bug#3772: 23.0.95; Segmentation fault: ffap/image/C-x d

bug#3772: 23.0.95; Segmentation fault: ffap/image/C-x d

[jidanni]

1. Pick a large (16KB) .JPG from
http://jidanni.org/geo/taipower/images/ , e.g,.
$ cd /tmp && wget \
http://jidanni/jidanni.org/geo/taipower/images/19990716ab67wow.jpg
$ emacs-snapshot -Q /tmp/19990716ab67wow.jpg
M-x ffap-bindings
C-x d
Segfault... running again:
(gdb) run -Q /tmp/19990716ab67wow.jpg
Program received signal SIGSEGV, Segmentation fault.
0xb755b6b8 in bcopy () from /lib/i686/cmov/libc.so.6
>please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
(gdb) bt full
#0  0xb755b6b8 in bcopy () from /lib/i686/cmov/libc.so.6
#1  0x08170638 in ?? ()
No symbol table info available...
(gdb) xbacktrace
Undefined command: "xbacktrace".  Try "help".

In GNU Emacs 23.0.95.1 (i486-pc-linux-gnu, GTK+ Version 2.16.4)
 of 2009-07-04 on elegiac, modified by Debian
 (emacs-snapshot package, version 1:20090703-1)
Celeron(R) CPU 2.60GHz

bug#3772: marked as done (23.0.95; Segmentation fault: ffap/image/C-x d)

[Emacs bug Tracking System]

[-- Attachment #1: Type: text/plain, Size: 882 bytes --]


Your message dated Tue, 07 Jul 2009 18:29:09 -0400
with message-id <8763e4rutm.fsf@stupidchicken.com>
and subject line Re: 23.0.95; Segmentation fault: ffap/image/C-x d
has caused the Emacs bug report #3772,
regarding 23.0.95; Segmentation fault: ffap/image/C-x d
to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact owner@emacsbugs.donarmstrong.com
immediately.)


-- 
3772: http://emacsbugs.donarmstrong.com/cgi-bin/bugreport.cgi?bug=3772
Emacs Bug Tracking System
Contact owner@emacsbugs.donarmstrong.com with problems

[-- Attachment #2: Type: message/rfc822, Size: 2884 bytes --]

From: jidanni@jidanni.org
To: emacs-pretest-bug@gnu.org
Cc: rfrancoise@debian.org
Subject: 23.0.95; Segmentation fault: ffap/image/C-x d
Date: Tue, 07 Jul 2009 07:37:05 +0800
Message-ID: <87vdm55qou.fsf@jidanni.org>

1. Pick a large (16KB) .JPG from
http://jidanni.org/geo/taipower/images/ , e.g,.
$ cd /tmp && wget \
http://jidanni/jidanni.org/geo/taipower/images/19990716ab67wow.jpg
$ emacs-snapshot -Q /tmp/19990716ab67wow.jpg
M-x ffap-bindings
C-x d
Segfault... running again:
(gdb) run -Q /tmp/19990716ab67wow.jpg
Program received signal SIGSEGV, Segmentation fault.
0xb755b6b8 in bcopy () from /lib/i686/cmov/libc.so.6
>please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
(gdb) bt full
#0  0xb755b6b8 in bcopy () from /lib/i686/cmov/libc.so.6
#1  0x08170638 in ?? ()
No symbol table info available...
(gdb) xbacktrace
Undefined command: "xbacktrace".  Try "help".

In GNU Emacs 23.0.95.1 (i486-pc-linux-gnu, GTK+ Version 2.16.4)
 of 2009-07-04 on elegiac, modified by Debian
 (emacs-snapshot package, version 1:20090703-1)
Celeron(R) CPU 2.60GHz


[-- Attachment #3: Type: message/rfc822, Size: 2085 bytes --]

From: Chong Yidong <cyd@stupidchicken.com>
To: Jason Rumney  <jasonr@gnu.org>
Cc: jidanni@jidanni.org, 3772-done@emacsbugs.donarmstrong.com
Subject: Re: 23.0.95; Segmentation fault: ffap/image/C-x d
Date: Tue, 07 Jul 2009 18:29:09 -0400
Message-ID: <8763e4rutm.fsf@stupidchicken.com>

> I can reproduce this.  From bisecting prior revisions, I think the
> problem first appeared with this change:
>
> 2009-03-24  Jason Rumney  <jasonr@gnu.org>
>
> 	* fileio.c (Fsubstitute_in_file_name): Always work on a copy.
> 	Calculate total size precisely.  Decode environment variables
> 	before substituting.  (Bug#38)

OK, I found the problem.  The way the string data was copied was
incorrect:

  nm = SDATA (filename);
  nm = strcpy (alloca (strlen (nm) + 1), nm);

This should have been

  nm = (unsigned char *) alloca (SBYTES (filename) + 1);
  bcopy (SDATA (filename), nm, SBYTES (filename) + 1);

I've checked a fix into CVS.