Details Ticket 5037


Comment | Reply | Take | Open


Serial Number 5037
Subject GRASS 6.3: d.graph segfault
Area grass6
Queue grass
Requestors hamish_nospam@yahoo.com
Owner none
Status resolved
Last User Contact Thu Sep 14 08:39:33 2006 (2 yr ago)
Current Priority 30
Final Priority 70
Due No date assigned
Last Action Thu Sep 14 11:12:06 2006 (2 yr ago)
Created Wed Aug 23 14:03:57 2006 (2 yr ago)

Transaction History Ticket 5037


Wed, Aug 23 2006 14:03:57    Request created by hbowman  
Subject: GRASS 6.3: d.graph segfault

Hi,

d.graph segfaults on startup. (GRASS 6.3-cvs only)

in lib/raster/com_proto.c  R_RGB_color()


e.g.

G63> d.mon x0
G63> echo "draw 50 50" | d.graph
Segmentation fault

It breaks due to bad translation of the color=black default option.
    int R,G,B,color;

        /* Parse and select color */
        if (opt2->answer != NULL) {
            color = G_str_to_color(opt2->answer, &R, &G, &B);

            if(color == 0)
                G_fatal_error(_("[%s]: No such color"), opt2->answer);

            if(color == 1) {
                R_RGB_color(R, G, B);
                set_last_color(R, G, B, RGBA_COLOR_OPAQUE);
            }
            else /* (color==2) is "none" */
                set_last_color(0, 0, 0, RGBA_COLOR_NONE);
        }


R,G,B is populated and passed to R_RGB_color(). R_RGB_color() is expecting
unsigned char, and segfaults as it thinks int 0 is '\0' ?????


(gdb) bt full
#0  0x400a144d in R_RGB_color (red=0 '\0', grn=0 '\0', blu=0 '\0') at
com_proto.c:166
No locals.
#1  0x0804ac65 in main (argc=2, argv=0xbffff6f4) at main.c:81
        window_name =
"\000÷ÿ¿töÿ¿\232;\000@ l\001Aà­\004\b(Æ\004\bxöÿ¿=\221\004\b\234\001\000@Xï\n@\230öÿ¿û­\004\bÀ\210\0
24A@®\004\bôöÿ¿À\210\024A"
module = (struct GModule *) 0x4005be50
        opt1 = (struct Option *) 0x4005be00
        opt2 = (struct Option *) 0x804c7d0
        mapcoords = (struct Flag *) 0x4005bdd8
        R = 0
        G = 0
        B = 0
        color = 1




thanks,
Hamish
Wed, Aug 23 2006 19:44:11    Mail sent by glynn@gclements.plus.com  
Return-Path <glynn@gclements.plus.com>
Delivered-To grass-bugs@lists.intevation.de
From Glynn Clements <glynn@gclements.plus.com>
MIME-Version 1.0
Content-Type text/plain; charset=us-ascii
Content-Transfer-Encoding 7bit
Message-ID <17644.37861.987330.604638@cerise.gclements.plus.com>
Date Wed, 23 Aug 2006 18:44:05 +0100
To Request Tracker <grass-bugs@intevation.de>
Cc grass-dev@grass.itc.it
Subject Re: [GRASS-dev] [bug #5037] (grass) GRASS 6.3: d.graph segfault
In-Reply-To <20060823120357.443AD1005A3@lists.intevation.de>
References <20060823120357.443AD1005A3@lists.intevation.de>
X-Mailer VM 7.07 under 21.4 (patch 15) "Security Through Obscurity" XEmacs Lucid
X-Virus-Scanned by amavisd-new at intevation.de
X-Spam-Status No, hits=-4.011 tagged_above=-999 required=3 tests=[AWL=0.989, BAYES_00=-5]
X-Spam-Level
Request Tracker wrote:

> this bug's URL: http://intevation.de/rt/webrt?serial_num=5037
> -------------------------------------------------------------------------
> 
> Subject: GRASS 6.3: d.graph segfault
> 
> d.graph segfaults on startup. (GRASS 6.3-cvs only)
> 
> in lib/raster/com_proto.c  R_RGB_color()
> 
> 
> e.g.
> 
> G63> d.mon x0
> G63> echo "draw 50 50" | d.graph
> Segmentation fault
> 
> It breaks due to bad translation of the color=black default option.

Incorrect. It segfaults because trans is NULL, because R_RGB_color()
is called before R_open_driver().

R_open_driver() or R__open_quiet() must be called before almost any
other R_* functions are called. The only exceptions are:

	R_parse_monitorcap
	R_set_update_function
	R_call_update_function
	R_has_update_function
	R_set_cancel
	R_get_cancel
	R_pad_freelist
	R_pad_perror

The old library would silently ignore any operations performed while
not connected to a driver.

