Bug#452789: xxd segfaults with large values for -c

[James Vega]

Bram,

Large values for the -c option (approximately 100 or greater) cause xxd
to segfault.  Where the segfault occurs seems to vary based on how large the
columns option is.

I get this traceback when running "xxd -b -c 100 /usr/bin/xxd".

  Program terminated with signal 11, Segmentation fault.
  #0  0xb7e6ce0d in getc () from /lib/i686/cmov/libc.so.6
  (gdb) bt full
  #0  0xb7e4ce0d in getc () from /lib/i686/cmov/libc.so.6
  No symbol table info available.
  #1  0x0804a0a2 in main (argc=2, argv=0xbfb6e3c0) at xxd.c:731
      fp = (FILE *) 0x2e04c008
      fpo = (FILE *) 0xb7f344e0
      c = 16
      e = 127
      p = 1
      relseek = 1
      negseek = 0
      revert = 0
      cols = 100
      nonzero = 1
      autoskip = 0
      hextype = 3
      ebcdic = 0
      octspergrp = 1
      grplen = 9
      length = -1
      n = 1
      seekoff = 0
      l = "0000000: 01111111", ' ' <repeats 889 times>
      pname = 0xbfb6f984 "xxd"
      pp = 0xbfb6f992 "/usr/bin/xxd"
  #2  0xb7e01450 in __libc_start_main () from /lib/i686/cmov/libc.so.6
  No symbol table info available.
  #3  0x08048851 in _start ()
  No symbol table info available.

Yet when running "xxd -b -c 1000 /usr/bin/xxd" I get the following.

  Program terminated with signal 11, Segmentation fault.
  #0  0x08049feb in main (argc=2, argv=0xbfc6acb0) at xxd.c:753
  753	      l[11 + (grplen * cols - 1)/octspergrp + p] =
  (gdb) bt full
  #0  0x08049feb in main (argc=2, argv=0xbfc6acb0) at xxd.c:753
      fp = (FILE *) 0x804c008
      fpo = (FILE *) 0xb7f354e0
      c = 16
      e = 127
      p = 0
      relseek = 1
      negseek = 0
      revert = 0
      cols = 1000
      nonzero = 0
      autoskip = 0
      hextype = 3
      ebcdic = 0
      octspergrp = 1
      grplen = 9
      length = -1
      n = 0
      seekoff = 0
      l = "0000000: 01111111", ' ' <repeats 889 times>
      pname = 0xbfc6b983 "xxd"
      pp = 0xbfc6b992 "/usr/bin/xxd"
  #1  0xb7e02450 in __libc_start_main () from /lib/i686/cmov/libc.so.6
  No symbol table info available.
  #2  0x08048851 in _start ()
  No symbol table info available.

The above tracebacks were generated after building xxd with no optimizations.

James
-- 
GPG Key: 1024D/61326D40 2003-09-02 James Vega <jamessan at debian.org>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: Digital signature
Url : http://lists.alioth.debian.org/pipermail/pkg-vim-maintainers/attachments/20071125/4cf4174b/attachment-0001.pgp