[Bug libc/19580] New: argp: segfault in --help formatting code

["simon at keinstein dot org" <sourceware-bugzilla at sourceware dot org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=19580

            Bug ID: 19580
           Summary: argp: segfault in --help formatting code
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: simon at keinstein dot org
                CC: drepper.fsp at gmail dot com
  Target Milestone: ---

Created attachment 8964
  --> https://sourceware.org/bugzilla/attachment.cgi?id=8964&action=edit
sample program

The following program segfaults when run with argument '--help':

#include <argp.h>

static struct argp_option options[] = {
  {"x", 'x', 0, 0,
"uuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu
                                             "},
  {0}
};

static struct argp argp = {options};

int
main (int argc, char **argv)
{
  argp_parse(&argp, argc, argv, 0, 0, 0);
  return 0;
}


Backtrace in gdb:
(gdb) run --help
Starting program: /home/simon/c/argp-wmargin --help
Usage: argp-wmargin [OPTION...]

  -x, --x

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff77bb258 in _wordcopy_bwd_dest_aligned (dstp=6291432,
dstp@entry=6296216, srcp=6291472, srcp@entry=6296265, 
    len=2305843009213693352, len@entry=2305843009213693947) at wordcopy.c:398
398     wordcopy.c: Datei oder Verzeichnis nicht gefunden.
(gdb) bt
#0  0x00007ffff77bb258 in _wordcopy_bwd_dest_aligned (dstp=6291432,
dstp@entry=6296216, srcp=6291472, srcp@entry=6296265, 
    len=2305843009213693352, len@entry=2305843009213693947) at wordcopy.c:398
#1  0x00007ffff77b55f6 in __memmove_sse2 (dest=dest@entry=0x6012ba,
src=src@entry=0x6012eb, len=18446744073709551582, 
    len@entry=18446744073709551583) at ../string/memmove.c:106
#2  0x00007ffff781fb86 in __argp_fmtstream_update (fs=fs@entry=0x6011e0) at
argp-fmtstream.c:319
#3  0x00007ffff7822fce in __argp_fmtstream_set_lmargin (__lmargin=0,
__fs=0x6011e0) at argp-fmtstream.h:244
#4  hol_entry_help (hhstate=0x7fffffffd7a0, stream=0x6011e0,
state=0x7fffffffda20, entry=0x6014b0) at argp-help.c:1188
#5  hol_help (hol=0x601300, hol=0x601300, stream=0x6011e0,
state=0x7fffffffda20) at argp-help.c:1209                       
#6  _help (argp=0x7fffffffd860, state=state@entry=0x7fffffffda20,
stream=0x7ffff7ad62a0 <_IO_2_1_stdout_>, 
    flags=flags@entry=634, name=<optimized out>) at argp-help.c:1657
#7  0x00007ffff782327a in __argp_state_help (state=state@entry=0x7fffffffda20,
stream=<optimized out>, 
    flags=flags@entry=634) at argp-help.c:1733
#8  0x00007ffff78234fa in argp_default_parser (key=<optimized out>, arg=0x0,
state=0x7fffffffda20) at argp-parse.c:116
#9  0x00007ffff782426e in group_parse (arg=<optimized out>, key=33554495,
state=0x7fffffffda20, group=0x601058)
    at argp-parse.c:257
#10 parser_parse_opt (val=<optimized out>, opt=33554495, parser=0x7fffffffd9b0)
at argp-parse.c:755
#11 parser_parse_next (arg_ebadkey=<synthetic pointer>, parser=0x7fffffffd9b0)
at argp-parse.c:867
#12 __argp_parse (argp=<optimized out>, argc=2, argv=<optimized out>,
flags=<optimized out>, end_index=0x0, input=0x0)
    at argp-parse.c:921
#13 0x00000000004005d9 in main (argc=2, argv=0x7fffffffdbc8) at
argp-wmargin.c:21

-- 
You are receiving this mail because:
You are on the CC list for the bug.