, %l0
0xef745aa8 <_smalloc+64>:       call  0xef745b4c <_malloc_unlocked>
0xef745aac <_smalloc+68>:       sll  %l0, 6, %o0
0xef745ab0 <_smalloc+72>:       tst  %o0
0xef745ab4 <_smalloc+76>:       bne  0xef745ac4 <_smalloc+92>
0xef745ab8 <_smalloc+80>:       st  %o0, [ %i2 + %i1 ]
0xef745abc <_smalloc+84>:       ret
0xef745ac0 <_smalloc+88>:       restore  %g0, 0, %o0
0xef745ac4 <_smalloc+92>:       clr  %o2
0xef745ac8 <_smalloc+96>:       st  %i0, [ %o0 ]
0xef745acc <_smalloc+100>:      mov  %o0, %o1
0xef745ad0 <_smalloc+104>:      add  %o0, %i0, %o0
0xef745ad4 <_smalloc+108>:      inc  %o2
0xef745ad8 <_smalloc+112>:      add  %o0, 8, %o0
0xef745adc <_smalloc+116>:      cmp  %o2, 0x40
0xef745ae0 <_smalloc+120>:      bl  0xef745ac8 <_smalloc+96>
0xef745ae4 <_smalloc+124>:      st  %o0, [ %o1 + 8 ]
0xef745ae8 <_smalloc+128>:      clr  [ %o1 + 8 ]
0xef745aec <_smalloc+132>:      ld  [ %i2 + %i1 ], %o1
0xef745af0 <_smalloc+136>:      ld  [ %o1 + 8 ], %o0  <<<<<====== SIGSEGV
0xef745af4 <_smalloc+140>:      add  %o1, 8, %i0
0xef745af8 <_smalloc+144>:      st  %o0, [ %i2 + %i1 ]
0xef745afc <_smalloc+148>:      ld  [ %o1 ], %o0
0xef745b00 <_smalloc+152>:      or  %o0, 1, %o0
0xef745b04 <_smalloc+156>:      st  %o0, [ %o1 ]
0xef745b08 <_smalloc+160>:      ret
0xef745b0c <_smalloc+164>:      restore

Register dump
=============
g0             0x0      0
g1             0xef7869a0       -277321312
g2             0x64     100
g3             0x0      0
g4             0x0      0
g5             0x0      0
g6             0x0      0
g7             0x0      0
o0             0x0      0
o1             0x6b6168 7037288
o2             0xef7a9714       -277178604
o3             0xef7a3180       -277204608
o4             0xef7a9790       -277178480
o5             0x0      0
sp             0xefffe800       -268441600
o7             0xef745a6c       -277587348
l0             0x10     16
l1             0xfbf7fb80       -67634304
l2             0xf656fb50       -162071728
l3             0x10081  65665
l4             0x0      0
l5             0x0      0
l6             0x10000  65536
l7             0x0      0
i0             0x8      8
i1             0xef7a9700       -277178624
i2             0x0      0
i3             0x0      0
i4             0x0      0
i5             0xef7a3180       -277204608
fp             0xefffe860       -268441504
i7             0xef745b30       -277587152
y              0x0      0
psr            0x40001080       1073746048
wim            0x0      0
tbr            0x0      0
pc             0xef745af0       -277587216
npc            0xef745af4       -277587212
fpsr           0x21     33
cpsr           0x0      0

-- 
-----------------------------------------------------------------
 For information about this mailing list, and its archives, see: 
 http://www.washington.edu/pine/pine-info/
-----------------------------------------------------------------