argp_help() causes segmentation fault (v4l-utils - dvbv5-scan)

[Hans Petter Selasky]

On 2020-04-09 23:32, Carlos O'Donell wrote:
> On 4/9/20 5:12 PM, Hans Petter Selasky wrote:
>> Dear GNU libc people,
>>
>> I'm a FreeBSD developer and we have a port of some of your glibc code. I recently found a bug, which I'm not sure if you've fixed.
>>
>> The fix for FreeBSD is here:
>> https://svnweb.freebsd.org/changeset/ports/531220
>>
>>> Log:
>>>    Fix segmentation fault when showing help text.
>>>    Found when running dvbv5-scan (part of coming v4l-utils upgrade).
>>>      Backtrace:
>>>    #0 hol_entry_help (entry=0x8007e0000, state=0x0, stream=0x8007d3000,
>>>           hhstate=0x7fffffffe5d8) at argp-help.c:1164
>>>    #1 hol_help (hol=0x8007df000, state=0x0, stream=0x8007d3000) at argp-help.c:1230
>>>    #2 _help (argp=0x7fffffffe750, state=0x0, stream=0x8004fca20, flags=634,
>>>           name=0x2018ce "dvbv5-scan") at argp-help.c:1675
>>>    #3 argp_help (argp=0x7fffffffe750, stream=0x8004fca20, flags=634,
>>>           name=0x2018ce "dvbv5-scan") at argp-help.c:1707
>>>    
>>
>> It turns out the argp_help invoke _help with a NULL state. In some cases the state may be used when printing the help message, for example when running dvbv5-scan w/o any arguments in FreeBSD.
> 
> Do you have a distilled minimal C example that shows the crash?
> 
> I just want to make sure we understand exactly what dvbv5-scan
> is doing with the API.
> 
>> Fix this by creating a dummy argp_state structure on the stack, and fill in the used arguments.
>>
>> I hope my fix is right. At least it fixes the issue for me.
>   
> In glibc we have:
> 
> 1164       const char *tstr = real->doc ? dgettext (state == NULL ? NULL
> 1165                                                : state->root_argp->argp_domain,
> 1166                                                real->doc) : 0;
> 
> We are constantly checking for a NULL state and not using it.
> 
> It comes from this commit:
> 
> commit 400cc70af5972a50618702da02d18aee845ce542
> Author: Ulrich Drepper <drepper@redhat.com>
> Date:   Wed May 10 06:39:15 2006 +0000
> 
>      * io/ftw.c (open_dir_stream): Return right away if REALLOC fails.
>      
>              [Coverity CID 229, 230]
>      
>              * argp/argp-help.c (hol_entry_help): Handle STATE==NULL in ARG and
>              DGETTEXT calls.
>              (hol_help): Likewise.  [Coverity CID 226, 227]
>      
>              * string/argz-replace.c (__argz_replace): Unconditionally call
>              free on SRC.  [Coverity CID 225]
>      
>              * nis/nis_creategroup.c (nis_creategroup): No need to duplicate
>              the return value of __nis_default_owner and __nis_default_group,
>              it has been especially allocated.  [Coverity CID 224]
> 
> The STATE=NULL part looks relevant.
> 
> Do you have this fix?

Likely not.

Can you point me at the repository which holds the latest argp code?

--HPS