patch for segfault freeing uninitialized memory

Eric Nadler enadler at watchguardvideo.com
Tue Mar 27 22:19:07 UTC 2012


I'm using the live555 library to stream H.264 video on an embedded Linux
system.  Using the live555 testOnDemandRTSPServer function I get a segfault
starting to stream H.264 video to VLC.

I've patched the error as I see it.  It looks to me like the base structure is
not fully initialized with 0 (only a subset of the structure is initialized).
This later results in a free of base->collate.index2weight in _locale_set_l.
This free tries to free uninitialized memory and segfaults.  My patch fully
zeros out the structure.

It doesn't appear that this code is changed in the current git tip from the
0.9.32 version I am using and tested with.

Note that this patch avoids the segfault.  However, my guess is that there
might still be some code in this area which is not working.  Looking at the GNU
C library it initializes the structure with the C locale if no other locale is
specified.

--- uClibc-0.9.32/libc/misc/locale/locale.c	2011-06-08 14:35:20.000000000 -0500
+++ uClibc-0.9.32-modified/libc/misc/locale/locale.c	2012-03-18
15:23:09.000000000 -0500
@@ -1295,6 +1295,7 @@
 		base = malloc(sizeof(struct __uclibc_locale_struct));
 		if (base == NULL)
 			return base;
+                memset(base, 0, sizeof(struct __uclibc_locale_struct));
 		_locale_init_l(base);
 	}


I wrote this as a bug but I thought it might be appropriate to also
send the patch to the list.

The bug is here: https://bugs.busybox.net/show_bug.cgi?id=4964

-- 
Sincerely,

Eric Nadler
Senior Software Engineer
WatchGuard Video

(469) 867-3735  Mobile
(972) 423-9778  Fax
ENadler at WatchGuardVideo.com
http://www.WatchGuardVideo.com
Visit our New Blog! <http://watchguardvideo.wordpress.com>

415 Century Parkway, Allen, TX 75013


More information about the uClibc mailing list