Subject: Re: bug#70914: 29.3; Crashes often on Windows

From: Hannes Domani <[email-masked]>
Date: Wed, 22 May 2024 06:12:17 +0000 (UTC)

Am Mittwoch, 22. Mai 2024 um 07:57:48 MESZ hat Simen Endsjø <[email-masked]> Folgendes geschrieben:

> >  I think (or rather hope) it will show us some large path.
>
> It was a bit difficult to get it crashing as it "hung" several times instead of
> crashing. But here is at last a crash:
>
>     get_volume_info: name="d:/profiles/%s"
>     get_volume_info: name="//"
>
>     Thread 1 received signal SIGSEGV, Segmentation fault.
>     [Switching to Thread 27916.0x5a7c]
>     0x0000000000000000 in ?? ()

Whoa, the result is very different from what I expected, but we found the
culprit.

@Eli

Not sure where this "//" path is coming from, but parse_root() does
not handle it correctly, it will look for 2 additional slashes after
them for some reason (?), buf first ignore the null-delimiter with 'name++',
before the 'while ( *name )' check:

  else if (IS_DIRECTORY_SEP (name[0]) && IS_DIRECTORY_SEP (name[1]))
    {
      int slashes = 2;

      name += 2;
      do
        {
      if (IS_DIRECTORY_SEP (*name) && --slashes == 0)
        break;
      name++;
    }
      while ( *name );
      if (IS_DIRECTORY_SEP (name[0]))
    name++;
    }

The 'root_len' it returns to get_volume_info() then likely overflows
'temp' in the following strncpy() call:

      strncpy (temp, name, root_len);

As a quick fix I suggest changing the if() to something like:

      if (!*name || (IS_DIRECTORY_SEP (*name) && --slashes == 0))

Hannes