Bug 26780 - vbindiff segfaults at searching
Summary: vbindiff segfaults at searching
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: RPM Packages (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact:
URL: https://github.com/madsen/vbindiff/is...
Whiteboard: MGA8-64-OK
Keywords: UPSTREAM, advisory, validated_update
Depends on:
Blocks:
 
Reported: 2020-06-12 16:38 CEST by Morgan Leijström
Modified: 2022-09-07 12:21 CEST (History)
3 users (show)

See Also:
Source RPM: vbindiff-3.0-0.7.beta5.mga7.src.rpm
CVE:
Status comment:


Attachments

Description Morgan Leijström 2020-06-12 16:38:51 CEST
Version-Release number of selected component (if applicable):
vbindiff-3.0-0.7.beta5.mga7.src.rpm
$ vbindiff -V
VBinDiff 3.0_beta5


How reproducible: always


Steps to Reproduce:
I am running it in Konsole in Plasma;

1. Open two binary files  (in my case they are identical except name)
2. Press key f (search function)
3. Immediate crash. Screen copy:

ST93C46C-8bitserEE.bin                                                          
0000 0000: 00 00 19 00 00 88 05 05  FF FF FF FF 14 00 00 A4  ........ ........  
0000 0010: 02 04 FF FF FF FF 03 09  00 00 01 06 8F B0 09 27  ........ .......'  
0000 0020: C0 91 76 01 D4 C0 00 FF  FF F0 78 FF FF FF FF FF  ..v..... ..x.....  
0000 0030: 00 01 00 03 FF 00 FF 00  FF FF 00 FF FF FF FF 64  ........ .......d  
0000 0040: 32 12 24 24 24 13 13 09  09 09 FF FF FF FF FF FF  2.$$$... ........  
0000 0050: FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ........ ........  
0000 0060: FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ........ ........  
0000 0070: FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ........ ........  
0000 0080:
0000 0090:
ST93C46-8bitserEE.bin                                                           
0000 0000: 00 00 19 00 00 88 05 05  FF FF FF FF 14 00 00 A4  ........ ........  
0000 0010: 02 04 FF FF FF FF 03 09  00 00 01 06 8F B0 09 27  ........ .......'  
0000 0020: C0 91 76 01 D4 C0 00 FF  FF F0 78 FF FF FF FF FF  ..v..... ..x.....  
0000 0030: 00 01 00 03 FF 00 FF 00  FF FF 00 FF FF FF FF 64  ........ .......d  
0000 0040: 32 12 24 24 24 13 13 09  09 09 FF FF FF FF FF FF  2.$$$... ........  
0000 0050: FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ........ ........  
0000 0060: FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ........ ........  
0000 0070: FF FF FF FF FF FF FF FF  FF FF FF FF FF FF FF FF  ........ ........  
0000 0080:
0000 0090:
┌──────────────────────────────────────────────────────────────────────────────┐
│Arrow keys move  F find      RET next difference  ESC quit  T move top        │
│C ASCII/Segmenteringsfel (minnesutskrift skapad)    Q quit  B move bottom     │
[morgan@svarten Utläst från kretsar]$
Comment 1 Lewis Smith 2020-06-12 21:42:30 CEST
Thanks for reporting this. It seems rather a basic fault.
Can you say whether the crash happens with just 1 file? Or only with 2.
I will play with it when I have a moment.

CC: (none) => lewyssmith

Comment 2 Morgan Leijström 2020-06-13 13:01:10 CEST
Crashes immediately on pressing f with only one file opened too.
Comment 3 Barry Jackson 2020-06-13 15:11:03 CEST
Same in Cauldron full backtrace:

(gdb) bt
#0  0x00007ffff7f888d4 in wresize (win=<optimized out>, ToLines=2, ToLines@entry=3, ToCols=31, ToCols@entry=32)
    at ../../ncurses/base/wresize.c:176
#1  0x0000000000406f87 in ConWindow::resize (this=this@entry=0x40c860 <inWin>, width=width@entry=32, height=height@entry=3)
    at curses/ConWin.cpp:239
#2  0x00000000004040f8 in positionInWin (cmd=cmd@entry=19 '\023', width=width@entry=32, title=title@entry=0x408649 " Find ")
    at vbindiff.cpp:1280
#3  0x0000000000406052 in searchFiles (cmd=19 '\023') at vbindiff.cpp:1584
#4  0x0000000000406738 in handleCmd (cmd=<optimized out>) at vbindiff.cpp:1676
#5  0x0000000000402758 in main (argc=<optimized out>, argv=<optimized out>) at vbindiff.cpp:1868
(gdb)

