Bug#819713: osm2pgsql: segfault

[Sebastiaan Couwenberg]

Control: tags -1 confirmed

On 04/01/2016 11:39 AM, Edward Betts wrote:
> Sebastiaan Couwenberg <sebastic at xs4all.nl> wrote:
>> Thanks for the backtrace, but how do I reproduce the issue?
> 
> Command line: osm2pgsql --create --slim --database gis 1124039.xml 1155955.xml
> 
> Files: https://github.com/openstreetmap/osm2pgsql/files/199303/osm.zip (6.3M)
> 
> Reported upstream: https://github.com/openstreetmap/osm2pgsql/issues/564

Thanks for the reproducible test case, I can confirm the segfault now.

It may be that NULL values are passed by pgsql_execPrepared(), passing
NULL to strlen causes undefined behaviour, that may be what we're seeing
here.

I've attached the gdb output for my run with debug symbols installed.

Kind Regards,

Bas

-- 
 GPG Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146  50D1 6750 F10A E88D 4AF1
-------------- next part --------------
(gdb) run
Starting program: /usr/bin/osm2pgsql --create --slim --database osm-test 1124039.xml 1155955.xml
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
osm2pgsql SVN version 0.90.0 (64 bit id space)

Using built-in tag processing pipeline
Using projection SRS 900913 (Spherical Mercator)
Setting up table: planet_osm_point
Setting up table: planet_osm_line
Setting up table: planet_osm_polygon
Setting up table: planet_osm_roads
Allocating memory for dense node cache
Allocating dense node cache in one big chunk
Allocating memory for sparse node cache
Sharing dense sparse
Node-cache: cache=800MB, maxblocks=12800*65536, allocation method=11
Mid: pgsql, scale=100 cache=800
Setting up table: planet_osm_nodes
Setting up table: planet_osm_ways
Setting up table: planet_osm_rels

Reading in file: 1124039.xml
Using XML parser.
[New Thread 0x7fffb4701700 (LWP 23959)]
[New Thread 0x7fffb3f00700 (LWP 23960)]
[Thread 0x7fffb4701700 (LWP 23959) exited]
Processing: Node(110k 110.0k/s) Way(0k 0.00k/s) Relation(0 0.00/s)[Thread 0x7fffb3f00700 (LWP 23960) exited]
Processing: Node(138k 138.5k/s) Way(13k 6.92k/s) Relation(80 20.00/s)  parse time: 7s

Reading in file: 1155955.xml
Using XML parser.
[New Thread 0x7fffb3f00700 (LWP 23965)]
[New Thread 0x7fffb4701700 (LWP 23966)]

Program received signal SIGSEGV, Segmentation fault.
strlen () at ../sysdeps/x86_64/strlen.S:106
106     ../sysdeps/x86_64/strlen.S: No such file or directory.
(gdb) bt
#0  strlen () at ../sysdeps/x86_64/strlen.S:106
#1  0x00000000004c2853 in std::char_traits<char>::length (__s=0x0) at /usr/include/c++/5/bits/char_traits.h:267
#2  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::append (__s=0x0, this=0x7fffffffd0f0) at /usr/include/c++/5/bits/basic_string.h:1027
#3  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::operator+= (__s=0x0, this=0x7fffffffd0f0) at /usr/include/c++/5/bits/basic_string.h:951
#4  pgsql_execPrepared (sql_conn=<optimized out>, stmtName=stmtName at entry=0x4eb0d4 "insert_node", nParams=nParams at entry=4, paramValues=paramValues at entry=0x7fffffffd2d0, expect=expect at entry=PGRES_COMMAND_OK)
    at /build/osm2pgsql-0.90.0+ds/pgsql.cpp:130
#5  0x00000000004a4a6d in middle_pgsql_t::local_nodes_set (this=this at entry=0x745750, id=@0x7fffffffd418: 2554008024, lat=@0x7fffffffd410: 6031065.303948787, lon=@0x7fffffffd408: 859981.69412163331, tags=...)
    at /build/osm2pgsql-0.90.0+ds/middle-pgsql.cpp:352
#6  0x00000000004a4bcd in middle_pgsql_t::nodes_set (this=0x745750, id=2554008024, lat=6031065.303948787, lon=859981.69412163331, tags=...) at /build/osm2pgsql-0.90.0+ds/middle-pgsql.cpp:451
#7  0x0000000000469e79 in osmdata_t::node_add (this=0x7fffffffda30, id=2554008024, lat=lat at entry=6031065.303948787, lon=lon at entry=859981.69412163331, tags=...) at /build/osm2pgsql-0.90.0+ds/osmdata.cpp:33
#8  0x0000000000482227 in parse_osmium_t::node (this=this at entry=0x7fffffffdad0, node=...) at /build/osm2pgsql-0.90.0+ds/parse-osmium.cpp:151
#9  0x00000000004829e8 in osmium::detail::apply_item_recurse<parse_osmium_t, osmium::memory::Item> (handler=..., item=...) at /usr/include/osmium/visitor.hpp:63
#10 osmium::apply<osmium::io::InputIterator<osmium::io::Reader, osmium::memory::Item>, parse_osmium_t> (end=..., it=...) at /usr/include/osmium/visitor.hpp:236
#11 osmium::apply<osmium::io::Reader, parse_osmium_t> (c=...) at /usr/include/osmium/visitor.hpp:243
#12 parse_osmium_t::stream_file (this=this at entry=0x7fffffffdad0, filename="1155955.xml", fmt="auto") at /build/osm2pgsql-0.90.0+ds/parse-osmium.cpp:123
#13 0x000000000045f170 in main (argc=<optimized out>, argv=<optimized out>) at /build/osm2pgsql-0.90.0+ds/osm2pgsql.cpp:88
(gdb)