Follow-up Comment #1, bug #68360 (group screen): I am seeing a regular crash in screen 5.0.2-2 on Arch Linux which leaves the session in state "Dead ???". The backtrace fits this bug report.
```
Program terminated with signal SIGABRT, Aborted.
Downloading 4.48 K source file /usr/src/debug/glibc/glibc/nptl/pthread_kill.c
#0 __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
44 return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO
(ret)
: 0;
(gdb) bt
#0 __pthread_kill_implementation (threadid=<optimized out>,
signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1 0x00007fa7de49a243 in __pthread_kill_internal (threadid=<optimized out>,
signo=6) at pthread_kill.c:89
#2 0x00007fa7de43e5d0 in __GI_raise (sig=sig@entry=6) at
../sysdeps/posix/raise.c:26
#3 0x00007fa7de425685 in __GI_abort () at abort.c:77
#4 0x00007fa7de426704 in __libc_message_impl
(vma_name=vma_name@entry=0x7fa7de5b9916 "glibc: fatal",
fmt=fmt@entry=0x7fa7de5bcf65 "%s\n")
at ../sysdeps/posix/libc_fatal.c:138
#5 0x00007fa7de4a482c in __libc_message_wrapper (vmaname=0x7fa7de5b9916
"glibc: fatal", fmt=0x7fa7de5bcf65 "%s\n") at ../include/stdio.h:203
#6 malloc_printerr (str=str@entry=0x7fa7de5bae01 "realloc(): invalid next
size") at malloc.c:5093
#7 0x00007fa7de4a812c in _int_realloc (av=av@entry=0x7fa7de619ac0
<main_arena>, oldp=oldp@entry=0x562787a5f7b0, oldsize=<optimized out>,
nb=<optimized out>) at malloc.c:4287
#8 0x00007fa7de4a92b3 in __GI___libc_realloc
(oldmem=oldmem@entry=0x562787a5f7c0, bytes=bytes@entry=544) at malloc.c:3268
#9 0x0000562756edc4fd in xrealloc (mem=<optimized out>, len=544) at
/usr/src/debug/screen/screen/src/resize.c:440
#10 CheckMaxSize (wi=wi@entry=135) at
/usr/src/debug/screen/screen/src/resize.c:380
#11 0x0000562756ee3dfd in ChangeScreenSize (wi=135, wi@entry=22055, he=71,
he@entry=1458675720, change_fore=change_fore@entry=1)
at /usr/src/debug/screen/screen/src/resize.c:127
#12 0x0000562756ee4042 in CheckScreenSize (change_flag=change_flag@entry=1) at
/usr/src/debug/screen/screen/src/resize.c:99
#13 0x0000562756ee83cf in ReceiveMsg () at
/usr/src/debug/screen/screen/src/socket.c:847
#14 0x0000562756e9fb40 in sched () at
/usr/src/debug/screen/screen/src/sched.c:200
#15 main (argc=0, argv=<optimized out>) at
/usr/src/debug/screen/screen/src/screen.c:1152
```
If a window resize with wi == maxwidth first causes the required reallocation
to be skipped and then subsequently leads to an out-of-bounds write, the next
realloc() could run into corrupted metadata in the adjacent heap chunk and
abort with "invalid next size".
Would be nice to see the patch adopted.
_______________________________________________________
Reply to this item at:
<https://savannah.gnu.org/bugs/?68360>
_______________________________________________
Message sent via Savannah
https://savannah.gnu.org/
signature.asc
Description: PGP signature
