Re: [bug-ncurses] Invalid pointer in munmap_chunk

[Dr. Werner Fink]

On Fri, Mar 22, 2019 at 08:40:29AM +0100, Dr. Werner Fink wrote:
> Hi,
> 
> I've get an report about this error from the container people here
> and verfied this in a chroot environment:
> 
>     noether:/ # rpm -e terminfo-base --nodeps
>     noether:/ # TERM=xterm
>     noether:/ # TERM=dumb 
>     noether:/ # export TERM=dumb
>     noether:/ # export TERM=xterm
>     munmap_chunk(): invalid pointer
>     Aborted (core dumped)
> 
>     noether:~ # coredumpctl  | tail -n 1
>     Fri 2019-03-22 08:20:00 CET   15852     0     0   6 present   
> /openSUSE_Factory/usr/bin/bash
> 
>     noether:~ # coredumpctl dump 15852 > /openSUSE_Factory/tmp/core 
>     noether:~ # chroot /abuild/oscbuild/openSUSE_Factory
>     noether:/ # gdb /bin/bash /tmp/core
>     GNU gdb (GDB; openSUSE Tumbleweed) 8.2
>     [...]
>     #0  0x00007fe8960d5d8b in raise () from /lib64/libc.so.6
>     (gdb) bt
>     #0  0x00007fe8960d5d8b in raise () from /lib64/libc.so.6
>     #1  0x00007fe8960bf612 in abort () from /lib64/libc.so.6
>     #2  0x00007fe896118287 in __libc_message () from /lib64/libc.so.6
>     #3  0x00007fe89611ea4c in malloc_printerr () from /lib64/libc.so.6
>     #4  0x00007fe89611ed14 in munmap_chunk () from /lib64/libc.so.6
>     #5  0x00007fe89607605c in really_free_termtype (ptr=0x565285d45ed0, 
> freeStrings=<optimized out>) at ../ncurses/./tinfo/free_ttype.c:55
>     #6  0x00007fe8960760ea in _nc_free_termtype2 (ptr=<optimized out>) at 
> ../ncurses/./tinfo/free_ttype.c:81
>     #7  0x00007fe896076b4f in del_curterm_sp (address@hidden, address@hidden) 
> at ../ncurses/./tinfo/lib_cur_term.c:150
>     #8  0x00007fe896079b3e in tgetent_sp (sp=0x0, bufp=0x565285d1b160 "", 
> name=<optimized out>) at ../ncurses/./tinfo/lib_termcap.c:135
>     #9  0x00007fe8962995cc in _rl_init_terminal_io () from 
> /lib64/libreadline.so.8
>     #10 0x00007fe8962999e3 in rl_reset_terminal () from 
> /lib64/libreadline.so.8
>     #11 0x00005652857a46bb in ?? ()
>     #12 0x00005652857d948a in do_assignment_no_expand ()
>     #13 0x00005652857bd57c in export_builtin ()
>     #14 0x0000565285784a20 in ?? ()
>     #15 0x0000565285782632 in execute_command ()
>     #16 0x0000565285734961 in ?? ()
>     #17 0x0000565285772995 in main ()
> 
> 
> as I always have some terminfo added to the builtin fallback database
> unknown, dumb, xterm, linux, vt100, vt102, and vt220
> I wonder why this happens

Maybe something like this

--- ncurses-6.1/ncurses/tinfo/lib_setup.c
+++ ncurses-6.1/ncurses/tinfo/lib_setup.c       2019-03-22 08:46:01.634603415 
+0000
@@ -761,7 +761,11 @@ TINFO_SETUP_TERM(TERMINAL **tp,
 
            if (fallback) {
                T(("found fallback entry"));
-               TerminalType(termp) = *fallback;
+#if NCURSES_EXT_NUMBERS
+               _nc_copy_termtype2(&(TerminalType(termp)),fallback);
+#else
+               _nc_copy_termtype(&(TerminalType(termp)),fallback);
+#endif
                status = TGETENT_YES;
            }
        }

could avoid this. At least it does not crash here anymore ;)

-- 
  "Having a smoking section in a restaurant is like having
          a peeing section in a swimming pool." -- Edward Burr

signature.asc
Description: PGP signature