Re: Problem with ncurses (crash in tgetent()) ...

[Thomas Dickey]

On Wed, Oct 11, 2006 at 10:52:34AM +0200, Andrzej Ostruszka wrote:
 
> It looks to me like somewhere there is hardcoded that the pagesize is
> 4096 and this gives problems in this situation when it differs (just a
> guess - but hopefully an educated one :)).  Examplary execution:

It might be that, or somewhere in the tgetent/lower code there might be
a buffer that's big enough (4096) for a terminfo entry.  I didn't see a
problem on Linux (which would use generally the same size of data on the
stack).
 
> $ ./ncurses $((2**12-1))
> tgetent() returned 1
> ^C
> $ ./ncurses $((2**12))
> zsh: segmentation fault (core dumped)  ./ncurses $((2**12))
> $ ./ncurses $((2**13))
> zsh: segmentation fault (core dumped)  ./ncurses $((2**13))
> $ ./ncurses $((2**13+1))
> tgetent() returned 1
> ^C
> 
> The backtrace just before the point where 'step' would give mi crash is:
> 
> Breakpoint 2, _nc_access (path=0xff211aa0 "/home/aao014/.terminfo/x/xterm",
>    mode=4) at ../ncurses/./tinfo/access.c:94
> 94          if (access(path, mode) < 0) {
> (gdb) bt
> #0  _nc_access (path=0xff211aa0 "/home/aao014/.terminfo/x/xterm", mode=4)
>    at ../ncurses/./tinfo/access.c:94
> #1  0x00016364 in _nc_read_file_entry (

This function has a 4096-byte buffer on the stack for instance.
It's used by infocmp and toe (so a workaround for your problem might
add a different function for tgetent() which uses an allocated buffer).

>    filename=0xff211aa0 "/home/aao014/.terminfo/x/xterm", ptr=0x41988)
>    at ../ncurses/./tinfo/read_entry.c:391
> #2  0x0001714c in _nc_read_entry (
>    tn=0xff211aa0 "/home/aao014/.terminfo/x/xterm", filename=0x41988 "",
>    tp=0xff211630) at ../ncurses/./tinfo/read_entry.c:493
> (gdb) s
 
-- 
Thomas E. Dickey <address@hidden>
http://invisible-island.net
ftp://invisible-island.net

signature.asc
Description: Digital signature