[Bug 1739505] Re: segfault on simple script that involves eval

[Graham Inggs]

** Also affects: csh (Ubuntu Disco)
   Importance: Undecided
   Status: New

** Also affects: csh (Ubuntu Bionic)
   Importance: Undecided
   Status: New

** Summary changed:

- segfault on simple script that involves eval
+ [SRU] segfault on simple script that involves eval

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  [SRU] segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Launchpad Bug Tracker]

This bug was fixed in the package csh - 20110502-4ubuntu1

---
csh (20110502-4ubuntu1) eoan; urgency=medium

  * Fix segfault on "eval", thanks Keith Thompson (LP: #1739505)

 -- Graham Inggs   Sat, 21 Sep 2019 01:32:46 +

** Changed in: csh (Ubuntu)
   Status: Confirmed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Bug Watch Updater]

** Changed in: csh (Debian)
   Status: Unknown => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Hans Joachim Desserud]

** Also affects: csh (Debian) via
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933057
   Importance: Unknown
   Status: Unknown

** Tags removed: artful
** Tags added: bionic disco eoan patch

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Keith Thompson]

I've submitted a report for this same bug on Debian 10.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933057

** Bug watch added: Debian Bug tracker #933057
   https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=933057

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Keith Thompson]

I've found the cause of the problem. It can be fixed by grabbing the
latest csh sources from OpenBSD and removing one of the Debian patches.

I've examined the csh sources obtained by running "apt-get source csh",
and the upstream OpenBSD csh sources from https://github.com/openbsd/src .

In the OpenBSD version from which the Debian/Ubuntu version was copied,
lex.c contains the following lines:

if ((evalp = *evalvec) != '\0') {
evalvec++;
goto top;
}

evalp is a pointer, so the comparison should be to NULL, not '\0'.

debian/patches/pointer_deref_comparison.patch changes the first line to:

if (*(evalp = *evalvec) != '\0') {

This fixes the compiler warning for comparing a pointer to '\0', but
it causes a segmentation fault if &evalvec is a null pointer -- which
happens whenever the "eval" command is invoked.  It's line 1330 of lex.c
in the patched csh 20110502-3 sources on Ubuntu 18.04.2 LTS package.

A later OpenBSD version of the csh sources changes that line to:

if ((evalp = *evalvec) != NULL) {

The change was made in commit bdb0dae4088 in
https://github.com/openbsd/src on 2018-09-19

The same problem occurs with csh 20110502-4 on Debian 10.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Stéphane Téletchéa]

I can confirm this bug is present, and more serious than what you think
...

I am using a proprietary software meant for RHEL (and certified with). I
have already prevented the switch to ubuntu 16.04 to 18.04 because this
software was not working anymore (the segfault you see for bsd-csh).

It came to me that the reason could be csh (I'm installing tcsh as a csh
replacement for years). It is only while searching for the alternatives
csh location that I realized it was pointing towards the bsd
(segfaulting bsd csh ...).

This is a non-trivial issue, and its priority should be highly increased, 
especially for a long-term edition meant to be there for years ...
Being a former QA employee in another company, I can tell this bug's priority 
and importance has to be increased ...

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Keith Thompson]

I've run into this myself in Ubuntu 18.04 and 18.10.

I have not found any "eval" command that does not cause bsd-csh to die
with a segmentation fault.  For example:

$ bsd-csh -f
% eval date
Segmentation fault (core dumped)

I downloaded the source tarball for csh_20110502, compiled it with "gcc
-g", and reproduced the problem under gdb:

$ gdb ./csh 
GNU gdb (Ubuntu 8.1-0ubuntu3) 8.1.0.20180409-git
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 

This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./csh...done.
(gdb) run -f
Starting program: /home/kst/src/csh/csh-20110502/csh -f
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
% eval date

Program received signal SIGSEGV, Segmentation fault.
0x5556e369 in readc (wanteof=0) at lex.c:1330
1330if (*(evalp = *evalvec) != '\0') {
(gdb) where
#0  0x5556e369 in readc (wanteof=0) at lex.c:1330
#1  0x5556b66f in getC1 (flag=3) at lex.c:384
#2  0x5556b440 in word () at lex.c:329
#3  0x5556ac94 in lex (hp=0x55783450 ) at lex.c:164
#4  0xa9f0 in process (catch=0) at csh.c:1046
#5  0x55567f44 in doeval (v=0x5578af60, t=0x5578ae80) at 
func.c:1396
#6  0x55564daf in func (t=0x5578ae80, bp=0x55781018 
) at func.c:113
#7  0x5557589b in execute (t=0x5578ae80, wanttty=6242, 
pipein=0x0, pipeout=0x0) at sem.c:370
#8  0x55575b78 in execute (t=0x5578ae40, wanttty=6242, 
pipein=0x0, pipeout=0x0) at sem.c:418
#9  0xab48 in process (catch=1) at csh.c:1088
#10 0x9375 in main (argc=0, argv=0x7fffe638) at csh.c:553
(gdb) quit
A debugging session is active.

Inferior 1 [process 6242] will be killed.

Quit anyway? (y or n) y
$ 

I'll note that this problem has not inconvenienced me, and I expect that
most csh users would be using tcsh, which is not affected by this bug.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[ole.tange]

This worked in 16.04:

eval if'($?_vARnAmE) echo continue'

but segfaults now, and is probably the same or a very related problem.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[James Bray]

bsd-csh is still segfaulting on the "eval" command in the 18.04 daily
snapshot.

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Launchpad Bug Tracker]

Status changed to 'Confirmed' because the bug affects multiple users.

** Changed in: csh (Ubuntu)
   Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

[Bug 1739505] Re: segfault on simple script that involves eval

[Hans Joachim Desserud]

** Tags added: artful

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/1739505

Title:
  segfault on simple script that involves eval

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/csh/+bug/1739505/+subscriptions

-- 
ubuntu-bugs mailing list
ubuntu-bugs@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs