Your message dated Sat, 21 Dec 2019 23:56:06 +0100
with message-id <[email protected]>
and subject line Re: Bug#909082: gpsd-clients: gpxlogger error free(): invalid
next size (fast)
has caused the Debian Bug report #909082,
regarding gpsd-clients: gpxlogger error free(): invalid next size (fast)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
909082: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=909082
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: gpsd-clients
Version: 3.16-4
Severity: normal
Tags: upstream
Dear Maintainer,
It seems that gpxlogger has a problem parsing the -f option. In
some circumstance it fails with an error:
gpxlogger -f /GPX/trk.gpx
*** Error in `gpxlogger': free(): invalid next size (fast): 0x01b81028 ***
Aborted
It seems that just changing a bit the /path/filename can avoid
the bug, this command works just fine:
gpxlogger -f /GPXX/trk.gpx
gpxlogger uses the strftime() to compose the filename, also in this
case there are working examples and error examples:
gpxlogger -f /GPX/trk_%Y%m%d%H%M%S.gpx
# This is ok
gpxlogger -f /GPX/trk_%Y%m%d_%H%M%S.gpx
*** Error in `gpxlogger': free(): invalid next size (fast): 0x017ef028 ***
Aborted
-- System Information:
Distributor ID: Raspbian
Description: Raspbian GNU/Linux 9.4 (stretch)
Release: 9.4
Codename: stretch
Architecture: armv7l
Kernel: Linux 4.14.62-v7+ (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages gpsd-clients depends on:
ii libbluetooth3 5.43-2+rpt2+deb9u2
ii libc6 2.24-11+deb9u3
ii libdbus-1-3 1.10.26-0+deb9u1
ii libgps22 3.16-4
ii libncurses5 6.0+20161126-1+deb9u2
ii libtinfo5 6.0+20161126-1+deb9u2
ii libusb-1.0-0 2:1.0.21-1
ii python-cairo 1.8.8-2.2
ii python-gps 3.16-4
ii python-gtk2 2.24.0-5.1
gpsd-clients recommends no packages.
Versions of packages gpsd-clients suggests:
ii gpsd 3.16-4
-- no debconf information
--- End Message ---
--- Begin Message ---
Version: 3.18.1-1
Hi,
thanks for the patch, it is shipped since 3.18.
Best regards,
Bernd
On 9/18/18 4:40 PM, Bernhard Übelacker wrote:
> Hello all,
> just tried to and could reproduce this crash on a Raspbian.
>
> But because of the lack of debug symbols in Raspbian (or the
> lack of knowledge where to find them) I tried a i386 Buster VM,
> but there was no crash visible.
>
> But a valgrind run shows following:
>
>
> valgrind gpxlogger -f /GPX/trk.gpx
> ==16014== Memcheck, a memory error detector
> ==16014== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
> ==16014== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
> ==16014== Command: gpxlogger -f /GPX/trk.gpx
> ==16014==
> ==16014== Invalid write of size 1
> ==16014== at 0x4A88620: __strftime_internal (strftime_l.c:1433)
> ==16014== by 0x4A8A6B1: strftime_l (strftime_l.c:460)
> ==16014== by 0x4A8851A: strftime (strftime.c:25)
> ==16014== by 0x109A1A: main (gpxlogger.c:248)
> ==16014== Address 0x4da0084 is 0 bytes after a block of size 12 alloc'd
> ==16014== at 0x483356B: malloc (vg_replace_malloc.c:298)
> ==16014== by 0x483582C: realloc (vg_replace_malloc.c:785)
> ==16014== by 0x1099E6: main (gpxlogger.c:240)
> ==16014==
>
>
> To the strftime function is a buffer given for which is memory
> allocated in the size of the parameter "/GPX/trk.gpx" on the command line.
>
> Also the strftime function takes a parameter fnamesize-1 for this memory.
>
> If the buffer size is too small strftime returns 0
> and the allocated buffer size should be increased.
>
> Unfortunately this size parameter is increased before the strftime call.
> Therefore we have just 12 bytes allocated
> but tell strftime it is allowed to write to 1035 bytes.
>
> Attached patch tries to move this addition below the strftime call.
>
> Kind regards,
> Bernhard
>
--
Bernd Zeimetz Debian GNU/Linux Developer
http://bzed.de http://www.debian.org
GPG Fingerprint: ECA1 E3F2 8E11 2432 D485 DD95 EB36 171A 6FF9 435F
--- End Message ---
