File rxvt-unicode-9.22-perl_environ_segfault.patch of Package rxvt-unicode

Overview Repositories Revisions Requests Users Attributes Meta

File rxvt-unicode-9.22-perl_environ_segfault.patch of Package rxvt-unicode (Revision 3db2ed610be901bbe4ceaf2e33abc675)

Currently displaying revision 3db2ed610be901bbe4ceaf2e33abc675 , Show latest

Do not segfault when calling perl_destruct from the rxvt_perl_interp dtor

When closing urxvt, a segfault happens:

(gdb) run 
Starting program: /usr/bin/urxvt 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[Detaching after fork from child process 12209]

Program received signal SIGSEGV, Segmentation fault.
__GI_getenv (name=0x7ffff7a6daf8 "RL_DESTRUCT_LEVEL", name@entry=0x7ffff7a6daf6 "PERL_DESTRUCT_LEVEL") at getenv.c:84
84		  if (name_start == ep_start && !strncmp (*ep + 2, name, len)
(gdb) bt
#0  __GI_getenv (name=0x7ffff7a6daf8 "RL_DESTRUCT_LEVEL", name@entry=0x7ffff7a6daf6 "PERL_DESTRUCT_LEVEL") at getenv.c:84
#1  0x00007ffff7912523 in Perl_mortal_getenv (str=0x7ffff7a6daf6 "PERL_DESTRUCT_LEVEL") at inline.h:2621
#2  perl_destruct (my_perl=0x5555556d1d60) at perl.c:616
#3  0x00005555555a7065 in rxvt_perl_interp::~rxvt_perl_interp (this=<optimized out>, this=<optimized out>) at ./rxvtperl.xs:379
#4  0x00007ffff76cf2c7 in __run_exit_handlers (status=0, listp=0x7ffff7853598 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, 
    run_dtors=run_dtors@entry=true) at exit.c:108
#5  0x00007ffff76cf470 in __GI_exit (status=<optimized out>) at exit.c:139
#6  0x00007ffff76b7159 in __libc_start_main (main=0x555555581f00 <main(int, char**)>, argc=1, argv=0x7fffffffe138, init=<optimized out>, 
    fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe128) at ../csu/libc-start.c:348
#7  0x000055555558624e in _start () at ../sysdeps/x86_64/start.S:120
(gdb)

When closing urxvt, the rxvt_term::destroy_cb method is eventually called,
which calls make_current() and afterwards destroys itself ("delete this;").
make_current indirectly assigns "env", which is a member of the rxvt_term
struct, to "environ". When calling the rxvt_term::~rxvt_term destructor,
the "env" member is explicitly destroyed ("delete [] env;"). Consequently,
"environ" points to freed memory.
Eventually, the rxvt_perl_interp::~rxvt_perl_interp dtor is called, which
calls perl_destruct(...), which eventually calls getenv(...) (see the
backtrace above). Since getenv dereferences "__environ"/"environ", a use
after free happens.
In order to fix this, we have to ensure that "environ" is not dangling.
From a quick glance at the code, setting "environ" to the "perl_environ"
seems to be a reasonable choice (that's what the other code in rxvtperl.xs
also does).

Version information:
rxvt-unicode-9.22
perl-5.32.0

Signed-off-by: Marcus Huewe <suse-tux@gmx.de>
Index: a/src/rxvtperl.xs
===================================================================
--- a/src/rxvtperl.xs.orig
+++ b/src/rxvtperl.xs
@@ -376,6 +376,7 @@ rxvt_perl_interp::~rxvt_perl_interp ()
 {
   if (perl)
     {
+      localise_env set_environ (perl_environ);
       perl_destruct (perl);
       perl_free (perl);
       PERL_SYS_TERM ();

Places

File rxvt-unicode-9.22-perl_environ_segfault.patch of Package rxvt-unicode (Revision 3db2ed610be901bbe4ceaf2e33abc675)

Places