Re: The patch of glibc which allows the user to override the pfinet server

[zhengda]

Samuel Thibault wrote:
> Gah.  Then set from inside gdb:
>
> gdb --args /root/storage/glibc-2.7/build-tree/hurd-i386-libc/sunrpc/rpcgen -Y 
> ../scripts -c rpcsvc/bootparam_prot.x -o 
> /root/storage/glibc-2.7/build-tree/hurd-i386-libc/sunrpc/xbootparam_prot.T
> (gdb) set environment 
> LD_LIBRARY_PATH=/root/storage/glibc-2.7/build-tree/hurd-i386-libc
> (gdb) r
>   
It works.

if (domain > max_domain || servers[domain] == MACH_PORT_NULL)
  {
    char *name = NULL;
    char *np = NULL;

    if (__asprintf (&name, "SOCK_SERV_%d", domain) > 0)
      {
        np = getenv (name);
        free (name);
gdb shows the error happens here when 'name' is freed.
Here is the result I see from gdb.
(gdb) bt
#0  0x0104354c in mach_msg_trap () from 
/root/storage/glibc-2.7/build-tree/hurd-i386-libc/libc.so.0.3
#1  0x01043c93 in __mach_msg (msg=0x1021998, option=3, send_size=48, 
rcv_size=32, rcv_name=118, timeout=0, notify=0) at msg.c:110
#2  0x011c2208 in msg_sig_post () from /lib/libhurduser.so.0.3
#3  0x0107f410 in kill_pid.7279 () at ../mach/lock-intern.h:89
#4  0x0107f64a in __kill (pid=25207, sig=6) at 
../sysdeps/mach/hurd/kill.c:139
#5  0x0107eadf in raise (sig=6) at ../sysdeps/posix/raise.c:27
#6  0x01080ed2 in abort () at abort.c:88
#7  0x01078018 in __assert_fail (assertion=0x11800c5 "((h)->check) == 
0x8a3c743e", file=0x118009d "hurdmalloc.c", line=287, function=0x11800ee 
"_hurd_free") at assert.c:78
#8  0x0106baa2 in _hurd_free (base=0x805a1a0) at hurdmalloc.c:287
#9  0x010512a1 in _hurd_socket_server (domain=1, dead=0) at hurdsock.c:85
#10 0x0113d92b in __socketpair (domain=1, type=1, protocol=4096, 
fds=0x1021c2c) at ../sysdeps/mach/hurd/socketpair.c:43
#11 0x011173fd in __pipe (fds=0x1021c2c) at ../sysdeps/mach/hurd/pipe.c:38
#12 0x08049226 in open_input (infile=0x1022051 
"rpcsvc/bootparam_prot.x", define=0x8053e3b "-DRPC_XDR") at rpc_main.c:364
#13 0x080496c3 in c_output (infile=0x1022051 "rpcsvc/bootparam_prot.x", 
define=0x8053e3b "-DRPC_XDR", extend=0,
   outfile=0x102206c 
"/root/storage/glibc-2.7/build-tree/hurd-i386-libc/sunrpc/xbootparam_prot.T") 
at rpc_main.c:478
#14 0x0804b0be in main (argc=7, argv=0x1021e64) at rpc_main.c:199
(gdb) f 9
#9  0x010512a1 in _hurd_socket_server (domain=1, dead=0) at hurdsock.c:85
85                free (name);
(gdb) p name
$1 = 0x805a1a0 "SOCK_SERV_1"

But I don't understand why. Obviously, 'name' isn't double-freed.

Best,
Zheng Da