SIGSEGV in _IO_old_file_overflow

[mikeg@weiden.de]

>Submitter-Id:	net
>Originator:	Michael L. Galbraith
>Organization:
 
>Confidential:	no
>Synopsis:	
>Severity:	
>Priority:	
>Category:	libc
>Class:		
>Release:	libc-2.0.96
>Environment:
	
Host type: i486-pc-linux-gnu
System: Linux mikeg 2.1.122 #3 Fri Sep 25 15:51:50 CEST 1998 i586 unknown
Architecture: i586

Addons: crypt linuxthreads
Build CFLAGS: -O2 -mcpu=pentium -march=pentium
Build CC: egcs-2.91.54 NOTE: also tried 2.8.1.. both build 2.0.95 fine
Compiler version: egcs-2.91.54 19980816 (gcc2 ss-980609 experimental)
Kernel headers: 2.1.122
Symbol versioning: yes
Build static: yes
Build shared: yes
Build pic-default: no
Build profile: yes
Build omitfp: yes NOTE: added -g1 -fno-omit-frame-pointer to get info
Build bounded: no
Build static-nss: no
Stdio: libio

>Description:
	

kaudioserver (kpanel too) runs well under 2.0.95, but segfaults under 2.0.96

Script started on Sat Sep 26 07:56:55 1998
bash-2.02# gdb /usr/local/kde/bin/kaudioserver
GNU gdb 4.17
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i586-pc-linux-gnu"...
(no debugging symbols found)...
(gdb) run
Starting program: /usr/local/kde/bin/kaudioserver 

Program received signal SIGSEGV, Segmentation fault.
0x4053306f in _IO_old_file_overflow (f=0x404ad940, ch=-1) at oldfileops.c:182
182	    case 'r':
(gdb) bt
#0  0x4053306f in _IO_old_file_overflow (f=0x404ad940, ch=-1)
    at oldfileops.c:182
#1  0x4049abeb in filebuf::overflow ()
#2  0x40531c90 in __overflow (f=0x404ad940, ch=-1)
#3  0x40533894 in _IO_old_file_xsputn (f=0x404ad940, data=0xbffff3a0, n=2)
    at oldfileops.c:473
#4  0x4049ad7a in filebuf::xsputn ()
#5  0x4052242c in _IO_vfprintf (s=0x404ad940, 
    format=0x8049200 "Using old audio server with talk id %s\n", ap=0xbffff324)
    at vfprintf.c:1331
#6  0x40528e4a in printf (
    format=0x8049200 "Using old audio server with talk id %s\n")
#7  0x8048f2d in strcpy ()
#8  0x404ef4c7 in __libc_start_main (main=0x8048d80 <strcpy+484>, argc=1, 
    argv=0xbffff594, init=0x80489d8 <_init>, fini=0x8049108 <_fini>, 

    rtld_fini=0x4000c6c0 <_dl_fini>, stack_end=0x1)
(gdb) piint f
$1 = (_IO_FILE *) 0x404ad940
(gdb) print *f
$2 = {_flags = -72537468, 
  _IO_read_ptr = 0x40474000 "Using old audio server with talk id 0\n", 
  _IO_read_end = 0x40474000 "Using old audio server with talk id 0\n", 
  _IO_read_base = 0x40474000 "Using old audio server with talk id 0\n", 
  _IO_write_base = 0x40474000 "Using old audio server with talk id 0\n", 
  _IO_write_ptr = 0x40474026 "", 
  _IO_write_end = 0x40474000 "Using old audio server with talk id 0\n", 
  _IO_buf_base = 0x40474000 "Using old audio server with talk id 0\n", 
  _IO_buf_end = 0x40475000 <Address 0x40475000 out of bounds>, 
  _IO_save_base = 0x0, _IO_backup_base = 0x0, _IO_save_end = 0x0, 
  _markers = 0x0, _chain = 0x804a580, _fileno = 1, _blksize = 0, 
  _old_offset = 0, _cur_column = 0, _vtable_offset = 0 '\000', _shortbuf = "", 
  _lock = 0x404ad918}
(gdb) quit
The program is running.  Exit anyway? (y or n) y
bash-2.02# exit
exit

Script done on Sat Sep 26 07:59:35 1998
>How-To-Repeat:
	
>Fix:
	
I haven't persued further due to time constraints.. will try to find time
to give it a shot at least.