On Tue, 19 Feb 2008, Cristian Ionescu-Idbohrn wrote:
> Doesn't look that way :( Seems to bail out on this line (see attached
> diff).
>
> eq = strchr(str, '=');
>
> str is pointing to something, but that doesn't seem to be the right
> thing (uninitialized?).
>
> # for B in $VAR;do echo $B;done
> sh: LINE 5907
> sh: LINE 5914: name='VAR=', name_len=4
> sh: LINE 5916
> sh: LINE 5920
> sh: LINE 5923
Yes. Something fishy going on. This is what happens during init
(runlevel 3, init scripts), a few steps before ash segfaults; please
compare the var_str_list and str pointer values:
,----
| + [ N ]
| sh: LINE 5907
| sh: LINE 5914: name='runlevel=', name_len=9
| sh: LINE 5916
| sh: LINE 5920: var_str_list=0x00118404, str=0x001183fc
| sh: LINE 5923
| sh: LINE 5925
| sh: LINE 5943
| sh: LINE 5946
| sh: LINE 5948
| sh: LINE 5950
| sh: LINE 5952
| + echo New runlevel: 3
| New runlevel: 3
| sh: LINE 5907
| sh: LINE 5914: name='runlevel=.d', name_len=9
| sh: LINE 5916
| sh: LINE 5920: var_str_list=0x0011840c, str=0x00118414
| sh: LINE 5923
| sh: LINE 5925
| sh: LINE 5943
| sh: LINE 5946
| sh: LINE 5948
| sh: LINE 5950
| sh: LINE 5952
| + [ -d /etc/rc3.d ]
| sh: LINE 5907
| sh: LINE 5914: name='prevlevel=', name_len=10
| sh: LINE 5916
| sh: LINE 5920: var_str_list=0x0011840c, str=0x00118414
| sh: LINE 5923
| sh: LINE 5925
| sh: LINE 5943
| sh: LINE 5946
| sh: LINE 5948
| sh: LINE 5950
| sh: LINE 5952
| + [ N != N ]
| sh: LINE 5907
| sh: LINE 5914: name='runlevel=.d/S??*', name_len=9
| sh: LINE 5916
| sh: LINE 5920: var_str_list=0x000b5bee, str=0x8feee1fc
| sh: LINE 5923
| rc (pid 75) segfaults for page address 8feee000 at pc 355a06a6
`----
A new shell is started at this point, which also segfaults when I
execute the following:
,----
| # for B in $VAR;do echo $B;done
| sh: LINE 5907
| sh: LINE 5914: name='VAR=', name_len=4
| sh: LINE 5916
| sh: LINE 5920: var_str_list=0x000b81c2, str=0x201892c1
| sh: LINE 5923
| sh (pid 72) segfaults for page address 20188000 at pc 355a06a6
`----
Cheers,
--
Cristian
--- busybox/shell/ash.c 2008-02-19 13:19:32.000000000 +0100
+++ busybox/shell/ash.c 2008-02-19 16:09:21.000000000 +0100
@@ -5904,32 +5904,52 @@
p = num ? shellparam.p[num - 1] : arg0;
goto value;
default:
+ bb_error_msg("LINE %d", __LINE__);
/* NB: name has form "VAR=..." */
/* "A=a B=$A" case: var_str_list is a list of "A=a" strings
* which should be considered before we check variables. */
if (var_str_list) {
unsigned name_len = (strchrnul(name, '=') - name) + 1;
+ bb_error_msg("LINE %d: name='%s', name_len=%u", __LINE__, name, name_len);
p = NULL;
+ bb_error_msg("LINE %d", __LINE__);
do {
+ char *eq;
char *str = var_str_list->text;
- char *eq = strchr(str, '=');
+ bb_error_msg("LINE %d: var_str_list=0x%08x, str=0x%08x", __LINE__, var_str_list, str);
+ if (!str)
+ break;
+ bb_error_msg("LINE %d", __LINE__);
+ eq = strchr(str, '=');
+ bb_error_msg("LINE %d", __LINE__);
if (!eq) /* stop at first non-assignment */
break;
+ bb_error_msg("LINE %d", __LINE__);
eq++;
+ bb_error_msg("LINE %d", __LINE__);
if (name_len == (eq - str)
&& strncmp(str, name, name_len) == 0) {
+ bb_error_msg("LINE %d", __LINE__);
p = eq;
/* goto value; - WRONG! */
/* think "A=1 A=2 B=$A" */
+ bb_error_msg("LINE %d", __LINE__);
}
+ bb_error_msg("LINE %d", __LINE__);
var_str_list = var_str_list->next;
+ bb_error_msg("LINE %d", __LINE__);
} while (var_str_list);
+ bb_error_msg("LINE %d", __LINE__);
if (p)
goto value;
+ bb_error_msg("LINE %d", __LINE__);
}
+ bb_error_msg("LINE %d", __LINE__);
p = lookupvar(name);
+ bb_error_msg("LINE %d", __LINE__);
value:
+ bb_error_msg("LINE %d", __LINE__);
if (!p)
return -1;
_______________________________________________
busybox mailing list
[email protected]
http://busybox.net/cgi-bin/mailman/listinfo/busybox
