>Number:         21963
>Category:       lib
>Synopsis:       A simple "opendir -> closedir" with -lpthread will core dump.
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    lib-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Jun 23 02:22:00 UTC 2003
>Closed-Date:
>Last-Modified:
>Originator:     MAEKAWA Masahide
>Release:        1.6U
>Organization:
N/A
>Environment:
NetBSD astaroth.daemon-systems.org 1.6U NetBSD 1.6U (ASTAROTH) #0: Sat Jun 21 01:13:30 JST 2003  maekawa@lucifer.daemon-systems.org:/usr/src/sys/arch/i386/compile/ASTAROTH i386

>Description:
Here is a simple programe (dirent.c).

--start--
#include <dirent.h>

int
main()
{
        DIR *dirp;

        if ((dirp = opendir("/")) == NULL)
                exit(1);

        if (closedir(dirp) == -1)
                exit(1);

        exit(0);
}
--end--

# ln -f -s J /etc/malloc.conf
# cc dirent.c && ./a.out && echo $?
0
# cc -g dirent -lpthread && ./a.out
zsh: bus error (core dumped)  ./a.out
# gdb a.out a.out.core
...
(gdb) bt
#0  0x48063f40 in pthread_mutex_unlock () from /usr/lib/libpthread.so.0
#1  0x480e23c9 in closedir () from /usr/lib/libc.so.12
#2  0x8048a14 in main () at dirent.c:11
#3  0x8048694 in ___start ()
(gdb) f 2
#2  0x8048a14 in main () at dirent.c:11
11              if (closedir(dirp) == -1)
(gdb) p *dirp
$1 = {dd_fd = -791621424, dd_loc = -791621424, dd_size = -791621424, 
  dd_buf = 0xd0d0d0d0 <Address 0xd0d0d0d0 out of bounds>, dd_len = -791621424, 
  dd_seek = -3399988123389603632, dd_rewind = -791621424, 
  dd_flags = -791621424, dd_lock = 0xd0d0d0d0}

>How-To-Repeat:
A simple "opendir -> closedir" with -lpthread will core dump.
>Fix:
I have no idea.

But on another NetBSD box,
NetBSD lucifer.daemon-systems.org 1.6T NetBSD 1.6T (LUCIFER) #0: Wed May 21 16:36:03 JST 2003  maekawa@lucifer.daemon-systems.org:/usr/src/sys/arch/i386/compile/LUCIFER i386

The program runs with no problems.

>Release-Note:
>Audit-Trail:
>Unformatted: