#843762 rcs: SIGSEGV on rcs -u1.2 -l1.1 foo

Package:
rcs
Source:
rcs
Description:
The GNU Revision Control System
Submitter:
"Yuriy M. Kaminskiy"
Date:
2023-08-14 16:18:08 UTC
Severity:
normal
Tags:
#843762#5
Date:
2016-11-09 10:31:42 UTC
From:
To:
Dear Maintainer,

While trying to unlock one revision and lock another, I got SIGSEGV:

$ touch foo
$ ci -l -d foo </dev/null
$ echo bar >foo
$ ci -l -d foo </dev/null
$ gdb --args rcs -u1.2 -l1.1 foo
(gdb) run
Program received signal SIGSEGV, Segmentation fault.
0x565629a2 in extend (tp=0x0, x=0xffffd8a2, to=0x565a00b0) at b-esds.c:39
39	  EXTEND_BODY (link);
(gdb) bt full
#0  0x565629a2 in extend (tp=0x0, x=0xffffd8a2, to=0x565a00b0) at
b-esds.c:39
         pair = 0x565b6218
#1  0x5655a321 in rcs_main (cmd=0x565b6218 "╒ьЪЪ", argc=-10078,
argv=0xffffd6cc)
     at rcs.c:1200
         dc = {rv = 0, deltas = 0x0, suppress_mail = false, lockhead =
false,           unlockcaller = false, newlocks = 0x0, byelocks = 0x0,
headstate = 0x0,           headstate_changed_p = false, states = {entry
= 0x0, next = 0x0},           tp_state = 0x0, accesses = {entry = 0x0,
next = 0x0}, tp_access = 0x0,           assocs = {entry = 0x0, next =
0x0}, tp_assoc = 0x0, logs = {entry = 0x0,             next = 0x0},
tp_log = 0x0, cuthead = 0x0, cuttail = 0x0,           delstrt = 0x0,
delrev = {strt = 0x0, end = 0x0, code = 0}}
         newargv = 0xffffd6c4
         branchnum = {
           string = 0xfe0 <error: Cannot access memory at address
0xfe0>,           size = 4160393216}
         boxlock = {entry = 0xf7fa9960 <_IO_2_1_stderr_>, next = 0x0}
         boxrm = {entry = 0x5658b058, next = 0x565b6210}
#2  0x56557948 in dispatch (argv=0xffffd6c4, argc=<optimized out>,
cmd=0x565784e1 "rcs", sub=<optimized out>, exitval=<synthetic pointer>)
     at super.c:74
No locals.
#3  main (argc=4, argv=0xffffd6c4) at super.c:256
         cmd = 0x565784e1 "rcs"
         sub = <optimized out>
         exitval = 0

Issue seems also present in rcs 5.9.4-1 from stretch/sid.

#843762#10
Date:
2016-11-09 14:40:36 UTC
From:
To:
Control: tag -1 patch
thanks

I looked a bit more at EXTEND_BODY macro and *extend functions, they do
something *very* strange and confusing.
Assuming I got it right, attached patch should fix the issue.