Re: address@hidden: Re: Buffer overflow in term_init on FreeBSD 4-STABLE]

[Gerd Moellmann]

Han Boetes <address@hidden> writes:

> Gerd Moellmann <address@hidden> wrote:
> > This change in term.c makes it work.  Looking at FreeBSD sources, it
> > seems the limit is 4096.
> 
> I just tried the latest version of cvs with these patches applied on
> OpenBSD and I get this segfault when starting in -nw mode. Doesn't
> happen in X.
> 
> Cheers.
> 
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x157ee0 in _malloc_internal (size=2) at 
> /home/han/nfs/Emacs/emacs/src/gmalloc.c:735
> 735               next->prev->next = next->next;
> (gdb) bt
> #0  0x157ee0 in _malloc_internal (size=2) at 
> /home/han/nfs/Emacs/emacs/src/gmalloc.c:735
> #1  0x1582c6 in malloc (size=2) at /home/han/nfs/Emacs/emacs/src/gmalloc.c:894
> #2  0x104389 in emacs_blocked_malloc (size=2) at 
> /home/han/nfs/Emacs/emacs/src/alloc.c:974
> #3  0x1582c6 in malloc (size=2) at /home/han/nfs/Emacs/emacs/src/gmalloc.c:894
> #4  0x4056ab79 in _nc_doalloc ()
> #5  0x4056830d in _nc_do_color ()
> #6  0x405689f4 in tparm ()
> #7  0x4056835a in tparm ()
> #8  0x4054d861 in tgoto ()
> #9  0x8d007 in cmcostinit () at /home/han/nfs/Emacs/emacs/src/cm.c:175
> #10 0x8f023 in calculate_costs (frame=0x2d3800) at 
> /home/han/nfs/Emacs/emacs/src/term.c:1365
> #11 0x3e2cc in init_display () at /home/han/nfs/Emacs/emacs/src/dispnew.c:6552

Hi, Han.

If this happens with my patch and doesn't happen without the patch,
there should be something wrong in term_init.  Alas, I don't see what
that could be.

Can you please step through term_init and check if you can see
something going wrong?

Also, it might be useful to compile Emacs with -DGC_MCHECK=1 in CFLAGS
(see also admin/make-emacs).  GC_MCHECK enables some consistency
checks in gmalloc.c that are quite useful (that shows no problem on
FreeBSD).