locate crashes when searching a string with >= 10 characters enclosed in *

[Michael Hamann]

Binary package hint: slocate

locate crashes when I search for a string with ten or more characters, enclosed in *, for example:

michael@pcmichitux:~$ locate *spidermonkey*
/home/michael/.eclipse/org.eclipse.sdk.ide/updates/eclipse/plugins/com.aptana.ide.documentation_0.2.6.11923/libraries/Dojo 0.3.1/lib/dojo/src/hostenv_spidermonkey.js
/home/michael/.eclipse/org.eclipse.sdk.ide/updates/eclipse/plugins/com.aptana.ide.documentation_0.2.7.12430/libraries/Dojo 0.3.1/lib/dojo/src/hostenv_spidermonkey.js
*** glibc detected *** locate: double free or corruption (fasttop): 0x08051778 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7e1e8bd]
/lib/tls/i686/cmov/libc.so.6(__libc_free+0x84)[0xb7e1ea44]
locate[0x804af79]
locate[0x804aded]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc)[0xb7dcd8cc]
locate[0x8049251]
======= Memory map: ========
08048000-0804f000 r-xp 00000000 08:07 56006 /usr/bin/slocate
0804f000-08050000 rw-p 00007000 08:07 56006 /usr/bin/slocate
08050000-08071000 rw-p 08050000 00:00 0 [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0
b7c21000-b7d00000 ---p b7c21000 00:00 0
b7d83000-b7d8c000 r-xp 00000000 08:07 4987 /lib/tls/i686/cmov/libnss_files-2.4.so
b7d8c000-b7d8e000 rw-p 00008000 08:07 4987 /lib/tls/i686/cmov/libnss_files-2.4.so
b7d8e000-b7d96000 r-xp 00000000 08:07 6281 /lib/tls/i686/cmov/libnss_nis-2.4.so
b7d96000-b7d98000 rw-p 00007000 08:07 6281 /lib/tls/i686/cmov/libnss_nis-2.4.so
b7d98000-b7daa000 r-xp 00000000 08:07 4984 /lib/tls/i686/cmov/libnsl-2.4.so
b7daa000-b7dac000 rw-p 00011000 08:07 4984 /lib/tls/i686/cmov/libnsl-2.4.so
b7dac000-b7dae000 rw-p b7dac000 00:00 0
b7dae000-b7db5000 r-xp 00000000 08:07 4985 /lib/tls/i686/cmov/libnss_compat-2.4.so
b7db5000-b7db7000 rw-p 00006000 08:07 4985 /lib/tls/i686/cmov/libnss_compat-2.4.so
b7db7000-b7db8000 rw-p b7db7000 00:00 0
b7db8000-b7ee5000 r-xp 00000000 08:07 4977 /lib/tls/i686/cmov/libc-2.4.so
b7ee5000-b7ee7000 r--p 0012c000 08:07 4977 /lib/tls/i686/cmov/libc-2.4.so
b7ee7000-b7ee9000 rw-p 0012e000 08:07 4977 /lib/tls/i686/cmov/libc-2.4.so
b7ee9000-b7eec000 rw-p b7ee9000 00:00 0
b7ef2000-b7efc000 r-xp 00000000 08:07 1254 /lib/libgcc_s.so.1
b7efc000-b7efd000 rw-p 00009000 08:07 1254 /lib/libgcc_s.so.1
b7efd000-b7f00000 rw-p b7efd000 00:00 0
b7f00000-b7f19000 r-xp 00000000 08:07 10713 /lib/ld-2.4.so
b7f19000-b7f1b000 rw-p 00018000 08:07 10713 /lib/ld-2.4.so
bff1f000-bff35000 rw-p bff1f000 00:00 0 [stack]
ffffe000-fffff000 ---p 00000000 00:00 0 [vdso]
Aborted

I use Ubuntu 6.10 with all updates until now.

I tested strings like *testtestet*, too, locate crashes too. But with one char less (*testteste*) locate doesn't crash.

