[aspell-devel] segfault in latest snapshot

[Nils Ellmenreich]

Hi all,

This is on RedHat 7.1. I've tried it with the delivered gcc 2.96 and
also with gcc 3.1.1. and aspell-0.50-20020815. While checking a file
with the following command line

aspell -c -t --add-tex-command="bibliography p" \
 --add-tex-command="verbatim p" --add-tex-command="figure o p" \
 --add-tex-command="texttt p"  --lang=en_GB foo.tex

with empty personal dictionary, it segfaults after the 10th word found.
This is gdb's output (I compiled aspell again without -O2):


Program received signal SIGSEGV, Segmentation fault.
0x403061bd in memmove (dest=0x407bb008, src=0x8081a5b, len=43254420) at 
../sysdeps/generic/memmove.c:73
        in ../sysdeps/generic/memmove.c
Current language:  auto; currently c
(gdb) where
#0  0x403061bd in memmove (dest=0x407bb008, src=0x8081a5b, len=43254420) at 
../sysdeps/generic/memmove.c:73
#1  0x0805d0ea in __copy_trivial<char> (__first=0x8081a5b "", __last=0xa9c1cef 
<Address 0xa9c1cef out of bounds>, __result=0x407bb008 "") at 
bits/stl_algobase.h:252
#2  0x0805cc87 in __copy_aux2<char> (__first=0x8081a5b "", __last=0xa9c1cef 
<Address 0xa9c1cef out of bounds>, __result=0x407bb008 "") at 
bits/stl_algobase.h:272
#3  0x0805c77c in __copy_ni2<char*, __gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > > > (__first=0x8081a5b "", 
__last=0xa9c1cef <Address 0xa9c1cef out of bounds>, 
__result={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x407bb008 ""}) at bits/stl_algobase.h:289
#4  0x0805ba57 in __copy_ni1<__gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > > > 
(__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}, 
__result={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x407bb008 ""}) at bits/stl_algobase.h:314
#5  0x0805b10e in copy<__gnu_cxx::__normal_iterator<char*, std::vector<char, 
std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, std::vector<char, 
std::allocator<char> > > > 
(__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}, 
__result={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x407bb008 ""}) at bits/stl_algobase.h:349
#6  0x0805b6f7 in __uninitialized_copy_aux<__gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > > > 
(__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}, 
__result={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x407bb008 ""}) at bits/stl_uninitialized.h:76
#7  0x0805af7c in uninitialized_copy<__gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > > > 
(__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}, 
__result={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x407bb008 ""}) at bits/stl_uninitialized.h:112
#8  0x0805ea36 in void std::vector<char, std::allocator<char> 
>::_M_range_insert<__gnu_cxx::__normal_iterator<char*, std::vector<char, 
std::allocator<char> > > >(__gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > >, __gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > >, std::forward_iterator_tag) 
(this=0xbfffd314, 
__position={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x0}, 
__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}) at 
bits/stl_vector.h:1058
#9  0x0805e62b in _M_insert_dispatch<__gnu_cxx::__normal_iterator<char*, 
std::vector<char, std::allocator<char> > > > (this=0xbfffd314, 
__pos={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0x0}, 
__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}) at 
bits/stl_vector.h:596
#10 0x0805e33f in insert<__gnu_cxx::__normal_iterator<char*, std::vector<char, 
std::allocator<char> > > > (this=0xbfffd314, 
__pos={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0x0}, 
__first={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = 
{<No data fields>}, _M_current = 0x8081a5b ""}, 
__last={<iterator<std::random_access_iterator_tag,char,int,char*,char&>> = {<No 
data fields>}, _M_current = 0xa9c1cef <Address 0xa9c1cef out of bounds>}) at 
bits/stl_vector.h:581
#11 0x0805d9a2 in CheckerString::get_word(acommon::CharVector&) 
(this=0x806e0d0, address@hidden) at checker_string.hpp:74
#12 0x08054ea8 in check(bool) (interactive=true) at aspell.cpp:728
#13 0x080517ab in main (argc=10, argv=0xbfffdbb4) at aspell.cpp:291
#14 0x4029e336 in __libc_start_main (main=0x80509a0 <main>, argc=10, 
ubp_av=0xbfffdbb4, init=0x804fe90 <_init>, fini=0x8061c3c <_fini>, 
rtld_fini=0x4000d2fc <_dl_fini>, stack_end=0xbfffdbac) at 
../sysdeps/generic/libc-start.c:129


I don't really want to disclose the file to the world and haven't been
able to reproduce it with a smaller file. If I succeed with this, I'll
post the file here ASAP. But as the point of failure is within memmove,
the error might only show with not-so-small files (mine is 21kB).

I'm open for any suggestions what to try (maybe some other gdb output?).

Regards, Nils