Bug#1003708: units: Segmentation fault on certain conversions in verbose mode

[Owen T. Heisler]

Package: units
Version: 2.21-1
Severity: normal
X-Debbugs-Cc: wri...@owenh.net

Hi, the following commands result in a segmentation fault:

$ echo -e "cm\nbrwiregauge" | units -v
$ echo -e "cm\nplategauge" | units -v

This was discovered while attempting to use the script example in the
"SCRIPTING WITH UNITS" section of the units(1) man page.

Thank you for maintaining this useful tool.

Owen T. Heisler

-- System Information:
Debian Release: 11.2
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable'), (1, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.10.0-9-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages units depends on:
ii libc6 2.31-13+deb11u2
ii libreadline8 8.1-1

Versions of packages units recommends:
ii python3 3.9.2-3
ii python3-requests 2.25.1+dfsg-2

units suggests no packages.

-- debconf-show failed

[Stephen Kitt]

Control: tag -1 forwarded

Hi Adrian,

I had a quick look into this, it seems related to the fact that brwiregauge,
plategauge etc. are units with discrete values, and the user is asking for
the inverse; but I’m not sure what the best way to fix this is.
fun->inverse.param ends up with nonsensical values:

(gdb) run
Starting program: /home/steve/Debian/units/units -v
Currency exchange rates from FloatRates (USD base) on 2020-11-15
3679 units, 109 prefixes, 114 nonlinear units

You have: cm
You want: brwiregauge

Program received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
65 ../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory.
(gdb) bt
#0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
#1 0x00007ffff7c8cf76 in __vfprintf_internal (s=0x7ffff7de06a0 <_IO_2_1_stdout_>,
format=format@entry=0x555555568f6d "\t%s = %s(", ap=ap@entry=0x7fffffffd540, mode_flags=mode_flags@entry=2)
at vfprintf-internal.c:1688
#2 0x00007ffff7d2ce88 in ___vfprintf_chk (fp=<optimized out>, flag=flag@entry=1, format=format@entry=0x555555568f6d "\t%s = %s(",
ap=ap@entry=0x7fffffffd540) at vfprintf_chk.c:29
#3 0x00005555555584a5 in vprintf (__ap=0x7fffffffd540, __fmt=0x555555568f6d "\t%s = %s(")
at /usr/include/x86_64-linux-gnu/bits/stdio2.h:120
#4 logprintf (format=format@entry=0x555555568f6d "\t%s = %s(") at units.c:415
#5 0x000055555555e605 in showfunc (havestr=0x5555555dd900 "cm", have=have@entry=0x5555555703a0 <have>, fun=0x5555556005c0)
at units.c:2976
#6 0x0000555555557e25 in main (argc=<optimized out>, argv=<optimized out>) at units.c:6267
(gdb) up
#1 0x00007ffff7c8cf76 in __vfprintf_internal (s=0x7ffff7de06a0 <_IO_2_1_stdout_>,
format=format@entry=0x555555568f6d "\t%s = %s(", ap=ap@entry=0x7fffffffd540, mode_flags=mode_flags@entry=2)
at vfprintf-internal.c:1688
1688 vfprintf-internal.c: No such file or directory.
(gdb) up
#2 0x00007ffff7d2ce88 in ___vfprintf_chk (fp=<optimized out>, flag=flag@entry=1, format=format@entry=0x555555568f6d "\t%s = %s(",
ap=ap@entry=0x7fffffffd540) at vfprintf_chk.c:29
29 vfprintf_chk.c: No such file or directory.
(gdb) up
#3 0x00005555555584a5 in vprintf (__ap=0x7fffffffd540, __fmt=0x555555568f6d "\t%s = %s(")
at /usr/include/x86_64-linux-gnu/bits/stdio2.h:120
120 return __vfprintf_chk (stdout, __USE_FORTIFY_LEVEL - 1, __fmt, __ap);
(gdb) up
#4 logprintf (format=format@entry=0x555555568f6d "\t%s = %s(") at units.c:415
415 vprintf(format, args);
(gdb) up
#5 0x000055555555e605 in showfunc (havestr=0x5555555dd900 "cm", have=have@entry=0x5555555703a0 <have>, fun=0x5555556005c0)
at units.c:2976
2976 logprintf("\t%s = %s(", havestr, fun->inverse.param);
(gdb) print *fun
$1 = {name = 0x5555556005a0 "brwiregauge", forward = {param = 0x6900000077 <error: Cannot access memory at address 0x6900000077>,
def = 0x6500000072 <error: Cannot access memory at address 0x6500000072>,
dimen = 0x6100000067 <error: Cannot access memory at address 0x6100000067>, domain_min = 0x6700000075,
domain_max = 0x5b00000065, domain_min_open = 105, domain_max_open = 110}, inverse = {
param = 0x200000005d <error: Cannot access memory at address 0x200000005d>,
def = 0x2000000020 <error: Cannot access memory at address 0x2000000020>,
dimen = 0x2000000020 <error: Cannot access memory at address 0x2000000020>, domain_min = 0x2000000020,
domain_max = 0x2000000020, domain_min_open = 45, domain_max_open = 54}, table = 0x5555555bc500, tablelen = 16,
tableunit = 0x555555600660 "in", next = 0x5555555d44f0, skip_error_check = 0, linenumber = 5857,
file = 0x555555589a40 "/usr/share/units/definitions.units"}


Regards,

Stephen


Begin forwarded message:

Date: Thu, 13 Jan 2022 19:20:31 -0600
From: "Owen T. Heisler" <owen...@gmail.com>
To: Debian Bug Tracking System <sub...@bugs.debian.org>
Subject: Bug#1003708: units: Segmentation fault on certain conversions in
verbose mode