userpref_get_config_dir() segfaults when $HOME is undefined
Reported by Davide Pesavento | April 17th, 2012 @ 10:52 PM | in 1.2.0 Release
When I plug in my iPod Touch (4th gen.), upowerd crashes with the following stack trace. I have libimobiledevice-1.1.4 and UPower-0.9.15 installed.
Program received signal SIGSEGV, Segmentation fault.
__strcpy_chk () at ../sysdeps/x86_64/strcpy_chk.S:71
71 ../sysdeps/x86_64/strcpy_chk.S: File o directory non esistente.
(gdb) bt
#0 __strcpy_chk () at ../sysdeps/x86_64/strcpy_chk.S:71
#1 0x00007fdc47ee4eb8 in strcpy (__src=<optimized out>, __dest=0x7fdc480f5640 "") at /usr/include/bits/string3.h:105
#2 userpref_get_config_dir () at userpref.c:128
#3 0x00007fdc47ee55b4 in userpref_get_host_id (host_id=0x7fff6bdc8760) at userpref.c:406
#4 0x00007fdc47ee8d7d in lockdownd_client_new_with_handshake (device=<optimized out>, client=0x7fff6bdc87f0, label=<optimized out>) at lockdown.c:717
#5 0x0000000000412deb in up_device_idevice_coldplug (device=0x15cb540) at up-device-idevice.c:105
#6 0x000000000040b069 in up_device_coldplug (device=0x15cb540, daemon=<optimized out>, native=0x15c9230) at up-device.c:548
#7 0x00000000004119cb in up_backend_device_new (native=0x15c9230, backend=0x15afcf0) at up-backend.c:128
#8 up_backend_device_add (backend=0x15afcf0, native=0x15c9230) at up-backend.c:229
#9 0x00007fdc48425aa2 in g_closure_invoke (closure=0x15b7af0, return_value=0x0, n_param_values=3, param_values=0x7fff6bdc8a90, invocation_hint=<optimized out>) at gclosure.c:777
#10 0x00007fdc48436c5b in signal_emit_unlocked_R (node=<optimized out>, detail=0, instance=0x159cc40, emission_return=0x0, instance_and_params=0x7fff6bdc8a90) at gsignal.c:3547
#11 0x00007fdc4843eecd in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=0, var_args=<optimized out>) at gsignal.c:3296
#12 0x00007fdc4843f053 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3352
#13 0x00007fdc48667a73 in monitor_event (source=<optimized out>, condition=<optimized out>, data=0x159cc40) at src/gudev/gudevclient.c:105
#14 0x00007fdc4813d579 in g_main_dispatch (context=0x1597580) at gmain.c:2515
#15 g_main_context_dispatch (context=0x1597580) at gmain.c:3052
#16 0x00007fdc4813d938 in g_main_context_iterate (context=0x1597580, block=1, dispatch=1, self=<optimized out>) at gmain.c:3123
#17 0x00007fdc4813dd2a in g_main_loop_run (loop=0x15b6380) at gmain.c:3317
#18 0x0000000000411149 in main (argc=1, argv=0x7fff6bdc9168) at up-main.c:308
(gdb) f 2
#2 userpref_get_config_dir () at userpref.c:128
128 strcpy(__config_dir, cdir);
The relevant code is:
const char *cdir = getenv("XDG_CONFIG_HOME");
if (!cdir) {
cdir = getenv("HOME");
strcpy(__config_dir, cdir);
It appears that both XDG_CONFIG_HOME and HOME are undefined in
the environment, thus cdir
is NULL and
strcpy()
crashes. This is a regression introduced with
the glib dependency removal.
Comments and changes to this ticket
-
Martin S. May 16th, 2012 @ 02:44 PM
- State changed from new to open
- Tag set to crash, getenv, userpref, xdg
- Assigned user set to Nikias Bassen
- Milestone set to 1.2.0 Release
- Milestone order changed from 190959 to 0
Which distro do you use?
-
Samuli Suominen August 5th, 2012 @ 01:10 PM
There is an duplicate ticket for this with a patch here:
http://libiphone.lighthouseapp.com/projects/27916-libiphone/tickets...
-
Bastien Nocera September 5th, 2012 @ 09:33 AM
This is a more complete patch than the one in ticket #273. It uses the same precedence as glib's g_get_user_config_dir() does.
-
Martin S. September 5th, 2012 @ 12:17 PM
- State changed from open to resolved
Thanks Bastien, looks fine. Pushed to master.
Please Sign in or create a free account to add a new ticket.
With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.
Create your profile
Help contribute to this project by taking a few moments to create your personal profile. Create your profile ยป
A project around supporting the iPhone in Linux.
See http://libimobiledevice.org
People watching this ticket
Attachments
Referenced by
- 273 [PATCH] fix segfault when running with $HOME unset http://libiphone.lighthouseapp.com/projects/27916-libiph...
- 273 [PATCH] fix segfault when running with $HOME unset Thanks, fixed in #265 and pushed to master.
- 331 Insecure tmp directory use The code in question, that uses "/tmp/root" for the user'...