[Brian Murray (brian-murray)]

I am unable to recreate the issue you have reported. I have tried searching for a ten character string between *'s and have not had locate crash. I am running Ubuntu 6.10 (edgy) and have slocate version 3.1-1 and libc6 version 2.4-1ubuntu12 installed. Could you provide the exact version numbers of the packages that you have installed? Also when you search for "*testtestet*" does that return anything?

Thanks,

Brian

[Michael Hamann (ubuntu-content-space)]

I have slocate 3.1-1 and libc6 2.4-1ubuntu12 installed, too.
I have pasted the output of locate "*testtestet*" below:

michael@pcmichitux:~$ locate "*testtestet*"
*** glibc detected *** locate: double free or corruption (fasttop): 0x08051778 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb7e578bd]
/lib/tls/i686/cmov/libc.so.6(__libc_free+0x84)[0xb7e57a44]
locate[0x804af79]
locate[0x804aded]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xdc)[0xb7e068cc]
locate[0x8049251]
======= Memory map: ========
08048000-0804f000 r-xp 00000000 08:07 56006 /usr/bin/slocate
0804f000-08050000 rw-p 00007000 08:07 56006 /usr/bin/slocate
08050000-08071000 rw-p 08050000 00:00 0 [heap]
b7c00000-b7c21000 rw-p b7c00000 00:00 0
b7c21000-b7d00000 ---p b7c21000 00:00 0
b7db1000-b7dbb000 r-xp 00000000 08:07 1254 /lib/libgcc_s.so.1
b7dbb000-b7dbc000 rw-p 00009000 08:07 1254 /lib/libgcc_s.so.1
b7dbc000-b7dc5000 r-xp 00000000 08:07 4987 /lib/tls/i686/cmov/libnss_files-2.4.so
b7dc5000-b7dc7000 rw-p 00008000 08:07 4987 /lib/tls/i686/cmov/libnss_files-2.4.so
b7dc7000-b7dcf000 r-xp 00000000 08:07 6281 /lib/tls/i686/cmov/libnss_nis-2.4.so
b7dcf000-b7dd1000 rw-p 00007000 08:07 6281 /lib/tls/i686/cmov/libnss_nis-2.4.so
b7dd1000-b7de3000 r-xp 00000000 08:07 4984 /lib/tls/i686/cmov/libnsl-2.4.so
b7de3000-b7de5000 rw-p 00011000 08:07 4984 /lib/tls/i686/cmov/libnsl-2.4.so
b7de5000-b7de7000 rw-p b7de5000 00:00 0
b7de7000-b7dee000 r-xp 00000000 08:07 4985 /lib/tls/i686/cmov/libnss_compat-2.4.so
b7dee000-b7df0000 rw-p 00006000 08:07 4985 /lib/tls/i686/cmov/libnss_compat-2.4.so
b7df0000-b7df1000 rw-p b7df0000 00:00 0
b7df1000-b7f1e000 r-xp 00000000 08:07 4977 /lib/tls/i686/cmov/libc-2.4.so
b7f1e000-b7f20000 r--p 0012c000 08:07 4977 /lib/tls/i686/cmov/libc-2.4.so
b7f20000-b7f22000 rw-p 0012e000 08:07 4977 /lib/tls/i686/cmov/libc-2.4.so
b7f22000-b7f25000 rw-p b7f22000 00:00 0
b7f37000-b7f39000 rw-p b7f37000 00:00 0
b7f39000-b7f52000 r-xp 00000000 08:07 10713 /lib/ld-2.4.so
b7f52000-b7f54000 rw-p 00018000 08:07 10713 /lib/ld-2.4.so
bf9a1000-bf9b6000 rw-p bf9a1000 00:00 0 [stack]
ffffe000-fffff000 ---p 00000000 00:00 0 [vdso]
Aborted
michael@pcmichitux:~$

I know that others can't reproduce this bug and I don't know why I can reproduce this bug (also after reboots). I have installed debsums, but it reports nothing for libc6 or slocate. If there is anything I could check, please tell me.

[Brian Murray (brian-murray)]

The database used by locate is found at /var/cache/locate/locatedb . I wonder if it might be something particular in the database itself. I would backup a copy of the database and then run updatedb as root so a new one is created. Then try using locate again. Also what type of processor do you have?