Re: [bug-inetutils] ‘ifconfig --help’ segfaults

[Ludovic Courtès]

Hello,

So...

--8<---------------cut here---------------start------------->8---
address@hidden:~/src/inetutils/+build]$ gdb ./ifconfig/ifconfig
GNU gdb (GDB) 7.0.1
Copyright (C) 2009 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /data/src/inetutils/+build/ifconfig/ifconfig...done.
(gdb) r --help
Starting program: /data/src/inetutils/+build/ifconfig/ifconfig --help
Usage: ifconfig [OPTION...]
             NAME [ADDR] [broadcast BRDADDR] [pointopoint|dstaddr DSTADDR]
            [netmask MASK] [metric N] [mtu N] [txqueuelen N] [up|down] [FLAGS]
Configure network interfaces.

  -a, --all                  display all available interfaces
  -A, --address=ADDR         set interface address to ADDR
  -B, -b, --broadcast=ADDR, --brdaddr=ADDR
                             set broadcast address to ADDR
  -d, -p, --dstaddr=ADDR, --peer=ADDR
                             set destination (peer) address to ADDR
      --down                 shut the interface down
      --format=FORMAT        select output format (or set back to default)
  -F, --flags=FLAG[,FLAG...] set interface flags
  -i, --interface=NAME       configure network interface NAME
  -m, --netmask=MASK         set netmask to MASK
      --metric=N             set metric of interface to N
  -M, --mtu=N                set mtu of interface to N
  -s, --short                short output format
      --up                   activate the interface (default if address is
                             given)
  -v, --verbose              output information when configuring interface

 Linux-specific options
  -T, --txqlen=N             set transmit queue length to N

  -?, --help                 give this help list
      --usage                give a short usage message

