segfault in JSClose

[Maximilian Schwerin]

Binary package hint: libjsw2

Hi,

in the current version of libjsw2 calling JSClose may result in a seg fault. I submitted a patch to the package authors about a year ago and this was fixed in version 1.5.6.

Updating the package should help...

Cheers, Maximilian

[Maximilian Schwerin (mschwerin)]

Hi,

I'm not completely sure if you're the right person to contact (the
website is not really clear about who is responsible for libjsw).

But anyway here goes:

I'm having problems with libjsw-1.5.5 segfaulting (no joystick
attached).

Here is a stacktrace:

Program received signal SIGABRT, Aborted.
[Switching to Thread 16384 (LWP 25861)]
0xb76ee191 in kill () from /lib/libc.so.6
(gdb) bt
#0 0xb76ee191 in kill () from /lib/libc.so.6
#1 0xb7e76131 in pthread_kill () from /lib/libpthread.so.0
#2 0xb7e764ab in raise () from /lib/libpthread.so.0
#3 0xb76edf24 in raise () from /lib/libc.so.6
#4 0xb76ef3ed in abort () from /lib/libc.so.6
#5 0xb772047c in __fsetlocking () from /lib/libc.so.6
#6 0xb772a296 in mallopt () from /lib/libc.so.6
#7 0xb7728f7f in mallopt () from /lib/libc.so.6
#8 0xb7727b9f in free () from /lib/libc.so.6
#9 0xb77e2404 in JSClose () from /usr/lib/libjsw.so
#10 0xb77e1dee in JSInit () from /usr/lib/libjsw.so
#11 0x0805b26c in open_jsw () at odk_joystick.c:90

This is reproducable. If I'd have to guess, JSInit can't open the device
and calls JSClose in main.c:142.

In JSClose the free of jsd->name (main.c:463) fails because jsd->name
has so far not been assigned a value.

I've attached a patch which fixes the problem...

Cheers, Maximilian

p.s.: Please tell me, if you're not the person to send this to.

[Maximilian Schwerin (mschwerin)]

From: <email address hidden>
To: mschwerin
Subject: Re: libjsw-1.5.5 segfaults
Date: Thu, 30 Mar 2006 21:24:24 -0800 (Fr, 07:24 CEST)

Hi, yes this is the correct address, it's listed in the contacts list as
the address to send all support questions to and the libjsw's AUTHORS file
should specify the address to that page.

Thanks for submitting the patch, I'll make the changes as needed.

The problem appears to be that jsd->name was not reset to NULL. This is
the fix that is needed since free() will not actually try to delete a NULL
pointer.

I'll try to release libjsw 1.5.6 shortly.

-Tara

[Sarah Kowalik (hobbsee-deactivatedaccount)]

fixed, thanks.