Mail Archives: cygwin/2011/07/01/07:44:59
On Jul 1 11:21, Andy Koppe wrote:
> On 1 July 2011 10:43, Corinna Vinschen wrote:
> > On Jul  1 10:36, Corinna Vinschen wrote:
> >> FYI, I tracked it down to the place where the stack overwrite occurs.
> >> This is most puzzeling. Â When typing :wq!, the following chain of functions
> >> is called:
> >>
> >> Â nv_colon
> >> Â Â do_cmdline
> >> Â Â ex_exit
> >> Â Â Â do_write
> >>    open              <- Here it calls into the Cygwin DLL
> >> Â Â Â Â fhandler_base::open_with_arch
> >> Â Â Â Â fhandler_base::open_fs
> >> Â Â Â Â Â fhandler_base::open
> >>      NtCreateFile        <--Here it calls into NTDLL.DLL
> >>
> >> The open call tries to open the backup file "/etc/hosts~", not the
> >> symlink itself.
> >>
> >> In the optimized version of vim, the local variable "cap" in the
> >> function nv_colon is kept in register $esi. Â When do_cmdline is called,
> >> $esi is pushed onto the stack. Â Then everything goes its normal ways,
> >> until NtCreateFile is called.
> >>
> >> And here's the puzzler: This call to NtCreateFile overwrites the 4 byte
> >> stack slot in which the "cap" pointer is saved with the value 0x10c!
>
> What else has access to that? The signal thread?
No, it's just the call stack of the main thread. cap is a local variable
of a vim function and the location is just the one cap gets pushed to to
be restored when returning from do_cmdline. It's so far away from the
NtCreateFile call, it's no concern to anybody at that point.
> > And it also does not happen if I build Cygwin with gcc 4.5.1 rather than
> > with gcc 4.3.4. Â Is it possible that a compiler bug is playing a role
> > here? Â I can't quite believe it, the effect is too specific.
>
> This sounds similar to some unexplained mintty crashes that Chris
> Sutcliffe and I have seen with gcc 4.3.4, triggered by setup.exe
> running postinstall scripts or vim accessing /etc/fstab. Unfortunately
> we never managed to pin down the actual cause, inspite of a fair bit
> of debugging and staring at the compiler's assembly output. The
> crashes went away with changes that should have made no difference.
>
> See here:
> http://code.google.com/p/mintty/source/detail?r=928
> http://code.google.com/p/mintty/source/detail?r=894
> http://groups.google.com/group/mintty-discuss/browse_thread/thread/7f1afcb74c61fe99
Hmm, that's really strange...
Corinna
--
Corinna Vinschen Please, send mails regarding Cygwin to
Cygwin Project Co-Leader cygwin AT cygwin DOT com
Red Hat
--
Problem reports: http://cygwin.com/problems.html
FAQ: http://cygwin.com/faq/
Documentation: http://cygwin.com/docs.html
Unsubscribe info: http://cygwin.com/ml/#unsubscribe-simple
- Raw text -