View Issue Details

IDProjectCategoryView StatusLast Update
0000633LDMud 3.3LPC Compiler/Preprocessorpublic2009-05-04 05:23
Reporterinvisible Assigned ToGnomi  
PrioritynormalSeveritycrashReproducibilitysometimes
Status resolvedResolutionfixed 
Fixed in Version3.3.719 
Summary0000633: Access of undefined/undeclared variable crashes 3.3.718 on amd64
DescriptionA call to a function, using an undeclared variable as argument *sometimes* (don't ask me why) crashes ldmud-3.3.718 compiled on amd64.

foo() - works (produces an "Undefined function 'foo' near ';'.", execution continues)

foo(bar) - crash after message "Variable bar not declared ! before ';'."

The segfault happens at line 10865 in prolang.y:
$$.type = V_VARIABLE(i)->type;

It seems, that V_VARIABLE(i) is NULL or another improper value when the variable is undefined. Strange thing: I'd expect this to crash *always* not only occasionally and not only on amd64.


The really annoing things about this bug are:

a) it happens only occasionally (some calls to "foo(bar)" just produce the error message compaining about the undefined variable 'bar' but the driver continues to work - as expected) - I really can't imagine why

b) it does *not* happen on our 'production'-server, running the very same version just compiled for i386 - again: shouldn't this always crash? Is there another path in the driver where V_VARIABLE(i) gets checked more thoroughly?

c) it is so simple to crash the driver; undeclared variables appear all the time while programming...
Additional Informationgdb output:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7f377f65a6e0 (LWP 5864)]
0x000000000048de3c in yyparse () at prolang.y:10865
10865 $$.type = V_VARIABLE(i)->type;
(gdb) bt
#0 0x000000000048de3c in yyparse () at prolang.y:10865
0000001 0x00000000004965fa in compile_file (fd=11,
    fname=0x7f377ce87767 "home/invisible/ccall.c",
    isMasterObj=<value optimized out>) at prolang.y:16823
0000002 0x00000000004a7c99 in load_object (lname=<value optimized out>,
    create_super=false, depth=0, isMasterObj=false, chain=0x0)
    at simulate.c:1981
0000003 0x00000000004a8494 in lookfor_object (str=<value optimized out>,
    bLoad=true) at simulate.c:2426
0000004 0x0000000000454229 in eval_instruction (
    first_instruction=<value optimized out>, initial_sp=<value optimized
out>)
    at interpret.c:16276
0000005 0x00000000004ab532 in catch_instruction (flags=0,
    offset=<value optimized out>, i_sp=0x7ad048,
    i_pc=0x7f377cfe2a2f "a\036\003\n »b´b{\004(j\v\n\212\036\004*¥\t",
    i_fp=<value optimized out>, reserve_cost=10000, i_context=0x0)
    at simulate.c:449
0000006 0x000000000044c52c in eval_instruction (
    first_instruction=<value optimized out>, initial_sp=<value optimized
out>)
    at interpret.c:9506
0000007 0x000000000045a113 in int_call_lambda (lsvp=<value optimized out>,
    num_arg=1, allowRefs=false) at interpret.c:17913
0000008 0x000000000045a7fe in v_funcall (sp=0x736370, num_arg=2)
    at interpret.c:20451
0000009 0x00000000004507aa in eval_instruction (
    first_instruction=<value optimized out>, initial_sp=<value optimized
out>)
    at interpret.c:8297
0000010 0x0000000000459418 in apply_low (fun=<value optimized out>,
    ob=0x7f377ce2b0e8, num_arg=1, b_ign_prot=false, allowRefs=false)
    at interpret.c:16836
0000011 0x000000000044a58d in int_apply (fun=0x34, ob=0x7fff87675cce,
    num_arg=2094053465, b_ign_prot=<value optimized out>,
b_use_default=true)
    at interpret.c:17027
0000012 0x000000000044b195 in sapply_int (fun=0x7f377d102ef0, ob=0x7f377ce2b0e8,
    num_arg=1, b_find_static=122, b_use_default=true) at interpret.c:17188
0000013 0x0000000000405dcd in parse_command (
    buff=0x7fff87679020 "xcall #foo(barbaz)", from_efun=false)
    at actions.c:1102
#14 0x000000000040773a in execute_command (
    str=0x7fff87679020 "xcall #foo(barbaz)", ob=0x7f377ce2b0e8)
#15 0x000000000040e96d in backend () at backend.c:673
#16 0x000000000046849d in main (argc=<value optimized out>,
    argv=<value optimized out>) at main.c:625
(gdb)


