[Flightgear-devel] Crash related to FGIO or FGAtlas

[Alexis B. - x. <ale...@gm...>]

Hi all,
Reproductible while using --atlas argument, you need to try hard to 
crash the c172p. After a few (serious) crash maneuvers it triggers a 
buffer overflow.

Alexis

--

NAN's found in SampleGroup velocity
PT_vs_hpt: ran out of layers
Warning: invalid line segment passed to IntersectVisitor::addLineSegment(..)
         nan nan nan nan nan nan segment ignored..
Warning: invalid line segment passed to IntersectVisitor::addLineSegment(..)
         nan nan nan nan nan nan segment ignored..
Warning: invalid line segment passed to IntersectVisitor::addLineSegment(..)
         nan nan nan nan nan nan segment ignored..
Warning: invalid line segment passed to IntersectVisitor::addLineSegment(..)
         nan nan nan nan nan nan segment ignored..
*** buffer overflow detected ***: 
/home/alexis/fgfs/install/fgfs/bin/fgfs terminated
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(__fortify_fail+0x48)[0xb70f4da8]
/lib/tls/i686/cmov/libc.so.6[0xb70f2eb0]
/lib/tls/i686/cmov/libc.so.6[0xb70f25a8]
/lib/tls/i686/cmov/libc.so.6(_IO_default_xsputn+0xc8)[0xb7064bb8]
/lib/tls/i686/cmov/libc.so.6(_IO_vfprintf+0xf4c)[0xb703777c]
/lib/tls/i686/cmov/libc.so.6(__vsprintf_chk+0xa4)[0xb70f2654]
/lib/tls/i686/cmov/libc.so.6(__sprintf_chk+0x2d)[0xb70f259d]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x8474cfd]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x84708d0]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x808ea74]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x86620b9]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x86645bb]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x806e0d9]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x80c1092]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x806d735]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x806b9bf]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe5)[0xb700d775]
/home/alexis/fgfs/install/fgfs/bin/fgfs[0x806b6f1]
======= Memory map: ========

[.... snip ... ]

a
Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb60b1730 (LWP 26937)]
0xb8027430 in __kernel_vsyscall ()
(gdb) bt
#0  0xb8027430 in __kernel_vsyscall ()
#1  0xb70226d0 in raise () from /lib/tls/i686/cmov/libc.so.6
#2  0xb7024098 in abort () from /lib/tls/i686/cmov/libc.so.6
#3  0xb706024d in ?? () from /lib/tls/i686/cmov/libc.so.6
#4  0xb70f4da8 in __fortify_fail () from /lib/tls/i686/cmov/libc.so.6
#5  0xb70f2eb0 in __chk_fail () from /lib/tls/i686/cmov/libc.so.6
#6  0xb70f25a8 in ?? () from /lib/tls/i686/cmov/libc.so.6
#7  0xb7064bb8 in _IO_default_xsputn () from /lib/tls/i686/cmov/libc.so.6
#8  0xb703777c in vfprintf () from /lib/tls/i686/cmov/libc.so.6
#9  0xb70f2654 in __vsprintf_chk () from /lib/tls/i686/cmov/libc.so.6
#10 0xb70f259d in __sprintf_chk () from /lib/tls/i686/cmov/libc.so.6
#11 0x08474cfd in FGAtlas::gen_message (this=0x10811050) at 
/usr/include/bits/stdio2.h:35
#12 0x084708d0 in FGAtlas::process (this=0x10811050) at atlas.cxx:560
#13 0x0808ea74 in FGIO::update (this=0xf81d7d8, delta_time_sec=0.625) at 
fg_io.cxx:360
#14 0x086620b9 in SGSubsystemGroup::Member::update (this=0xf81a138, 
delta_time_sec=0.625) at subsystem_mgr.cxx:308
#15 0x086645bb in SGSubsystemGroup::update (this=0x9d59d3c, 
delta_time_sec=0.625) at subsystem_mgr.cxx:161
#16 0x0806e0d9 in fgMainLoop () at main.cxx:455
#17 0x080c1092 in fgOSMainLoop () at fg_os_osgviewer.cxx:172
#18 0x0806d735 in fgMainInit (argc=5, argv=0xbfe9d484) at main.cxx:895
#19 0x0806b9bf in main (argc=5, argv=0xbfe9d484) at bootstrap.cxx:229
(gdb)