https://bugzilla.novell.com/show_bug.cgi?id=636794
https://bugzilla.novell.com/show_bug.cgi?id=636794#c0 Summary: Crash in mono runtime Classification: Mono Product: Mono: Runtime Version: 2.6.x Platform: x86 OS/Version: Ubuntu Status: NEW Severity: Normal Priority: P5 - None Component: misc AssignedTo: [email protected] ReportedBy: [email protected] QAContact: [email protected] Found By: --- Blocker: --- Created an attachment (id=387299) --> (http://bugzilla.novell.com/attachment.cgi?id=387299) exploit input User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.8) Gecko/2009033100 Ubuntu/9.04 (jaunty) Firefox/3.0.8 Mono runtime crashes even with security manager turned on. Reproducible: Always Steps to Reproduce: mono-2.6.7/inst/bin/mono exploit_0_0 OR mono-2.6.7/inst/bin/mono --security=validil exploit_0_0 Actual Results: Stacktrace: Native stacktrace: ../branches/separate-analysis/mono-2.6.7/inst/bin/mono [0x80dac8b] ../branches/separate-analysis/mono-2.6.7/inst/bin/mono [0x8115fbb] [0xb7f04410] ../branches/separate-analysis/mono-2.6.7/inst/bin/mono(mono_main+0x19a5) [0x80b8e65] ../branches/separate-analysis/mono-2.6.7/inst/bin/mono [0x805bb51] /lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5) [0xb7c8e775] ../branches/separate-analysis/mono-2.6.7/inst/bin/mono [0x805ba81] Debug info from gdb: Cannot access memory at address 0x0 [Thread debugging using libthread_db enabled] [New Thread 0xb7c446f0 (LWP 24401)] [New Thread 0xb6cf5b90 (LWP 24404)] [New Thread 0xb6d26b90 (LWP 24403)] [New Thread 0xb7b07b90 (LWP 24402)] 0xb7f04430 in __kernel_vsyscall () 4 Thread 0xb7b07b90 (LWP 24402) 0xb7f04430 in __kernel_vsyscall () 3 Thread 0xb6d26b90 (LWP 24403) 0xb7f04430 in __kernel_vsyscall () 2 Thread 0xb6cf5b90 (LWP 24404) 0xb7f04430 in __kernel_vsyscall () 1 Thread 0xb7c446f0 (LWP 24401) 0xb7f04430 in __kernel_vsyscall () Thread 4 (Thread 0xb7b07b90 (LWP 24402)): #0 0xb7f04430 in __kernel_vsyscall () #1 0xb7e0b0e5 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/tls/i686/cmov/libpthread.so.0 #2 0x0820a461 in GC_wait_marker () at pthread_support.c:1785 #3 0x0820d23f in GC_help_marker (my_mark_no=2) at mark.c:1116 #4 0x08209245 in GC_mark_thread (id=0x0) at pthread_support.c:548 #5 0xb7e074ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 #6 0xb7d5c49e in clone () from /lib/tls/i686/cmov/libc.so.6 Thread 3 (Thread 0xb6d26b90 (LWP 24403)): #0 0xb7f04430 in __kernel_vsyscall () #1 0xb7e0e8f6 in nanosleep () from /lib/tls/i686/cmov/libpthread.so.0 #2 0x081e18d8 in collection_thread (unused=0x0) at collection.c:34 #3 0xb7e074ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 #4 0xb7d5c49e in clone () from /lib/tls/i686/cmov/libc.so.6 Thread 2 (Thread 0xb6cf5b90 (LWP 24404)): #0 0xb7f04430 in __kernel_vsyscall () #1 0xb7e0d3f5 in sem_wait@@GLIBC_2.1 () from /lib/tls/i686/cmov/libpthread.so.0 #2 0x081f8e48 in mono_sem_wait (sem=0x82d8124, alertable=0) at mono-semaphore.c:102 #3 0x0811c2a8 in finalizer_thread (unused=0x0) at gc.c:1022 #4 0x081529b7 in start_wrapper (data=0x870c698) at threads.c:666 #5 0x081ebade in thread_start_routine (args=0x870f694) at wthreads.c:286 #6 0x0820a0f3 in GC_start_routine (arg=0x35f20) at pthread_support.c:1390 #7 0xb7e074ff in start_thread () from /lib/tls/i686/cmov/libpthread.so.0 #8 0xb7d5c49e in clone () from /lib/tls/i686/cmov/libc.so.6 Thread 1 (Thread 0xb7c446f0 (LWP 24401)): #0 0xb7f04430 in __kernel_vsyscall () #1 0xb7e0e0fb in read () from /lib/tls/i686/cmov/libpthread.so.0 #2 0x080dae59 in mono_handle_native_sigsegv (signal=11, ctx=0xb7306d0c) at /usr/include/bits/unistd.h:45 #3 0x08115fbb in mono_arch_handle_altstack_exception (sigctx=0xb7306d0c, fault_addr=0x4, stack_ovf=0) at exceptions-x86.c:1287 #4 <signal handler called> #5 0x0819d809 in mono_runtime_run_main (method=0x86fb224, argc=1, argv=0xbfc1fc2c, exc=0x0) at object.c:3339 #6 0x080b8e65 in mono_main (argc=3, argv=0xbfc1fc24) at driver.c:999 #7 0x0805bb51 in main (argc=) at main.c:34 #0 0xb7f04430 in __kernel_vsyscall () ================================================================= Got a SIGSEGV while executing native code. This usually indicates a fatal error in the mono runtime or one of the native libraries used by your application. ================================================================= Aborted Expected Results: No crash -- Configure bugmail: https://bugzilla.novell.com/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the QA contact for the bug. You are the assignee for the bug. _______________________________________________ mono-bugs maillist - [email protected] http://lists.ximian.com/mailman/listinfo/mono-bugs