-- 
Glynn Clements <glynn@gclements.plus.com>


Thu, Aug 24 2006 04:29:01    Mail sent by hamish_nospam@yahoo.com  
Return-Path <hamish_nospam@yahoo.com>
Delivered-To grass-bugs@lists.intevation.de
Date Thu, 24 Aug 2006 14:28:47 +1200
From Hamish <hamish_nospam@yahoo.com>
To Glynn Clements <glynn@gclements.plus.com>
Cc grass-bugs@intevation.de, grass-dev@grass.itc.it
Subject Re: [GRASS-dev] [bug #5037] (grass) GRASS 6.3: d.graph segfault
Message-Id <20060824142847.318c9e19.hamish_nospam@yahoo.com>
In-Reply-To <17644.37861.987330.604638@cerise.gclements.plus.com>
References <20060823120357.443AD1005A3@lists.intevation.de> <17644.37861.987330.604638@cerise.gclements.plus.com>
X-Mailer Sylpheed version 1.0.4 (GTK+ 1.2.10; i386-pc-linux-gnu)
X-Face M<EoB)"*Z~u!,vFhXmw}R_KbdBta*P_=T|rbBL'e1/CQ9;/1g\BU3&!=y8ria$2Uk!HT&BB 8i?|X_+7~1jsy}F~g$2va%3fV`*=L(*cem[@3\yg,G,@rg6/QMJ
Mime-Version 1.0
Content-Type text/plain; charset=US-ASCII
Content-Transfer-Encoding 7bit
X-Virus-Scanned by amavisd-new at intevation.de
X-Spam-Status No, hits=-1.544 tagged_above=-999 required=3 tests=[AWL=0.756, BAYES_00=-5, FORGED_YAHOO_RCVD=2.7]
X-Spam-Level
> > this bug's URL: http://intevation.de/rt/webrt?serial_num=5037
> > -------------------------------------------------------------------
> > 
> > Subject: GRASS 6.3: d.graph segfault
> > 
> > d.graph segfaults on startup. (GRASS 6.3-cvs only)
..
Glynn:
> It segfaults because trans is NULL, because R_RGB_color()
> is called before R_open_driver().
> 
> R_open_driver() or R__open_quiet() must be called before almost any
> other R_* functions are called. The only exceptions are:
>
> 	R_parse_monitorcap
> 	R_set_update_function
> 	R_call_update_function
> 	R_has_update_function
> 	R_set_cancel
> 	R_get_cancel
> 	R_pad_freelist
> 	R_pad_perror
> 
> The old library would silently ignore any operations performed while
> not connected to a driver.

ok, thanks. It works now.


I have added a new "extra/pentagon" symbol to 6.3-cvs.

e.g.:
 echo "symbol extra/pentagon 65 50 50 blue none" | d.graph



Hamish


Thu, Aug 24 2006 04:49:24    Status changed to resolved by hbowman  
Wed, Sep 13 2006 15:37:25    Mail sent by hamish_nospam@yahoo.com  
Return-Path <hamish_nospam@yahoo.com>
Delivered-To grass-bugs@lists.intevation.de
Date Thu, 14 Sep 2006 01:37:14 +1200
From Hamish <hamish_nospam@yahoo.com>
To grass5 <grass-dev@grass.itc.it>
Cc grass-bugs@intevation.de
Subject Re: [GRASS-dev] [bug #5037] (grass) GRASS 6.3: d.graph
Message-Id <20060914013714.65b21bb5.hamish_nospam@yahoo.com>
X-Mailer Sylpheed version 1.0.4 (GTK+ 1.2.10; i386-pc-linux-gnu)
X-Face M<EoB)"*Z~u!,vFhXmw}R_KbdBta*P_=T|rbBL'e1/CQ9;/1g\BU3&!=y8ria$2Uk!HT&BB 8i?|X_+7~1jsy}F~g$2va%3fV`*=L(*cem[@3\yg,G,@rg6/QMJ
Mime-Version 1.0
Content-Type text/plain; charset=US-ASCII
Content-Transfer-Encoding 7bit
X-Virus-Scanned by amavisd-new at intevation.de
X-Spam-Status No, hits=-2.3 tagged_above=-999 required=3 tests=[BAYES_00=-5, FORGED_YAHOO_RCVD=2.7]
X-Spam-Level
> > this bug's URL: http://intevation.de/rt/webrt?serial_num=5037
> > -------------------------------------------------------------------
> > 
> > Subject: GRASS 6.3: d.graph segfault
> > 
> > d.graph segfaults on startup. (GRASS 6.3-cvs only)
..
Glynn:
> It segfaults because trans is NULL, because R_RGB_color()
> is called before R_open_driver().
> 
> R_open_driver() or R__open_quiet() must be called before almost any
> other R_* functions are called. The only exceptions are:
>
> 	R_parse_monitorcap
> 	R_set_update_function
> 	R_call_update_function
> 	R_has_update_function
> 	R_set_cancel
> 	R_get_cancel
> 	R_pad_freelist
> 	R_pad_perror
> 
> The old library would silently ignore any operations performed while
> not connected to a driver.


There's another problem, G_str_to_color() [lib/gis/color_str.c] returns
an error if a color is given as a R:G:B triplet.