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff76d00c2 in strlen () from 
/nix/store/4jl83jgzaacf519h3wczgbjvqi91hfk6-glibc-2.11.1/lib/libc.so.6
(gdb) bt full
#0  0x00007ffff76d00c2 in strlen () from 
/nix/store/4jl83jgzaacf519h3wczgbjvqi91hfk6-glibc-2.11.1/lib/libc.so.6
No symbol table info available.
#1  0x000000000040221c in if_list_flags (prefix=0x40dabb "Known flags are: ") 
at ../../ifconfig/flags.c:248
        len = 142
        fp = 0x6135e0
        fnames = <value optimized out>
        i = <value optimized out>
        str = 0x7ffff76c0fc5 "H9\305t\304H\203\370\377u\266\353\274f\017\037D"
        p = <value optimized out>
#2  0x000000000040a7c2 in argp_doc (argp=<value optimized out>, state=<value 
optimized out>, post=1, pre_blank=1, first_only=0, stream=0x6154d0) at 
../../lib/argp-help.c:1554
        text = 0x5500000001 <Address 0x5500000001 out of bounds>
        inp_text = 0x0
        inp_text_len = <value optimized out>
        trans_text = 0x0
        input = 0x7fffffffc6f0
        anything = 0
        child = 0x614700
#3  0x000000000040a8e2 in argp_doc (argp=<value optimized out>, state=<value 
optimized out>, post=1, pre_blank=1, first_only=0, stream=0x6154d0) at 
../../lib/argp-help.c:1571
        text = <value optimized out>
        inp_text = 0x1 <Address 0x1 out of bounds>
        inp_text_len = <value optimized out>
        trans_text = 0x0
        input = 0x0
        anything = 0
        child = 0x7fffffffc4e0
#4  0x000000000040b350 in _help (argp=<value optimized out>, state=<value 
optimized out>, stream=<value optimized out>, flags=21, name=<value optimized 
out>) at ../../lib/argp-help.c:1701
        anything = 1
        hol = <value optimized out>
        fs = 0x6154d0
#5  0x000000000040be77 in argp_state_help (state=0x7fffffffc600, stream=<value 
optimized out>, flags=634) at ../../lib/argp-help.c:1765
No locals.
#6  0x00000000004074bb in argp_default_parser (key=<value optimized out>, 
arg=0x0, state=0x7fffffffc600) at ../../lib/argp-parse.c:95
No locals.
#7  0x00000000004072ff in group_parse (group=0x6150a0, state=0x7fffffffc600, 
key=0, arg=0x5500000001 <Address 0x5500000001 out of bounds>) at 
../../lib/argp-parse.c:232
        err = <value optimized out>
#8  0x00000000004080f8 in parser_parse_opt (argp=<value optimized out>, 
argc=<value optimized out>, argv=<value optimized out>, flags=<value optimized 
out>, end_index=<value optimized out>,
    input=<value optimized out>) at ../../lib/argp-parse.c:744
No locals.
#9  parser_parse_next (argp=<value optimized out>, argc=<value optimized out>, 
argv=<value optimized out>, flags=<value optimized out>, end_index=<value 
optimized out>, input=<value optimized out>)
    at ../../lib/argp-parse.c:855
        opt = 50331711
#10 argp_parse (argp=<value optimized out>, argc=<value optimized out>, 
argv=<value optimized out>, flags=<value optimized out>, end_index=<value 
optimized out>, input=<value optimized out>)
    at ../../lib/argp-parse.c:923
        err = 7
        parser = {argp = 0x7fffffffc470, short_opts = 0x615478 
"-vai:A:m:d:p:B:b:M:F:sT:?V", long_opts = 0x615198, opt_data = {rpl_optind = 2, 
rpl_opterr = 1, rpl_optopt = -1, rpl_optarg = 0x0,
            __initialized = 1, __nextchar = 0x7fffffffcbca "", __ordering = 
RETURN_IN_ORDER, __posixly_correct = 0, __first_nonopt = 1, __last_nonopt = 1}, 
groups = 0x615010, egroup = 0x615130,
          child_inputs = 0x615178, try_getopt = 1, state = {root_argp = 
0x7fffffffc470, argc = 2, argv = 0x7fffffffc828, next = 2, flags = 8, arg_num = 
0, quoted = 0, input = 0x0, child_inputs = 0x0,
            hook = 0x0, name = 0x7fffffffcbbb "ifconfig", err_stream = 
0x7ffff79aa860, out_stream = 0x7ffff79aa780, pstate = 0x7fffffffc590}, storage 
= 0x615010}
#11 0x0000000000403044 in parse_cmdline (argc=2, argv=0x7fffffffc828) at 
../../ifconfig/options.c:587
        index = <value optimized out>
        ifp = 0x0
#12 0x0000000000401e39 in main (argc=0, argv=0x0) at 
../../ifconfig/ifconfig.c:63
        err = <value optimized out>
        sfd = <value optimized out>
        ifp = <value optimized out>
(gdb) frame 1
#1  0x000000000040221c in if_list_flags (prefix=0x40dabb "Known flags are: ") 
at ../../ifconfig/flags.c:248
248             len += strlen (fp->name) + 1;
(gdb) p fp->name
$1 = 0x5500000001 <Address 0x5500000001 out of bounds>
--8<---------------cut here---------------end--------------->8---

And the patch:

2010-03-09  Ludovic Courtès  <address@hidden>

        * ifconfig/flags.c (if_flags): Add trailing entry with NULL `name'.

diff --git a/ifconfig/flags.c b/ifconfig/flags.c
index 05371b2..60c5a7c 100644
--- a/ifconfig/flags.c
+++ b/ifconfig/flags.c
@@ -224,6 +224,7 @@ struct if_flag
 #ifdef IFF_D2                  /* Flag is specific to device.  */
     {"D2", IFF_D2},
 #endif
+    { NULL, 0 }
   };
 
 static int

Thanks,
Ludo’.

pgpbiqYtg6nH2.pgp
Description: PGP signature