classification
Title: Running test_time.py in python27 caused python to unexpectedly quit
Type: crash Stage:
Components: Tests Versions: Python 2.7
process
Status: closed Resolution: out of date
Dependencies: Superseder:
Assigned To: ned.deily Nosy List: antlong, belopolsky, ned.deily, neologix
Priority: normal Keywords:

Created on 2011-02-26 06:37 by antlong, last changed 2011-02-26 20:27 by brett.cannon. This issue is now closed.

Messages (9)
msg129502 - (view) Author: Anthony Long (antlong) Date: 2011-02-26 06:37
I ran 

python test_time.py 

and python immediately crashed.

This is the trace from mac's error reporter: 

http://dpaste.de/Jsw7/
msg129518 - (view) Author: Charles-François Natali (neologix) * (Python committer) Date: 2011-02-26 10:02
Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x0000000000000018
Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Python crashes when dereferencing 0x0000000000000018, which is NULL + 24

This means that it crashes here:

     p = asctime(&buf);
     if (p[24] == '\n')
         p[24] = '\0';

No check is made on asctime(3) return's value, so if it returns NULL, we'll segfault.

I think the problem is that gettmarg doesn't check its returned struct tm.

Also, in time_strtime, there's this comment:

 Checks added to make sure strftime() does not crash Python by
 
414        indexing blindly into some array for a textual representation
 
415        by some bad index (fixes bug #897625).
 
416  

Is there any good reason why those checks aren't performed directly in 
gettmarg ?
msg129519 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2011-02-26 10:33
From the path names in the trace you appear to have a MacPorts Python 2.7 installed.  For what it's worth, the standard library test_time works for me on OS X 10.6.6 with a current MacPorts 2.7.1 as well as a python.org 2.7.1.  Exactly how did you try to run this, i.e. what are the results of:
   $ which python
   $ echo $pwd
   $ ls -l test_time.py
msg129523 - (view) Author: Charles-François Natali (neologix) * (Python committer) Date: 2011-02-26 10:50
True with the following:

import time

time.asctime((2011, 2, 26, -1, 0, 0, 0, 0, 0))

You'll get a segfault.
msg129525 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2011-02-26 10:58
$ /opt/local/bin/python2.7
Python 2.7.1 (r271:86832, Dec 31 2010, 11:59:23) 
[GCC 4.2.1 (Apple Inc. build 5664)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import time
>>> time.asctime((2011, 2, 26, -1, 0, 0, 0, 0, 0))
'Mon Feb 26 -1:00:00 2011'
>>> ^D
$ /Library/Frameworks/Python.framework/Versions/2.7/bin/python2.7
Python 2.7.1+ (release27-maint, Jan 29 2011, 13:55:30) 
[GCC 4.2.1 (Apple Inc. build 5664)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> import time
>>> time.asctime((2011, 2, 26, -1, 0, 0, 0, 0, 0))
'Mon Feb 26 -1:00:00 2011'
>>> ^D
msg129526 - (view) Author: Charles-François Natali (neologix) * (Python committer) Date: 2011-02-26 11:01
This explains why you don't get a segfault: your libc is broken ;-)
msg129528 - (view) Author: Ned Deily (ned.deily) * (Python committer) Date: 2011-02-26 11:07
If it's broken, complain to Apple.

$ otool -L $(/opt/local/bin/python2.7 -c 'import time;print(time.__file__)')
/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/lib-dynload/time.so:
	/usr/lib/libSystem.B.dylib (compatibility version 1.0.0, current version 125.2.1)

That still doesn't explain the OP's crash on OS X 10.6.6.
msg129532 - (view) Author: Charles-François Natali (neologix) * (Python committer) Date: 2011-02-26 11:41
> If it's broken, complain to Apple.

Actually, I checked glibc's asctime, and it has the same behaviour. But the point is that asctime can return NULL.

> That still doesn't explain the OP's crash on OS X 10.6.6.

Yes it does. If asctime returns NULL, you'll segfault.
Now, if you ask me why he's encoutering this bug, I'd guess that he's using py3k' test_time.py, which added tests feeding invalid tuples to time.asctime. But it's just a wild guess.

Anyway, the code in python 2.7 is buggy, and must be fixed.
msg129535 - (view) Author: Charles-François Natali (neologix) * (Python committer) Date: 2011-02-26 12:24
I updated my local svn checkout, and the code has been fixed recently:


  r87648 | alexander.belopolsky | 2011-01-02 15:48:22 -0500 (Sun, 02 Jan 2011) | 1 line
  
  Issue #8013: Fixed time.asctime segfault when OS's asctime fails


    p = asctime(&buf);
    if (p == NULL) {
        PyErr_SetString(PyExc_ValueError, "invalid time");
        return NULL;
    }
    if (p[24] == '\n')
        p[24] = '\0';


So I'd suggest to close this issue.
History
Date User Action Args
2011-02-26 20:27:41brett.cannonsetstatus: open -> closed
nosy: belopolsky, ned.deily, neologix, antlong
resolution: out of date
2011-02-26 12:24:53neologixsetnosy: belopolsky, ned.deily, neologix, antlong
messages: + msg129535
2011-02-26 11:41:09neologixsetnosy: belopolsky, ned.deily, neologix, antlong
messages: + msg129532
2011-02-26 11:07:30ned.deilysetnosy: belopolsky, ned.deily, neologix, antlong
messages: + msg129528
2011-02-26 11:01:18neologixsetnosy: belopolsky, ned.deily, neologix, antlong
messages: + msg129526
2011-02-26 10:58:33ned.deilysetassignee: ned.deily
messages: + msg129525
nosy: belopolsky, ned.deily, neologix, antlong
2011-02-26 10:54:54pitrousetnosy: + belopolsky
2011-02-26 10:50:11neologixsetnosy: ned.deily, neologix, antlong
messages: + msg129523
2011-02-26 10:33:36ned.deilysetnosy: + ned.deily
messages: + msg129519
2011-02-26 10:02:14neologixsetnosy: + neologix
messages: + msg129518
2011-02-26 06:37:38antlongcreate