You can download the coredump at
http://xover.mud.at/~invisible/temp/ldmud-3.3.718-core (25MB) (program
compiled via 'sh settings/beutelland', original from 3.3.718 +
"enable_use_mccp=yes", plus "-ggdb3" added to $DEBUG in the Makefile)
TagsNo tags attached.
Attached Files
r2499.diff (4,944 bytes)   
Index: trunk/CHANGELOG
===================================================================
--- trunk/CHANGELOG	(Revision 2498)
+++ trunk/CHANGELOG	(Revision 2499)
@@ -1,6 +1,10 @@
 This file lists all changes made to the game driver in all glory detail.
 See the file HISTORY for a user-oriented summary of all the changes.
 
+17-Jan-2008 (Fuchur)
+  - (prolang.y)
+    check return value of verify_declared() - fixes a crash in t-language
+
 17-Jan-2009 (Gnomi)
   - (object.c)
     Save_object without a filename removed one too many elements
Index: trunk/src/prolang.y
===================================================================
--- trunk/src/prolang.y	(Revision 2498)
+++ trunk/src/prolang.y	(Revision 2499)
@@ -3472,6 +3472,11 @@
     define_variable(name, actual_type);
     i = verify_declared(name); /* Is the var declared? */
 
+#ifdef DEBUG
+    if (i == -1)
+        fatal("Variable not declared after defining it.\n");
+#endif
+
     /* Initialize float values with 0.0. */
     if (with_init
        || (!(actual_type.typeflags & TYPE_MOD_POINTER)
@@ -9604,54 +9609,44 @@
 %line
           $$.start = $1.start;
           i = verify_declared($2);
+          if (i == -1)
+              /* Variable not declared. */
+              YYACCEPT;
 
-          if (i != -1)
+          if (i & VIRTUAL_VAR_TAG)
           {
-
-              if (i & VIRTUAL_VAR_TAG)
+              add_f_code(F_PUSH_VIRTUAL_VARIABLE_LVALUE);
+              add_byte(i);
+              lvtype = V_VARIABLE(i)->type;
+              lvtype.typeflags &= TYPE_MOD_MASK;
+          }
+          else
+          {
+              if ((i + num_virtual_variables) & ~0xff)
               {
-                  add_f_code(F_PUSH_VIRTUAL_VARIABLE_LVALUE);
-                  add_byte(i);
-                  lvtype = V_VARIABLE(i)->type;
-                  lvtype.typeflags &= TYPE_MOD_MASK;
+                  add_f_code(F_PUSH_IDENTIFIER16_LVALUE);
+                  add_short(i + num_virtual_variables);
+                  CURRENT_PROGRAM_SIZE += 1;
               }
               else
               {
-                  if ((i + num_virtual_variables) & ~0xff)
-                  {
-                      add_f_code(F_PUSH_IDENTIFIER16_LVALUE);
-                      add_short(i + num_virtual_variables);
-                      CURRENT_PROGRAM_SIZE += 1;
-                  }
-                  else
-                  {
-                      add_f_code(F_PUSH_IDENTIFIER_LVALUE);
-                      add_byte(i + num_virtual_variables);
-                  }
-                  lvtype = NV_VARIABLE(i)->type;
-                  lvtype.typeflags &= TYPE_MOD_MASK;
+                  add_f_code(F_PUSH_IDENTIFIER_LVALUE);
+                  add_byte(i + num_virtual_variables);
               }
+              lvtype = NV_VARIABLE(i)->type;
+              lvtype.typeflags &= TYPE_MOD_MASK;
+          }
 
