Hi!

----

Below are three valgrind hits which likely indicate serious bugs. I
don't have time to go into the details now so I'm shoving this as-is
on the list.

Steps to reproduce
-- snip --
1. Build ksh93 with some hacks to make life easier for "valgrind":
$ (CCFLAGS='-g' CC='gcc -std=gnu99 -D_AST_std_malloc=1 -DSHOPT_SYSRC
-D_map_libc=1 -g' ./bin/package ^Cke) 2>&1 | tee -a buildlog.log
2. Run valgrind:
$ (SHELL=$PWD/arch/linux.i386-64/bin/ksh ; LC_ALL=en_US.UTF-8
LANG=en_US.UTF-8 VMALLOC_OPTIONS="abort" valgrind --track-origins=yes
--read-var-info=yes $SHELL src/cmd/ksh93/tests/functions.sh)
-- snip --

Issue No. 1:
-- snip --
==7385== For counts of detected and suppressed errors, rerun with: -v
==7385== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 6 from 6)
==7349== Warning: invalid file descriptor 32767 in syscall close()
==7349== Invalid read of size 1
==7349==    at 0x44766F: memmove (name.c:1566)
==7349==    by 0x448776: nv_putval (name.c:1959)
==7349==    by 0x4091FC: nv_putv (nvdisc.c:156)
==7349==    by 0x422ADD: put_restricted (init.c:350)
==7349==    by 0x4091D6: nv_putv (nvdisc.c:151)
==7349==    by 0x4477C8: nv_putval (name.c:1603)
==7349==    by 0x4497D9: table_unset (name.c:2423)
==7349==    by 0x44C5A8: sh_unscope (name.c:3507)
==7349==    by 0x4716A4: sh_ntfork (xec.c:4009)
==7349==    by 0x469F38: sh_exec (xec.c:1667)
==7349==    by 0x462533: sh_subshell (subshell.c:583)
==7349==    by 0x440F71: comsubst (macro.c:2126)
==7349==  Address 0x566ee46 is 150 bytes inside a block of size 159 free'd
==7349==    at 0x4C298B2: realloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7349==    by 0x504547: _ast_realloc (malloc.c:1041)
==7349==    by 0x4486C5: nv_putval (name.c:1942)
==7349==    by 0x4091FC: nv_putv (nvdisc.c:156)
==7349==    by 0x422ADD: put_restricted (init.c:350)
==7349==    by 0x4091D6: nv_putv (nvdisc.c:151)
==7349==    by 0x4477C8: nv_putval (name.c:1603)
==7349==    by 0x4497D9: table_unset (name.c:2423)
==7349==    by 0x44C5A8: sh_unscope (name.c:3507)
==7349==    by 0x4716A4: sh_ntfork (xec.c:4009)
==7349==    by 0x469F38: sh_exec (xec.c:1667)
==7349==    by 0x462533: sh_subshell (subshell.c:583)
-- snip --




Issue No. 2:
-- snip --
==7349== Invalid read of size 8
==7349==    at 0x449E9C: sh_scoped (name.c:2584)
==7349==    by 0x46FF68: sh_funscope (xec.c:3431)
==7349==    by 0x4703A9: sh_funct (xec.c:3496)
==7349==    by 0x469881: sh_exec (xec.c:1533)
==7349==    by 0x466032: sh_eval (xec.c:592)
==7349==    by 0x41F491: sh_trap (fault.c:475)
==7349==    by 0x465C57: sh_debug (xec.c:526)
==7349==    by 0x4683CC: sh_exec (xec.c:1224)
==7349==    by 0x46B95A: sh_exec (xec.c:2181)
==7349==    by 0x46FD37: sh_funscope (xec.c:3409)
==7349==    by 0x4703A9: sh_funct (xec.c:3496)
==7349==    by 0x469881: sh_exec (xec.c:1533)
==7349==  Address 0x5c312c0 is 48 bytes inside a block of size 80 free'd
==7349==    at 0x4C2892E: free (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7349==    by 0x5044E3: _ast_free (malloc.c:1036)
==7349==    by 0x4DD3CD: dtclose (dtclose.c:60)
==7349==    by 0x44C5FF: sh_unscope (name.c:3514)
==7349==    by 0x46FE38: sh_funscope (xec.c:3418)
==7349==    by 0x4703A9: sh_funct (xec.c:3496)
==7349==    by 0x469881: sh_exec (xec.c:1533)
==7349==    by 0x466032: sh_eval (xec.c:592)
==7349==    by 0x41F491: sh_trap (fault.c:475)
==7349==    by 0x465C57: sh_debug (xec.c:526)
==7349==    by 0x4683CC: sh_exec (xec.c:1224)
==7349==    by 0x46B95A: sh_exec (xec.c:2181)
-- snip --

Issue No. 3:
-- snip --
==7349== Invalid read of size 1
==7349==    at 0x4BB43C: memmove (stk.c:497)
==7349==    by 0x4BB64E: stkgrow (stk.c:543)
==7349==    by 0x4BB153: _stkseek (stk.c:415)
==7349==    by 0x4D50F4: vecseek (regnexec.c:177)
==7349==    by 0x4D5393: pospush (regnexec.c:284)
==7349==    by 0x4D878D: parse (regnexec.c:1206)
==7349==    by 0x4D7611: parse (regnexec.c:975)
==7349==    by 0x4D86BB: parse (regnexec.c:1192)
==7349==    by 0x4D58A3: parserep (regnexec.c:446)
==7349==    by 0x4DACA9: parse (regnexec.c:1698)
==7349==    by 0x4D8812: parse (regnexec.c:1209)
==7349==    by 0x4D7611: parse (regnexec.c:975)
==7349==  Address 0x5ce2367 is 7 bytes after a block of size 512 free'd
==7349==    at 0x4C298B2: realloc (in
/usr/lib64/valgrind/vgpreload_memcheck-amd64-linux.so)
==7349==    by 0x504547: _ast_realloc (malloc.c:1041)
==7349==    by 0x4BB565: stkgrow (stk.c:523)
==7349==    by 0x4BB153: _stkseek (stk.c:415)
==7349==    by 0x4D50F4: vecseek (regnexec.c:177)
==7349==    by 0x4D5393: pospush (regnexec.c:284)
==7349==    by 0x4D878D: parse (regnexec.c:1206)
==7349==    by 0x4D7611: parse (regnexec.c:975)
==7349==    by 0x4D86BB: parse (regnexec.c:1192)
==7349==    by 0x4D58A3: parserep (regnexec.c:446)
==7349==    by 0x4DACA9: parse (regnexec.c:1698)
==7349==    by 0x4D8812: parse (regnexec.c:1209)
-- snip --

----

Bye,
Roland

-- 
  __ .  . __
 (o.\ \/ /.o) [email protected]
  \__\/\/__/  MPEG specialist, C&&JAVA&&Sun&&Unix programmer
  /O /==\ O\  TEL +49 641 3992797
 (;O/ \/ \O;)

_______________________________________________
ast-developers mailing list
[email protected]
https://mailman.research.att.com/mailman/listinfo/ast-developers

Reply via email to