1360794 - hash_buf.c:130: BUFHEAD *__get_buf(HTAB *, uint32, BUFHEAD *, int): Assertion `segp != ((void*)0)' failed

Status: NEW

(NSS :: Tools, defect, P3)

Description

[Brian Carpenter [:geeknik]]

Attachment: cert8.db

Triggered with changeset 13315:769f9ae07b10. Built with afl-clang-fast on Debian 8 x64 (CC=afl-clang-fast CXX=afl-clang-fast++ AFL_USE_ASAN=1 USE_64=1 make nss_build_all).

run ./certutil -K -d . with the attached cert8.db.

#0  0x00007ffff5efe067 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1  0x00007ffff5eff448 in __GI_abort () at abort.c:89
#2  0x00007ffff5ef7266 in __assert_fail_base (fmt=0x7ffff602ff18 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7ffff13845a0 <.str> "segp != ((void*)0)", file=file@entry=0x7ffff13845e0 "hash_buf.c",
    line=line@entry=130, function=function@entry=0x7ffff1384600 <__PRETTY_FUNCTION__.__get_buf> "BUFHEAD *__get_buf(HTAB *, uint32, BUFHEAD *, int)") at assert.c:92
#3  0x00007ffff5ef7312 in __GI___assert_fail (assertion=0x7ffff13845a0 <.str> "segp != ((void*)0)", file=0x7ffff13845e0 "hash_buf.c", line=130,
    function=0x7ffff1384600 <__PRETTY_FUNCTION__.__get_buf> "BUFHEAD *__get_buf(HTAB *, uint32, BUFHEAD *, int)") at assert.c:101
#4  0x00007ffff137109d in __get_buf (hashp=<optimized out>, addr=<optimized out>, prev_bp=<optimized out>, newpage=<optimized out>) at hash_buf.c:130
#5  0x00007ffff136c796 in hash_access (hashp=0x61700000f900, action=HASH_GET, key=0x7fffffffce80, val=<optimized out>) at hash.c:781
#6  0x00007ffff1369cd9 in hash_get (dbp=<optimized out>, key=<optimized out>, data=<optimized out>, flag=<optimized out>) at hash.c:672
#7  0x00007ffff12f9d8f in dbs_get (dbs=0x60c00000b8c0, key=0x7fffffffce80, data=0x7fffffffce60, flags=0) at dbmshim.c:331
#8  0x00007ffff13411a8 in certdb_Get (flags=0, db=<optimized out>, key=<optimized out>, data=<optimized out>) at pcertdb.c:233
#9  ReadDBEntry (handle=<optimized out>, entry=<optimized out>, dbkey=<optimized out>, dbentry=<optimized out>, arena=<optimized out>) at pcertdb.c:467
#10 0x00007ffff135a5a9 in ReadDBVersionEntry (handle=0x60300000a270) at pcertdb.c:2869
#11 nsslowcert_GetVersionNumber (handle=<optimized out>) at pcertdb.c:4050
#12 0x00007ffff1348613 in nsslowcert_OpenPermCertDB (handle=0x60300000a270, readOnly=<optimized out>, appName=0x0, prefix=<optimized out>, namecb=<optimized out>, cbarg=<optimized out>) at pcertdb.c:4091
#13 nsslowcert_OpenCertDB (handle=0x60300000a270, readOnly=<optimized out>, appName=<optimized out>, prefix=<optimized out>, namecb=<optimized out>, cbarg=<optimized out>, openVolatile=<optimized out>) at pcertdb.c:4587
#14 0x00007ffff132feb7 in lg_OpenCertDB (configdir=<optimized out>, prefix=<optimized out>, readOnly=<optimized out>, certdbPtr=<optimized out>) at lginit.c:365
#15 legacy_Open (configdir=<optimized out>, certPrefix=<optimized out>, keyPrefix=<optimized out>, certVersion=<optimized out>, keyVersion=<optimized out>, flags=1, certDB=<optimized out>, keyDB=<optimized out>) at lginit.c:609
#16 0x00007ffff1d2a4c4 in sftkdbCall_open (dir=<optimized out>, certPrefix=<optimized out>, keyPrefix=<optimized out>, certVersion=<optimized out>, keyVersion=<optimized out>, flags=<optimized out>, certDB=<optimized out>,
    keyDB=<optimized out>) at lgglue.c:306
#17 0x00007ffff1dc2a2f in sftk_DBInit (configdir=<optimized out>, certPrefix=<optimized out>, keyPrefix=<optimized out>, updatedir=<optimized out>, updCertPrefix=<optimized out>, updKeyPrefix=<optimized out>, updateID=<optimized out>,
