Re: Buffer overflow in term_init on FreeBSD 4-STABLE

[Han Boetes]

Gerd Moellmann <address@hidden> wrote:
> This change in term.c makes it work.  Looking at FreeBSD sources, it
> seems the limit is 4096.

I just tried the latest version of cvs with these patches applied on
OpenBSD and I get this segfault when starting in -nw mode. Doesn't
happen in X.

Cheers.


Program received signal SIGSEGV, Segmentation fault.
0x157ee0 in _malloc_internal (size=2) at 
/home/han/nfs/Emacs/emacs/src/gmalloc.c:735
735               next->prev->next = next->next;
(gdb) bt
#0  0x157ee0 in _malloc_internal (size=2) at 
/home/han/nfs/Emacs/emacs/src/gmalloc.c:735
#1  0x1582c6 in malloc (size=2) at /home/han/nfs/Emacs/emacs/src/gmalloc.c:894
#2  0x104389 in emacs_blocked_malloc (size=2) at 
/home/han/nfs/Emacs/emacs/src/alloc.c:974
#3  0x1582c6 in malloc (size=2) at /home/han/nfs/Emacs/emacs/src/gmalloc.c:894
#4  0x4056ab79 in _nc_doalloc ()
#5  0x4056830d in _nc_do_color ()
#6  0x405689f4 in tparm ()
#7  0x4056835a in tparm ()
#8  0x4054d861 in tgoto ()
#9  0x8d007 in cmcostinit () at /home/han/nfs/Emacs/emacs/src/cm.c:175
#10 0x8f023 in calculate_costs (frame=0x2d3800) at 
/home/han/nfs/Emacs/emacs/src/term.c:1365
#11 0x3e2cc in init_display () at /home/han/nfs/Emacs/emacs/src/dispnew.c:6552
#12 0xc1b5b in main (argc=2, argv=0xcfbfbcfc) at 
/home/han/nfs/Emacs/emacs/src/emacs.c:1569
#13 0x364c1 in ___start ()
#14 0x36437 in Letext ()
#15 0xcfbfbe88 in ?? ()
#16 0x1 in ?? ()
Error accessing memory address 0x101464c: Invalid argument.



# Han