-              if (exact_types.typeflags
-               && !BASIC_TYPE(lvtype, Type_Number)
-               && !BASIC_TYPE(lvtype, Type_Float))
-              {
-                  argument_type_error($1.code, lvtype);
-              }
-
-              CURRENT_PROGRAM_SIZE += 2;
-          }
-          else
+          if (exact_types.typeflags
+           && !BASIC_TYPE(lvtype, Type_Number)
+           && !BASIC_TYPE(lvtype, Type_Float))
           {
-              /* Variable not declared - try to recover */
-              YYACCEPT;
-
-              lvtype = Type_Any;
+              argument_type_error($1.code, lvtype);
           }
 
-          last_expression = CURRENT_PROGRAM_SIZE;
+          last_expression = CURRENT_PROGRAM_SIZE + 2;
 
-          CURRENT_PROGRAM_SIZE += 1;
+          CURRENT_PROGRAM_SIZE += 3;
 
           add_f_code($1.code);
           $$.end = CURRENT_PROGRAM_SIZE;
@@ -10591,6 +10586,9 @@
           bytecode_p p;
 %line
           i = verify_declared($2);
+          if (i == -1)
+              /* variable not declared */
+              YYACCEPT;
 
           $$.start = current = CURRENT_PROGRAM_SIZE;
           $$.code = -1;
@@ -10844,6 +10842,9 @@
           bytecode_p p;
 %line
           i = verify_declared($1);
+          if (i == -1)
+              /* variable not declared */
+              YYACCEPT;
 
           $$.start = current = CURRENT_PROGRAM_SIZE;
           $$.end = 0;
@@ -11474,6 +11475,10 @@
 %line
           $$.length = 0;
           i = verify_declared($1);
+          if (i == -1)
+              /* variable not declared */
+              YYACCEPT;
+
           if (i & VIRTUAL_VAR_TAG)
           {
               $$.u.simple[0] = F_PUSH_VIRTUAL_VARIABLE_LVALUE;
@@ -13557,7 +13562,12 @@
           int i;
 %line
           $$ = 1 + $1;
+
           i = verify_declared($3);
+          if (i == -1)
+              /* variable not declared */
+              YYACCEPT;
+
           if (i & VIRTUAL_VAR_TAG)
           {
               ins_f_code(F_PUSH_VIRTUAL_VARIABLE_LVALUE);
r2499.diff (4,944 bytes)   

Activities

zesstra

2009-05-04 03:58

administrator   ~0001070

Could you make the exact binary which wrote the core also available for download? (Otherwise the core dump is not very useful.)

Gnomi

2009-05-04 04:12

manager   ~0001071

I believe this bug is already fixed in r2499. I attached the patch, could you give it a try.

invisible

2009-05-04 04:20

reporter   ~0001073

Binary can be found at http://xover.mud.at/~invisible/temp/ldmud-3.3.718-debug.

But I'll try the patch this week someday.

invisible

2009-05-04 04:30

reporter   ~0001074

Ok, found time right away... this patch does indeed fix the issue. Thanks a lot!

Issue History

Date Modified Username Field Change
2009-05-04 03:46 invisible New Issue
2009-05-04 03:58 zesstra Note Added: 0001070
2009-05-04 04:10 Gnomi File Added: r2499.diff
2009-05-04 04:12 Gnomi Note Added: 0001071
2009-05-04 04:20 invisible Note Added: 0001073
2009-05-04 04:30 invisible Note Added: 0001074
2009-05-04 05:22 Gnomi Project LDMud 3.2 => LDMud 3.3
2009-05-04 05:23 Gnomi Status new => resolved
2009-05-04 05:23 Gnomi Fixed in Version => 3.3.719
2009-05-04 05:23 Gnomi Resolution open => fixed
2009-05-04 05:23 Gnomi Assigned To => Gnomi