Hi,
I'm trying to run cgit on 5.0 GENERIC#53 amd64 on a VIA Nano U2250 (Dell
XS11-VX8). But I get segfaults right at the start.
I've tried both the binary package (cgit-0.8.3.5p1 from
ftp.fr.openbsd.org) and one built from ports (same from OPENBSD_5_0 on
anoncvs.fr.openbsd.org).
In both cases, it segfaults in trim_end() (line 114 [0]: t[len] = '\0';)
called from main() (line 686 [1]; both according to gdb*). This bit of
code tries to trim the path after the last '/' in argv[0], whitc never
seems to have one even when manually called from a different directory
(e.g. ./cgi-bin/cgit.cgi).
What is odd is that in trim_end(), at the previous line also references
t[len] (c = t[len];), but doesn't fail there. c then changes to '\0'
(and gdb says it's "not available"), supposedly at line 113, then the
segfault occurs. len is 8, which is the length of str ("cgit.cgi").
However, there is some possibly dirty things happening as *t is a
pointer equals to trim_end's argument const char *str. Could this be
some protection forbidding functions to modifiy anything in the memory
passed as const?
Did anybody notice anything similar? Any idea on how to fix it or
investigate it further?
[0]
http://hjemli.net/git/cgit/tree/shared.c?id=9e849950dc7c1f2fb6ffa62ab65bd30f35717d13#n114
[1]
http://hjemli.net/git/cgit/tree/cgit.c?id=9e849950dc7c1f2fb6ffa62ab65bd30f35717d13#n686
* Starting program: /srv/www/cgi-bin/cgit.cgi
Program received signal SIGSEGV, Segmentation fault.
[Switching to process 28106, thread 0x203488800]
trim_end (str=0x56bc08 "cgit.cgi", c=0 '\0') at shared.c:114
114 t[len] = '\0';
(gdb) bt
#0 trim_end (str=0x56bc08 "cgit.cgi", c=0 '\0') at shared.c:114
#1 0x0000000000404f76 in main (argc=1, argv=0x7f7ffffc5800) at cgit.c:686
--
Olivier Mehani <[email protected]>
PGP fingerprint: 4435 CF6A 7C8D DD9B E2DE F5F9 F012 A6E2 98C6 6655
