Re: getenv("TZ") crashes triggered by tzset_basic()

Trond Endrestøl <Trond.Endrestol_at_fagskolen.gjovik.no> wrote:

> On Thu, 3 Jul 2014 14:01+0200, Fabian Keil wrote:
> 
> > Using HEAD, www/gatling reproducible crashes for me after receiving
> > a single request if TZ isn't set:
> > 
> > (gdb) where
> > #0  strncmp (s1=<optimized out>, s2=<optimized out>, n=<optimized out>) at /usr/src/lib/libc/string/strncmp.c:46
> > #1  0x00000008011a9ffe in strncmpeq (nameValue=0x7fffffffeb5e "LC_PAPER=de_DE.UTF-8", name=0x8011be49e "TZ", nameLen=<optimized out>) at /usr/src/lib/libc/stdlib/getenv.c:144
> > #2  __findenv_environ (name=<optimized out>, nameLen=<optimized out>) at /usr/src/lib/libc/stdlib/getenv.c:195
> > #3  getenv (name=0x8011be49e "TZ") at /usr/src/lib/libc/stdlib/getenv.c:441
> > #4  0x0000000801189f49 in tzset_basic (rdlocked=0) at /usr/src/lib/libc/../../contrib/tzcode/stdtime/localtime.c:1274
> > #5  0x000000080118a13e in localtime (timep=0x801c12030) at /usr/src/lib/libc/../../contrib/tzcode/stdtime/localtime.c:1467
> > #6  0x000000000040d38d in http_dirlisting (h=0x801c07140, D=0x801c0e080, path=0x7fffffffbb50 "/", arg=0x0) at http.c:214
> > #7  0x000000000040ff9d in http_openfile (h=0x801c07140, filename=0x801c0c085 "/", ss=0x7fffffffc108, sockfd=9, nobody=1) at http.c:1485
> > #8  0x0000000000413922 in httpresponse (h=0x801c07140, s=9, headerlen=76) at http.c:1940
> > #9  0x000000000040657d in handle_read_misc (i=9, h=0x801c07140, ftptimeout_secs=600, nextftp=...) at gatling.c:1051
> > #10 0x0000000000404d54 in main (argc=3, argv=0x7fffffffe840, envp=0x7fffffffe860) at gatling.c:2247
> > 
> > This is not a recent regression, I first noticed it a couple
> > of months ago but haven't had time to look into it yet.
> > 
> > If was reminded of this because a program I'm working on
> > (Privoxy) recently crashed thusly:
> > 
> > (gdb) where
> > #0  0x000000080128ef40 in strncmp (s1=<optimized out>, s2=<optimized out>, n=<optimized out>) at /usr/src/lib/libc/string/strncmp.c:46
> > #1  0x000000080128bb92 in getenv (name=<optimized out>) at /usr/src/lib/libc/stdlib/getenv.c:424
> > #2  0x000000080126bb39 in tzset_basic (rdlocked=0) at /usr/src/lib/libc/../../contrib/tzcode/stdtime/localtime.c:1281
> > #3  0x000000080126bb1b in tzset_basic (rdlocked=-14721152) at /usr/src/lib/libc/../../contrib/tzcode/stdtime/localtime.c:1274
> > #4  0x000000080122c0a0 in _fmt (format=0x22313031734e6863 <Address 0x22313031734e6863 out of bounds>, t=0x8012a009e, pt=0x2 <Address 0x2 out of bounds>, ptlim=0xf5 <Address 0xf5 out of bounds>, 
> >     warnp=0x8014cc418 <tzname+8>, loc=0x80126bb1b <tzset_basic+27>) at /usr/src/lib/libc/stdtime/strftime.c:137
> > #5  0x000000080122d6fb in _conv (n=<optimized out>, format=<optimized out>, pt=<optimized out>, n=<optimized out>, format=<optimized out>, pt=<optimized out>, ptlim=<optimized out>)
> >     at /usr/src/lib/libc/stdtime/strftime.c:597
> > #6  _yconv (a=<optimized out>, b=<optimized out>, convert_top=<optimized out>, convert_yy=<optimized out>, pt=<optimized out>, ptlim=<optimized out>, a=<optimized out>, b=<optimized out>, 
> >     convert_top=<optimized out>, convert_yy=<optimized out>, pt=<optimized out>, ptlim=<optimized out>) at /usr/src/lib/libc/stdtime/strftime.c:649
> > #7  0x0000000000428747 in get_log_timestamp (buffer=0x7fffff1f5f80 "2014-06-30 17:03:45.115", buffer_size=30) at errlog.c:482
> > [...]
> > (gdb) f 3
> > #3  0x000000080126bb1b in tzset_basic (rdlocked=-14721152) at /usr/src/lib/libc/../../contrib/tzcode/stdtime/localtime.c:1274
> 
> > 1274		name = getenv("TZ");
> 
> Does the code test at all for the possibility of getenv(3) returning a 
> NULL pointer?

It does:
http://svnweb.freebsd.org/base/head/contrib/tzcode/stdtime/localtime.c?view=markup#l1270

Assuming the back traces aren't corrupted, the crashes occur
before getenv() returns, though.

Fabian