Re: bin/48480: vi seg-fault

[Thomas Klausner <wiz%NetBSD.org@localhost>]

The following reply was made to PR bin/48480; it has been noted by GNATS.

From: Thomas Klausner <wiz%NetBSD.org@localhost>
To: gnats-bugs%NetBSD.org@localhost
Cc: Christos Zoulas <christos%zoulas.com@localhost>
Subject: Re: bin/48480: vi seg-fault
Date: Wed, 25 Dec 2013 17:17:34 +0100

 On Wed, Dec 25, 2013 at 02:55:01PM +0000, Christos Zoulas wrote:
 >  I can't reproduce this. Can you run it on a system that has MKDEBUG=yes
 >  on it?
 
 > vi 5970_1_atf.html 
 zsh: segmentation fault (core dumped)  vi 5970_1_atf.html
 > gdb vi vi.core 
 GNU gdb (GDB) 7.6.1
 Copyright (C) 2013 Free Software Foundation, Inc.
 License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 This is free software: you are free to change and redistribute it.
 There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 and "show warranty" for details.
 This GDB was configured as "x86_64--netbsd".
 For bug reporting instructions, please see:
 <http://www.gnu.org/software/gdb/bugs/>...
 Reading symbols from /usr/bin/vi...done.
 [New process 1]
 
 warning: Can't read pathname for load map: Input/output error.
 Core was generated by `vi'.
 Program terminated with signal 11, Segmentation fault.
 #0  __rec_vpipe (t=0x7f7ff7b02c00, top=4294967295) at 
/archive/foreign/src/lib/libc/db/recno/rec_get.c:186
 186                         sz = t->bt_rdata.size;; *p++ = ch, --sz) {
 (gdb) bt
 #0  __rec_vpipe (t=0x7f7ff7b02c00, top=4294967295) at 
/archive/foreign/src/lib/libc/db/recno/rec_get.c:186
 #1  0x00007f7ff7114470 in __rec_open (fname=0x7f7ff7b47100 "5970_1_atf.html", 
flags=<optimized out>, mode=<optimized out>, openinfo=<optimized out>, 
dflags=<optimized out>)
     at /archive/foreign/src/lib/libc/db/recno/rec_open.c:211
 #2  0x000000000044ed77 in db_init (sp=0x7f7ff7b12000, ep=0x7f7ff7b490e0, 
rcv_name=0x0, oname=0x7f7ff7b47100 "5970_1_atf.html", psize=<optimized out>, 
open_err=0x7f7fffffcdb4)
     at /archive/foreign/src/external/bsd/nvi/dist/common/vi_db1.c:704
 #3  0x0000000000421351 in file_init (sp=0x7f7ff7b12000, frp=0x7f7ff7b190c0, 
rcv_name=0x0, flags=0) at 
/archive/foreign/src/external/bsd/nvi/dist/common/exf.c:262
 #4  0x00000000004273c4 in editor (wp=0x7f7ff7b02400, argc=<optimized out>, 
argv=<optimized out>) at 
/archive/foreign/src/external/bsd/nvi/dist/common/main.c:382
 #5  0x00000000004065d2 in main (argc=2, argv=0x7f7fffffd5e0) at 
/archive/foreign/src/external/bsd/nvi/dist/cl/cl_main.c:129
 (gdb) fr 0
 #0  __rec_vpipe (t=0x7f7ff7b02c00, top=4294967295) at 
/archive/foreign/src/lib/libc/db/recno/rec_get.c:186
 186                         sz = t->bt_rdata.size;; *p++ = ch, --sz) {
 (gdb) l
 181             uint8_t *p;
 182
 183             bval = t->bt_bval;
 184             for (nrec = t->bt_nrecs; nrec < top; ++nrec) {
 185                     for (p = t->bt_rdata.data,
 186                         sz = t->bt_rdata.size;; *p++ = ch, --sz) {
 187                             if ((ch = getc(t->bt_rfp)) == EOF || ch == 
bval) {
 188                                     data.data = t->bt_rdata.data;
 189                                     data.size = p - (uint8_t 
*)t->bt_rdata.data;
 190                                     if (ch == EOF && data.size == 0)
 (gdb) p p
 $1 = (__uint8_t *) 0x7f7ff7c00000 <Address 0x7f7ff7c00000 out of bounds>
 (gdb) p nrec
 $2 = <optimized out>
 (gdb) p t
 $3 = (BTREE *) 0x7f7ff7b02c00
 (gdb) p *t
 $4 = {bt_mp = 0x7f7ff7b4c000, bt_dbp = 0x7f7ff7b1b0c0, bt_cur = {page = 
0x7f7ff7b50030, index = 4}, bt_pinned = 0x0, bt_cursor = {pg = {pgno = 0, index 
= 0}, key = {data = 0x0, size = 0}, rcursor = 0, 
     flags = 0 '\000'}, bt_stack = {{pgno = 0, index = 0} <repeats 50 times>}, 
bt_sp = 0x7f7ff7b02c48, bt_rkey = {data = 0x0, size = 0}, bt_rdata = {data = 
0x7f7ff7b57000, size = 18944}, bt_fd = 4, bt_free = 0, 
   bt_psize = 10240, bt_ovflsize = 5096, bt_lorder = 1234, bt_order = NOT, 
bt_last = {pgno = 0, index = 0}, bt_cmp = 0x7f7ff711ff10 <__bt_defcmp>, bt_pfx 
= 0x7f7ff711ff80 <__bt_defpfx>, 
   bt_irec = 0x7f7ff7114a30 <__rec_vpipe>, bt_rfp = 0x7f7ff7367ec0, bt_rfd = 3, 
bt_cmap = 0x0, bt_smap = 0x0, bt_emap = 0x0, bt_msize = 0, bt_nrecs = 5, 
bt_reclen = 0, bt_bval = 10 '\n', flags = 8422}
 (gdb) p t->bt_rdata 
 $5 = {data = 0x7f7ff7b57000, size = 18944}
 (gdb) p ch
 $6 = 45
 (gdb) p sz
 $7 = <optimized out>
 
  Thomas