Whiteboard: (none) => MGA7TOO
CC: (none) => zen25000
Version: 7 => Cauldron

Comment 4 Barry Jackson 2020-06-13 16:46:06 CEST
Building locally in Mga7 using current upstream git master (manual build and run from build tree without packaging) produces a similar segfault:

└────────Program received signal SIGSEGV, Segmentation fault.──────────────────┘
                                                             0x00007ffff7f867a4 in wresize (win=<optimized out>, ToLines=2, ToCols=31, ToCols@entry=32)
    at ../../ncurses/base/wresize.c:161
161                         if (s == 0)
(gdb) bt
#0  0x00007ffff7f867a4 in wresize (win=<optimized out>, ToLines=2, ToCols=31, ToCols@entry=32)
    at ../../ncurses/base/wresize.c:161
#1  0x0000000000407ed5 in ConWindow::resize (this=this@entry=0x40d860 <inWin>, width=width@entry=32, 
    height=height@entry=3) at curses/ConWin.cpp:239
#2  0x000000000040500a in positionInWin (cmd=cmd@entry=19 '\023', width=width@entry=32, 
    title=title@entry=0x409619 " Find ") at vbindiff.cpp:1280
#3  0x0000000000406dd1 in searchFiles (cmd=19 '\023') at vbindiff.cpp:1635
#4  0x0000000000407237 in handleCmd (cmd=<optimized out>) at vbindiff.cpp:1676
#5  0x0000000000403878 in main (argc=<optimized out>, argv=<optimized out>) at vbindiff.cpp:1868

This looks to me like an ncurses update breakage, most recent updates were 6 and 9 months ago which could explain it being broken in both 7 and cauldron.

I will report it upstream (vbindiff) later.

Keywords: (none) => UPSTREAM

Barry Jackson 2020-06-13 16:46:40 CEST

Assignee: bugsquad => zen25000

Comment 5 Barry Jackson 2020-06-13 17:14:58 CEST
Reported upstream:
https://github.com/madsen/vbindiff/issues/19
Comment 6 Lewis Smith 2020-06-14 20:59:12 CEST
Thank you a lot Barry for taking this on, and all your input. It helps a lot.
> This looks to me like an ncurses update breakage, most recent updates were
> 6 and 9 months ago which could explain it being broken in both 7 and cauldron
ncurses was last updated for M7 Tue Dec 10 2019, simultaneously for M8 - which has had several updates since.

@Morgan: can you say whether you have used vbindiff successfully in the past? To test whether this fault is known to be recent, or has lurked forever (nobody using the pkg).

URL: http://www.cjmweb.net/vbindiff/ => https://github.com/madsen/vbindiff/issues/19

Comment 7 Morgan Leijström 2020-06-14 23:38:55 CEST
This was the first time i ever tried vbindiff. Had to compare two machine calibration memories contents, and simply grabbed one of the diff packages i spotted in our repo...
Comment 8 Barry Jackson 2020-06-15 00:35:54 CEST
Hmm.. Well out of interest I tried the Mageia 6 version in Mga6, just the same!

└─┘      Program received signal SIGSEGV, Segmentation fault.
                                                             wresize (win=0x636970, ToLines=2, ToCols=31, ToCols@entry=32) at ../../ncurses/base/wresize.c:166
166                                       : win->_nc_bkgd);
(gdb) bt
#0  wresize (win=0x636970, ToLines=2, ToCols=31, ToCols@entry=32) at ../../ncurses/base/wresize.c:166
#1  0x0000000000406e25 in ConWindow::resize (this=this@entry=0x60a860 <inWin>, width=width@entry=32, height=height@entry=3)
    at curses/ConWin.cpp:241
#2  0x0000000000403d98 in positionInWin (cmd=cmd@entry=19 '\023', width=width@entry=32, title=title@entry=0x408069 " Find ")
    at vbindiff.cpp:1281
#3  0x0000000000405a6e in searchFiles (cmd=19 '\023') at vbindiff.cpp:1578
#4  0x0000000000406051 in handleCmd (cmd=<optimized out>) at vbindiff.cpp:1677
#5  0x0000000000402658 in main (argc=3, argv=0x7fffffffdaa8) at vbindiff.cpp:1869
(gdb)

