argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Hans Petter Selasky]

Dear GNU libc people,

I'm a FreeBSD developer and we have a port of some of your glibc code. I 
recently found a bug, which I'm not sure if you've fixed.

The fix for FreeBSD is here:
https://svnweb.freebsd.org/changeset/ports/531220

> Log:
>   Fix segmentation fault when showing help text.
>   Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>   
>   Backtrace:
>   #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>          hhstate=0x7fffffffe5d8) at argp-help.c:1164
>   #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>   #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>          name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>   #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>          name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>   

It turns out the argp_help invoke _help with a NULL state. In some cases 
the state may be used when printing the help message, for example when 
running dvbv5-scan w/o any arguments in FreeBSD.

Fix this by creating a dummy argp_state structure on the stack, and fill 
in the used arguments.

I hope my fix is right. At least it fixes the issue for me.

Thank you!

--HPS

-------------- next part --------------
A non-text attachment was scrubbed...
Name: patch-argp-help.c
Type: text/x-csrc
Size: 441 bytes
Desc: not available
URL: <https://sourceware.org/pipermail/libc-alpha/attachments/20200409/054f1bcd/attachment.bin>