It seems to work fine with triplets from other modules (d.vect).

e.g.:

G63> echo "symbol basic/box 16 50 50 green 50:50:50" | d.graph
WARNING: [50:50:50]: No such color


sscanf() fills red,green,blue with garbage? [which fails >255 test]

    ret = sscanf (buf, "%d%[,:; ]%d%[,:; ]%d", red, temp, green, temp, blue);
I'm having no luck debugging this. R,G,B getting cast to another type
somehwhere????

?

thanks,
Hamish


Wed, Sep 13 2006 15:37:25    Status changed to open by _rt_system  
Thu, Sep 14 2006 08:39:33    Mail sent by glynn@gclements.plus.com  
Return-Path <glynn@gclements.plus.com>
Delivered-To grass-bugs@lists.intevation.de
From Glynn Clements <glynn@gclements.plus.com>
MIME-Version 1.0
Content-Type text/plain; charset=us-ascii
Content-Transfer-Encoding 7bit
Message-ID <17672.63726.303593.144450@cerise.gclements.plus.com>
Date Thu, 14 Sep 2006 07:38:38 +0100
To Hamish <hamish_nospam@yahoo.com>
Cc grass5 <grass-dev@grass.itc.it>, grass-bugs@intevation.de
Subject Re: [GRASS-dev] [bug #5037] (grass) GRASS 6.3: d.graph
In-Reply-To <20060914013714.65b21bb5.hamish_nospam@yahoo.com>
References <20060914013714.65b21bb5.hamish_nospam@yahoo.com>
X-Mailer VM 7.07 under 21.4 (patch 15) "Security Through Obscurity" XEmacs Lucid
X-Virus-Scanned by amavisd-new at intevation.de
X-Spam-Status No, hits=-5 tagged_above=-999 required=3 tests=[BAYES_00=-5]
X-Spam-Level
Hamish wrote:

> > > this bug's URL: http://intevation.de/rt/webrt?serial_num=5037
> > > -------------------------------------------------------------------
> > > 
> > > Subject: GRASS 6.3: d.graph segfault
> > > 
> > > d.graph segfaults on startup. (GRASS 6.3-cvs only)
> ..
> Glynn:
> > It segfaults because trans is NULL, because R_RGB_color()
> > is called before R_open_driver().
> > 
> > R_open_driver() or R__open_quiet() must be called before almost any
> > other R_* functions are called. The only exceptions are:
> >
> > 	R_parse_monitorcap
> > 	R_set_update_function
> > 	R_call_update_function
> > 	R_has_update_function
> > 	R_set_cancel
> > 	R_get_cancel
> > 	R_pad_freelist
> > 	R_pad_perror
> > 
> > The old library would silently ignore any operations performed while
> > not connected to a driver.
> 
> 
> There's another problem, G_str_to_color() [lib/gis/color_str.c] returns
> an error if a color is given as a R:G:B triplet.

Same program, but a completely unrelated bug.

> It seems to work fine with triplets from other modules (d.vect).
> 
> e.g.:
> 
> G63> echo "symbol basic/box 16 50 50 green 50:50:50" | d.graph
> WARNING: [50:50:50]: No such color
> 
> 
> sscanf() fills red,green,blue with garbage? [which fails >255 test]
> 
>     ret = sscanf (buf, "%d%[,:; ]%d%[,:; ]%d", red, temp, green, temp, blue);
> 
> 
> I'm having no luck debugging this. R,G,B getting cast to another type
> somehwhere????

lib/gis/color_str.c:54:

	int G_str_to_color (const char *str, int *red, int *green, int *blue)

include/gis.h:299:

	typedef struct
	{
	    unsigned char r, g, b, a;  /* red, green, blue, and alpha */
	} RGBA_Color ;

display/d.graph/do_graph.c:386:

	    ret = G_str_to_color(line_color_str, &line_color->r, &line_color->g, &line_color->b);
IOW, do_graph.c is passing pointers to "unsigned char" fields while
G_str_to_color() expects pointers to "int"s, resulting in the pointer
targets overlapping (each is 4 bytes wide, but they start 1 byte
apart). The value of *red will be the result of reading the entire
structure as if it was an int.

On a little-endian system, the value will be 0xAABBGGRR (the alpha
field will typically contain garbage); on a big-endian system, it
would be 0xRRGGBBAA. However, the most common big-endian architecture
(PPC) requires "int"s to be aligned, so you would get an exception
(SIGBUS, IIRC) trying to read or write *green or *blue.

The d.graph code needs to be changed to e.g:

	{
	    int r, g, b;
	    ret = G_str_to_color(line_color_str, &r, &g, &b);
	    line_color->r = (unsigned char) r;
	    line_color->g = (unsigned char) g;
	    line_color->b = (unsigned char) b;
	}

-- 
Glynn Clements <glynn@gclements.plus.com>


Thu, Sep 14 2006 11:12:06    Status changed to resolved by hbowman  
Thu, Sep 14 2006 11:12:06    Comments added by hbowman  
thanks Glynn.


fixed in CVS & 6.2 rel branch.


Hamish
Comment | Reply | Take | Open

You are currently authenticated as guest.
[Show Configuration] [Login as another user]

Users Guide - Mail Commands - Homepage of RequestTracker 1.0.7 - list any request