    readOnly=<optimized out>, noCertDB=<optimized out>, noKeyDB=<optimized out>, forceOpen=<optimized out>, isFIPS=<optimized out>, certDB=<optimized out>, keyDB=<optimized out>) at sftkdb.c:2584
#18 0x00007ffff1d40991 in SFTK_SlotReInit (slot=0x61200000b5c0, configdir=<optimized out>, updatedir=<optimized out>, updateID=<optimized out>, params=0x6110000097f8, moduleIndex=<optimized out>) at pkcs11.c:2484
#19 0x00007ffff1d4214d in SFTK_SlotInit (configdir=<optimized out>, updatedir=<optimized out>, updateID=<optimized out>, params=0x6110000097f8, moduleIndex=<optimized out>) at pkcs11.c:2600
#20 0x00007ffff1d45738 in nsc_CommonInitialize (pReserved=<optimized out>, isFIPS=<optimized out>) at pkcs11.c:3052
#21 0x00007ffff1d461c9 in NSC_Initialize (pReserved=0x7fffffffdcd0) at pkcs11.c:3115
#22 0x00007ffff67bec1b in secmod_ModuleInit (mod=<optimized out>, reload=<optimized out>, alreadyLoaded=<optimized out>) at pk11load.c:245
#23 0x00007ffff67c0a62 in secmod_LoadPKCS11Module (mod=<optimized out>, oldModule=0x7fffffffe0c0) at pk11load.c:504
#24 0x00007ffff67f49df in SECMOD_LoadModule (
    modulespec=0x61400000fe40 "library= name=\"NSS Internal PKCS #11 Module\" parameters=\"configdir='.' certPrefix='' keyPrefix='' secmod='secmod.db' flags=readOnly updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' upda"..., parent=<optimized out>, recurse=<optimized out>) at pk11pars.c:1672
#25 0x00007ffff67f4d48 in SECMOD_LoadModule (
    modulespec=0x61200000bbc0 "name=\"NSS Internal Module\" parameters=\"configdir='.' certPrefix='' keyPrefix='' secmod='secmod.db' flags=readOnly updatedir='' updateCertPrefix='' updateKeyPrefix='' updateid='' updateTokenDescription"..., parent=<optimized out>, recurse=<optimized out>) at pk11pars.c:1707
#26 0x00007ffff6711f01 in nss_InitModules (configdir=0x13a6040 <SECU_ConfigDirectory.buf> ".", certPrefix=<optimized out>, keyPrefix=<optimized out>, secmodName=<optimized out>, updateDir=<optimized out>, updCertPrefix=<optimized out>,
    updKeyPrefix=<optimized out>, updateID=<optimized out>, updateName=<optimized out>, configName=<optimized out>, configStrings=<optimized out>, pwRequired=<optimized out>, readOnly=<optimized out>, noCertDB=<optimized out>,
    noModDB=<optimized out>, forceOpen=<optimized out>, optimizeSpace=<optimized out>, isContextInit=<optimized out>) at nssinit.c:464
#27 nss_Init (configdir=<optimized out>, certPrefix=<optimized out>, keyPrefix=<optimized out>, secmodName=<optimized out>, updateDir=<optimized out>, updCertPrefix=<optimized out>, updKeyPrefix=<optimized out>,
    updateID=<optimized out>, updateName=<optimized out>, initContextPtr=<optimized out>, initParams=<optimized out>, readOnly=<optimized out>, noCertDB=<optimized out>, noModDB=<optimized out>, forceOpen=<optimized out>,
    noRootInit=<optimized out>, optimizeSpace=<optimized out>, noSingleThreadedModules=<optimized out>, allowAlreadyInitializedModules=<optimized out>, dontFinalizeModules=<optimized out>) at nssinit.c:689
#28 0x00007ffff67130a2 in NSS_Initialize (configdir=0x433b <error: Cannot access memory at address 0x433b>, certPrefix=0x433b <error: Cannot access memory at address 0x433b>, keyPrefix=0x6 <error: Cannot access memory at address 0x6>,
    secmodName=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, flags=<optimized out>) at nssinit.c:889
#29 0x00000000004ddd8e in certutil_main (argc=<optimized out>, argv=<optimized out>, initialize=<optimized out>) at certutil.c:2986
#30 0x00000000004db7b4 in main (argc=17211, argv=0x433b) at certutil.c:3703