argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Carlos O'Donell]

On 4/9/20 5:12 PM, Hans Petter Selasky wrote:
> Dear GNU libc people,
> 
> I'm a FreeBSD developer and we have a port of some of your glibc code. I recently found a bug, which I'm not sure if you've fixed.
> 
> The fix for FreeBSD is here:
> https://svnweb.freebsd.org/changeset/ports/531220
> 
>> Log:
>>   Fix segmentation fault when showing help text.
>>   Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>>     Backtrace:
>>   #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>>          hhstate=0x7fffffffe5d8) at argp-help.c:1164
>>   #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>>   #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>>          name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>>   #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>>          name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>>   
> 
> It turns out the argp_help invoke _help with a NULL state. In some cases the state may be used when printing the help message, for example when running dvbv5-scan w/o any arguments in FreeBSD.

Do you have a distilled minimal C example that shows the crash?

I just want to make sure we understand exactly what dvbv5-scan
is doing with the API.

> Fix this by creating a dummy argp_state structure on the stack, and fill in the used arguments.
> 
> I hope my fix is right. At least it fixes the issue for me.
 
In glibc we have:

1164       const char *tstr = real->doc ? dgettext (state == NULL ? NULL
1165                                                : state->root_argp->argp_domain,
1166                                                real->doc) : 0;

We are constantly checking for a NULL state and not using it.

It comes from this commit:

commit 400cc70af5972a50618702da02d18aee845ce542
Author: Ulrich Drepper <drepper@redhat.com>
Date:   Wed May 10 06:39:15 2006 +0000

    * io/ftw.c (open_dir_stream): Return right away if REALLOC fails.
    
            [Coverity CID 229, 230]
    
            * argp/argp-help.c (hol_entry_help): Handle STATE==NULL in ARG and
            DGETTEXT calls.
            (hol_help): Likewise.  [Coverity CID 226, 227]
    
            * string/argz-replace.c (__argz_replace): Unconditionally call
            free on SRC.  [Coverity CID 225]
    
            * nis/nis_creategroup.c (nis_creategroup): No need to duplicate
            the return value of __nis_default_owner and __nis_default_group,
            it has been especially allocated.  [Coverity CID 224]

The STATE=NULL part looks relevant.

Do you have this fix?

-- 
Cheers,
Carlos.