pkg/37858: bmake(1) dumps core in lang/sge

[tnn%NetBSD.org@localhost]

>Number:         37858
>Category:       pkg
>Synopsis:       bmake(1) dumps core in lang/sge
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Thu Jan 24 10:05:00 +0000 2008
>Originator:     Tobias Nygren
>Release:        n/a
>Organization:
>Environment:
HP-UX c3k6 B.11.11 U 9000/785 2005683377 unlimited-user license

>Description:
bmake dumps core when parsing pkgsrc/lang/sge/Makefile on HP-UX, but I doubt 
it's really a HP-UX specific issue.

tnn@c3k6:sge> /tmp/pkgsrc-obj/devel/bmake/work.c3k6/HPUX/bmake
Segmentation fault (core dumped)

/opt/langtools/bin/gdb /tmp/pkgsrc-obj/devel/bmake/work.c3k6/HPUX/bmake core
HP gdb 5.4.0 for PA-RISC 1.1 or 2.0 (narrow), HP-UX 11.00
and target hppa1.1-hp-hpux11.00.
Copyright 1986 - 2001 Free Software Foundation, Inc.
Hewlett-Packard Wildebeest 5.4.0 (based on GDB) is covered by the
GNU General Public License. Type "show copying" to see the conditions to
change it and/or distribute copies. Type "show warranty" for warranty/support.
..
Core was generated by `bmake'.
Program terminated with signal 11, Segmentation fault.
SEGV_UNKNOWN - Unknown Error
#0  0xc3998458 in <unknown_procedure> + 0x8 () from /usr/lib/libc.2
#0  0xc3998458 in <unknown_procedure> + 0x8 () from /usr/lib/libc.2
#1  0xc3999494 in <unknown_procedure> + 0x22c () from /usr/lib/libc.2
#2  0xc399c1ac in free+0x30c () from /usr/lib/libc.2
#3  0x28474 in VarModify (ctx=0x40009db8, vpstate=0x7f7f10a4,
    str=0x4005c8d0 "sgeadmin:sgeadmin::Sun\\",
    modProc=0x4000220a <VarRESubstitute>, datum=0x7f7f1074)
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/var.c:1540
#4  0x2ba88 in Var_Parse (str=0x4005d970 "sgeadmin", ctxt=0x40009db8, err=0,
    lengthPtr=0x7f7f0ec0, freePtr=0x7f7f0ec8)
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/var.c:2996
#5  0x2cb54 in Var_Subst (var=0x4005c9a0 "_entry_",
    str=0x4005d15c "${_entry_:C/\\:.*//}\n.    if defined(USERGROUP_PHASE)\n# 
Determine the numeric UID of each 
user.\nUSE_TOOLS+=\tperl\nPKG_UID.${e}_cmd=\t\t\t\t\t\t\t\\\nif ${TEST} ! -x 
${PERL5}; then ${ECHO} \"\"; exit 0; fi;\t\t\\\n${PE"..., ctxt=0x40009db8, 
undefErr=0)
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/var.c:3372
#6  0xe924 in For_Run (lineno=245)
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/for.c:371
#7  0x1f264 in ParseReadLine ()
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/parse.c:2659
#8  0x1f370 in Parse_File (name=0x40001360 "Makefile", stream=0x7b040498)
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/parse.c:2735
#9  0x17f2c in ReadMakefile (p=0x40001360, q=0x0)
#10 0x17674 in main (argc=1, argv=0x7f7f01bc)
    at /tmp/pkgsrc-obj/devel/bmake/work.c3k6/bmake/main.c:967

>How-To-Repeat:
I have found that the following construct is what causes problems:

PKG_USERS= ${SGE_USER}:${SGE_GROUP}::Sun\ Grid\ Engine\ Administrator

Replacing those backslashes with forward slashes makes the parsing succeed. Is 
this a counting and/or buffer overrun problem?

>Fix:
Code inspection?