Bug 4964 - segfault freeing uninitialized memory
Summary: segfault freeing uninitialized memory
Status: RESOLVED FIXED
Alias: None
Product: uClibc
Classification: Unclassified
Component: Locales (show other bugs)
Version: 0.9.32
Hardware: Other Linux
: P5 major
Target Milestone: ---
Assignee: unassigned
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2012-03-21 18:41 UTC by Eric Nadler
Modified: 2012-04-17 21:27 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Eric Nadler 2012-03-21 18:41:14 UTC
I'm using the live555 library to stream H.264 video on an embedded Linux system.  Using the live555 testOnDemandRTSPServer function I get a segfault starting to stream H.264 video to VLC.

I've patched the error as I see it.  It looks to me like the base structure is not fully initialized with 0 (only a subset of the structure is initialized).  This later results in a free of base->collate.index2weight in _locale_set_l.  This free tries to free uninitialized memory and segfaults.  My patch fully zeros out the structure.

It doesn't appear that this code is changed in the current git tip from the 0.9.32 version I am using and tested with.

Note that this patch avoids the segfault.  However, my guess is that there might still be some code in this area which is not working.  Looking at the GNU C library it initializes the structure with the C locale if no other locale is specified.

--- uClibc-0.9.32/libc/misc/locale/locale.c	2011-06-08 14:35:20.000000000 -0500
+++ uClibc-0.9.32-modified/libc/misc/locale/locale.c	2012-03-18 15:23:09.000000000 -0500
@@ -1295,6 +1295,7 @@
 		base = malloc(sizeof(struct __uclibc_locale_struct));
 		if (base == NULL)
 			return base;
+                memset(base, 0, sizeof(struct __uclibc_locale_struct));
 		_locale_init_l(base);
 	}
Comment 1 Bernhard Reutner-Fischer 2012-04-17 21:27:22 UTC
Fixed in 15d28c8ce0a7f2d59edd7f068e931041d68511e2
Thanks!