I am the registered maintainer, but I must admit that I don't think I ever hit 'F' when testing it, so this looks like a long standing bug. Shows just how popular it must be!

Let's wait and see what upstream have to say.
Comment 9 Lewis Smith 2020-06-16 10:38:16 CEST
> I tried the Mageia 6 version in Mga6, just the same!
> this looks like a long standing bug. Shows just how popular it must be!
Very long-standing!
Thank you for persuing this, I can bow out.

CC: lewyssmith => (none)

Barry Jackson 2021-08-18 23:29:04 CEST

Whiteboard: MGA7TOO => MGA7TOO MGA8TOO

Comment 10 sturmvogel 2022-08-12 14:51:52 CEST
vbindiff is broken since MGA6. vbindiff is unmaintained since over 5 years upstream and no code maintenance/bugfixing was done.

This package should be obsoleted.

Blocks: (none) => 30163

Comment 11 Barry Jackson 2022-09-02 20:09:57 CEST
I have pushed a fix for this to Cauldron, as suggested by linuxCowboy in the upstream github group.

I have not had chance to test this in Cauldron myself, but it seems OK in Mga8.

Please test this in Cauldron when it appears vbindiff-3.0-0.10.beta5.mga9.
Comment 12 Barry Jackson 2022-09-05 23:20:45 CEST
vbindiff-3.0-0.8.beta5.1.mga8 has been submitted to 8/core/updates_testing

Advisory
#########################

This update fixes a segfault encountered when attempting to use the search feature.

References
#########################

https://bugs.mageia.org/show_bug.cgi?id=26780

https://github.com/madsen/vbindiff/issues/19

Fix suggested in github comment by linuxCowboy. Thanks!

Packages affected
########################
vbindiff-3.0-0.8.beta5.1.mga8.x86_64.rpm
vbindiff-debugsource-3.0-0.8.beta5.1.mga8.x86_64.rpm
vbindiff-debuginfo-3.0-0.8.beta5.1.mga8.x86_64.rpm

From:
vbindiff-3.0-0.8.beta5.1.mga8.src.rpm

Testing
########################

Install the original package from core and check that when hitting "F" while displaying the contents of any file the program crashes.

Install the new version from testing and confirm that it searches without crashing.

Assignee: zen25000 => qa-bugs

Comment 13 Barry Jackson 2022-09-05 23:21:54 CEST
I guess we ignore Mga7 now?
Thomas Backlund 2022-09-06 00:48:30 CEST

Whiteboard: MGA7TOO MGA8TOO => (none)
Version: Cauldron => 8

Comment 14 Morgan Leijström 2022-09-06 09:49:57 CEST
Useful prog, thanks.
Used our old vbindiff to compare two EEPROM backups from old machine.
Pressed key f -> segfault.
Updated to vbindiff-3.0-0.8.beta5.1.mga8.x86_64.rpm and repeated:
No segfault, dialog to choose Hex or Text search and both modes seem to work.

Keywords: (none) => validated_update
Whiteboard: (none) => MGA8-64-OK
CC: (none) => sysadmin-bugs

Dave Hodgins 2022-09-07 05:23:11 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 15 Mageia Robot 2022-09-07 07:28:58 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGAA-2022-0120.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED

Comment 16 Morgan Leijström 2022-09-07 09:14:51 CEST
(In reply to Barry Jackson from comment #11)
> Please test this in Cauldron when it appears vbindiff-3.0-0.10.beta5.mga9.

When tested OK in cauldron, for clarity please remove blocking 30163 (packages to obsolete)
Barry Jackson 2022-09-07 12:21:39 CEST

Blocks: 30163 => (none)


Note You need to log in before you can comment on or make changes to this bug.