Subject: bug#3772 closed by Chong Yidong <[email-masked]> (Re: 23.0.95; Segmentation fault: ffap/image/C-x d)

From: [email-masked] (Emacs bug Tracking System)
Date: Tue, 07 Jul 2009 22:35:07 +0000

This is an automatic notification regarding your bug report
which was filed against the emacs package:

#3772: 23.0.95; Segmentation fault: ffap/image/C-x d

It has been closed by Chong Yidong <[email-masked]>.

Their explanation is attached below along with your original report.
If this explanation is unsatisfactory and you have not received a
better one in a separate message then please contact Chong Yidong <[email-masked]> by
replying to this email.

-- 
3772: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=3772
Emacs Bug Tracking System
Contact [email-masked] with problems

Subject: Re: 23.0.95; Segmentation fault: ffap/image/C-x d
From: Chong Yidong <[email-masked]>
To: Jason Rumney <[email-masked]>
Cc: [email-masked], [email-masked]
Date: Tue, 07 Jul 2009 18:29:09 -0400

> I can reproduce this.  From bisecting prior revisions, I think the
> problem first appeared with this change:
>
> 2009-03-24  Jason Rumney  <[email-masked]>
>
> 	* fileio.c (Fsubstitute_in_file_name): Always work on a copy.
> 	Calculate total size precisely.  Decode environment variables
> 	before substituting.  (Bug#38)

OK, I found the problem.  The way the string data was copied was
incorrect:

  nm = SDATA (filename);
  nm = strcpy (alloca (strlen (nm) + 1), nm);

This should have been

  nm = (unsigned char *) alloca (SBYTES (filename) + 1);
  bcopy (SDATA (filename), nm, SBYTES (filename) + 1);

I've checked a fix into CVS.

Subject: 23.0.95; Segmentation fault: ffap/image/C-x d
From: [email-masked]
To: [email-masked]
Cc: [email-masked]
Date: Tue, 07 Jul 2009 07:37:05 +0800

1. Pick a large (16KB) .JPG from
http://jidanni.org/geo/taipower/images/ , e.g,.
$ cd /tmp && wget \
http://jidanni/jidanni.org/geo/taipower/images/19990716ab67wow.jpg
$ emacs-snapshot -Q /tmp/19990716ab67wow.jpg
M-x ffap-bindings
C-x d
Segfault... running again:
(gdb) run -Q /tmp/19990716ab67wow.jpg
Program received signal SIGSEGV, Segmentation fault.
0xb755b6b8 in bcopy () from /lib/i686/cmov/libc.so.6
>please include the output from the following gdb commands:
    `bt full' and `xbacktrace'.
(gdb) bt full
#0  0xb755b6b8 in bcopy () from /lib/i686/cmov/libc.so.6
#1  0x08170638 in ?? ()
No symbol table info available...
(gdb) xbacktrace
Undefined command: "xbacktrace".  Try "help".

In GNU Emacs 23.0.95.1 (i486-pc-linux-gnu, GTK+ Version 2.16.4)
 of 2009-07-04 on elegiac, modified by Debian
 (emacs-snapshot package, version 1:20090703-1)
Celeron(R) CPU 2.60GHz