[Python-Dev] segmentation fault in tuple parsing

[Jun-ichiro itojun Hagino]

	it looks that there's some issue with tuple passing
	(PyArg_ParseTuple).  the last argument of vgetargs1(), which is 0,
	is dereferenced in convertsimple().  sorry if this is due to
	my mistake in socketmodule IPv6 support.

itojun


(gdb) run
Starting program: /usr/home/itojun/work/python/python/dist/src/python 
Python 2.2a1 (#12, Aug  4 2001, 10:17:23) 
[GCC egcs-2.91.66 19990314 (egcs-1.1.2 release)] on netbsd1
Type "help", "copyright", "credits" or "license" for more information.
>>> import socket
>>> socket.getnameinfo(('::1', 80, 0, 0), 0)

Program received signal SIGSEGV, Segmentation fault.
convertsimple (arg=0x80e43ac, p_format=0xbfbfcda4, p_va=0xbfbfcf80, 
    msgbuf=0xbfbfce68 "\af\027H ŽÇ\021\b\b+\030H") at Python/getargs.c:501
501                             *p = ival;
(gdb) bt
#0  convertsimple (arg=0x80e43ac, p_format=0xbfbfcda4, p_va=0xbfbfcf80, 
    msgbuf=0xbfbfce68 "\af\027H ŽÇ\021\b\b+\030H") at Python/getargs.c:501
#1  0x806ab6c in convertitem (arg=0x80e43ac, p_format=0xbfbfcf74, 
    p_va=0xbfbfcf80, levels=0xbfbfcde8, 
    msgbuf=0xbfbfce68 "\af\027H ŽÇ\021\b\b+\030H") at Python/getargs.c:351
#2  0x8068a72 in vgetargs1 (args=0x813d18c, format=0x481980b0 "i", 
    p_va=0xbfbfcf80, compat=0) at Python/getargs.c:197
#3  0x80686fd in PyArg_ParseTuple (args=0x813d18c, format=0x481980ac "si|ii")
    at Python/getargs.c:52
#4  0x48194319 in PySocket_getnameinfo (self=0x0, args=0x811c3cc)
    at /usr/home/itojun/work/python/python/dist/src/Modules/socketmodule.c:2430
#5  0x8059f35 in call_cfunction (func=0x81871cc, arg=0x811c3cc, kw=0x0)
    at Python/ceval.c:3072
#6  0x805744d in eval_frame (f=0x80e7c0c) at Python/ceval.c:1912
#7  0x8058461 in PyEval_EvalCodeEx (co=0x80fbdc0, globals=0x80f2d0c, 
    locals=0x80f2d0c, args=0x0, argcount=0, kws=0x0, kwcount=0, defs=0x0, 
    defcount=0, closure=0x0) at Python/ceval.c:2517
#8  0x8059ea3 in PyEval_EvalCode (co=0x80fbdc0, globals=0x80f2d0c, 
    locals=0x80f2d0c) at Python/ceval.c:490
#9  0x8073f48 in run_node (n=0x80f5c00, filename=0x80b4975 "<stdin>", 
    globals=0x80f2d0c, locals=0x80f2d0c, flags=0xbfbfd65c)
    at Python/pythonrun.c:1058
#10 0x8072a0e in PyRun_InteractiveOneFlags (fp=0x80dafd0, 
    filename=0x80b4975 "<stdin>", flags=0xbfbfd65c) at Python/pythonrun.c:578
#11 0x8073997 in PyRun_InteractiveLoopFlags (fp=0x80dafd0, 
    filename=0x80b4975 "<stdin>", flags=0xbfbfd65c) at Python/pythonrun.c:514
#12 0x8073802 in PyRun_AnyFileExFlags (fp=0x80dafd0, 
    filename=0x80b4975 "<stdin>", closeit=0, flags=0xbfbfd65c)
    at Python/pythonrun.c:477
#13 0x8051da3 in Py_Main (argc=1, argv=0xbfbfd6b8) at Modules/main.c:332
#14 0x8051742 in main (argc=1, argv=0xbfbfd6b8) at Modules/python.c:10
#15 0x8051579 in ___start ()
(gdb) frame 1
#1  0x806ab6c in convertitem (arg=0x80e43ac, p_format=0xbfbfcf74, 
    p_va=0xbfbfcf80, levels=0xbfbfcde8, 
    msgbuf=0xbfbfce68 "\af\027H ŽÇ\021\b\b+\030H") at Python/getargs.c:351
351                     msg = convertsimple(arg, &format, p_va, msgbuf);
(gdb) print p_va
$1 = (va_list *) 0xbfbfcf80
(gdb) frame 2
#2  0x8068a72 in vgetargs1 (args=0x813d18c, format=0x481980b0 "i", 
    p_va=0xbfbfcf80, compat=0) at Python/getargs.c:197
197                     msg = convertitem(PyTuple_GET_ITEM(args, i), &format, p_va,
(gdb) list
192             }
193             
194             for (i = 0; i < len; i++) {
195                     if (*format == '|')
196                             format++;
197                     msg = convertitem(PyTuple_GET_ITEM(args, i), &format, p_va,
198                                       levels, msgbuf);
199                     if (msg) {
200                             seterror(i+1, msg, levels, fname, message);
201                             return 0;
(gdb) print format
$2 = 0x481980b0 "i"
(gdb) frame 3
#3  0x80686fd in PyArg_ParseTuple (args=0x813d18c, format=0x481980ac "si|ii")
    at Python/getargs.c:52
52              retval = vgetargs1(args, format, &va, 0);
(gdb) list
47      {
48              int retval;
49              va_list va;
50              
51              va_start(va, format);
52              retval = vgetargs1(args, format, &va, 0);
53              va_end(va);
54              return retval;
55      }
56