Bug 4964

Summary: segfault freeing uninitialized memory
Product: uClibc Reporter: Eric Nadler <exnadler>
Component: LocalesAssignee: unassigned
Status: RESOLVED FIXED    
Severity: major CC: exnadler, uclibc-cvs
Priority: P5    
Version: 0.9.32   
Target Milestone: ---   
Hardware: Other   
OS: Linux   
Host: Target:
Build:

Description Eric Nadler 2012-03-21 18:41:14 UTC
I'm using the live555 library to stream H.264 video on an embedded Linux system.  Using the live555 testOnDemandRTSPServer function I get a segfault starting to stream H.264 video to VLC.

I've patched the error as I see it.  It looks to me like the base structure is not fully initialized with 0 (only a subset of the structure is initialized).  This later results in a free of base->collate.index2weight in _locale_set_l.  This free tries to free uninitialized memory and segfaults.  My patch fully zeros out the structure.

It doesn't appear that this code is changed in the current git tip from the 0.9.32 version I am using and tested with.

Note that this patch avoids the segfault.  However, my guess is that there might still be some code in this area which is not working.  Looking at the GNU C library it initializes the structure with the C locale if no other locale is specified.

--- uClibc-0.9.32/libc/misc/locale/locale.c	2011-06-08 14:35:20.000000000 -0500
+++ uClibc-0.9.32-modified/libc/misc/locale/locale.c	2012-03-18 15:23:09.000000000 -0500
@@ -1295,6 +1295,7 @@
 		base = malloc(sizeof(struct __uclibc_locale_struct));
 		if (base == NULL)
 			return base;
+                memset(base, 0, sizeof(struct __uclibc_locale_struct));
 		_locale_init_l(base);
 	}
Comment 1 Bernhard Reutner-Fischer 2012-04-17 21:27:22 UTC
Fixed in 15d28c8ce0a7f2d59edd7f068e931041d68511e2
Thanks!