[Tcl-bugs] [ tcl-Bugs-1999176 ] glob can cause crash on windows Tcl8.5.2

[SourceForge.net <no...@so...>]

Bugs item #1999176, was opened at 2008-06-20 22:22
Message generated for change (Comment added) made by pointsman
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1999176&group_id=10894

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: 36. Pathname Management
Group: current: 8.5.2
Status: Closed
Resolution: Fixed
Priority: 9
Private: No
Submitted By: Nobody/Anonymous (nobody)
Assigned to: Don Porter (dgp)
Summary: glob can cause crash on windows Tcl8.5.2

Initial Comment:
This glob has crashed my windows on
with Tcl8.5.2

glob -nocomplain -directory {} anything

Artur
ma...@xd...

----------------------------------------------------------------------

Comment By: Rolf Ade (pointsman)
Date: 2008-06-29 16:36

Message:
Logged In: YES 
user_id=13222
Originator: NO

The fix seems to leak.

With 8.5.3rc0 w/ 2004654 patch the following script shows the leak:

while 1 {
    interp create moo
    moo eval {
        package require tcltest
        namespace import tcltest::*

        proc createfile {file {string a}} {
            set f [open $file w]
            puts -nonewline $f $string
            close $f
            return $string
        }

        proc cleanup {args} {
            set wd [list .]
            foreach p [concat $wd $args] {
                set x ""
                catch {
                    set x [glob -directory $p tf* td*]
                }
                foreach file $x {
                    if {
                        [catch {file delete -force -- $file}]
                        && [testConstraint testchmod]
                    } then {
                        catch {openup $file}
                        catch {file delete -force -- $file}
                    }
                }
            }
        }

        for {set i 0} {$i < 1000} {incr i} {
            test fCmd-10.11 {file copy: copy to empty file name} -setup {
                cleanup
            } -returnCodes error -body {
                createfile tf1
                file copy tf1 ""
            } -result {error copying "tf1" to "": no such file or
directory}
        }
    }
    puts moo
    interp delete moo
}

The script leaks slowly enough, to be watched with top without danger.

The tests fCmd-10.11 and fCmd-10.12 out of the test suite trigger the
leak. Attached is the relevant part of a valgrind output (-DPURIFY build).


----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-24 20:06

Message:
Logged In: YES 
user_id=80530
Originator: NO


patch committed for 8.6a1 and 8.5.3.

No backport to 8.4.* since the bug
hasn't been demo'd there.

----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-24 20:00

Message:
Logged In: YES 
user_id=80530
Originator: NO


here's a patch to stop the crash
without redesigning the world

File Added: 1999716.patch

----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-24 17:34

Message:
Logged In: YES 
user_id=80530
Originator: NO


Lines 1773-1774 are more reasonable than
I thought.  When they run, we have already
called Tcl_FSGetNormalizedPath() on
fsPathPtr->cwdPtr, so for any normal value,
that call should have established
cwdPtr!=NULL.  That's only false because
the empty string value as a pathname is
so weird (see 2001389).



----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-23 21:30

Message:
Logged In: YES 
user_id=80530
Originator: NO


>From the comments about 'struct FsPath'
on lines 57-64 of tclPathObj.c:

 * (i) flags == 0, => Ordinary path.
 *
 * translatedPathPtr contains the translated path (which may be a
circular
 * reference to the object itself). If it is NULL then the path is pure
 * normalized (and the normPathPtr will be a circular reference). cwdPtr
is
 * null for an absolute path, and non-null for a relative path (unless the
cwd
 * has never been set, in which case the cwdPtr may also be null for a
 * relative path).

Take care to note that cwdPtr==NULL is possible for a
relative path when the global cwd has never been set.
The code at lines 1773-1174 (in Tcl_FSGetNormalizedPath())
fails to account for this possibility.


----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-23 18:20

Message:
Logged In: YES 
user_id=80530
Originator: NO


Add the command

cd [pwd]

before the [glob] and the crash
doesn't happen.

Suggests that at least one contibutor
to the error is that Tcl's internal
record of what is the current working
directory is not initialized at a time
when other parts of Tcl's filesystem
code may be assuming that it is initialized.


----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-23 14:49

Message:
Logged In: YES 
user_id=80530
Originator: NO

% glob -nocomplain -directory {} anything

Program received signal SIGSEGV, Segmentation fault.
0x0807c3db in Tcl_DbIncrRefCount (objPtr=0x0,
    file=0x8172768 "/home/dgp/cvs/tcl/unix/../generic/tclPathObj.c",
line=1772)
    at /home/dgp/cvs/tcl/unix/../generic/tclObj.c:3088
3088        if (objPtr->refCount == 0x61616161) {
(gdb) bt
#0  0x0807c3db in Tcl_DbIncrRefCount (objPtr=0x0,
    file=0x8172768 "/home/dgp/cvs/tcl/unix/../generic/tclPathObj.c",
line=1772)
    at /home/dgp/cvs/tcl/unix/../generic/tclObj.c:3088
#1  0x080827a8 in Tcl_FSGetNormalizedPath (interp=0x0, pathPtr=0x9d1e850)
    at /home/dgp/cvs/tcl/unix/../generic/tclPathObj.c:1772
#2  0x080ae733 in TclNativeCreateNativeRep (pathPtr=0x9d1e850)
    at /home/dgp/cvs/tcl/unix/../unix/tclUnixFile.c:1104
#3  0x08082d79 in Tcl_FSGetInternalRep (pathPtr=0x9d1e850,
fsPtr=0x8188f40)
    at /home/dgp/cvs/tcl/unix/../generic/tclPathObj.c:2069
#4  0x0806bb9b in Tcl_FSGetNativePath (pathPtr=0x9d1e850)
    at /home/dgp/cvs/tcl/unix/../generic/tclIOUtil.c:4290
#5  0x080ad679 in TclpMatchInDirectory (interp=0x9cd18c8,
resultPtr=0x9d13200,
    pathPtr=0x9d1e850, pattern=0x0, types=0x0)
    at /home/dgp/cvs/tcl/unix/../unix/tclUnixFile.c:235
#6  0x08068974 in Tcl_FSMatchInDirectory (interp=0x9cd18c8,
    resultPtr=0x9d13200, pathPtr=0x9d1e850, pattern=0x0, types=0x0)
    at /home/dgp/cvs/tcl/unix/../generic/tclIOUtil.c:1056
#7  0x081473d7 in DoGlob (interp=0x9cd18c8, matchesObj=0x9d13200,
    separators=0x8181bfe "/", pathPtr=0x9d06d18, flags=4,
    pattern=0x9d18080 "anything", types=0x0)
    at /home/dgp/cvs/tcl/unix/../generic/tclFileName.c:2457


----------------------------------------------------------------------

Comment By: Don Porter (dgp)
Date: 2008-06-23 14:43

Message:
Logged In: YES 
user_id=80530
Originator: NO


crashes on unix too.


----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=110894&aid=1999176&group_id=10894