Number: 58
Title: segmentation violation on simple source
Submitter: Ulrich Neumerkel
Date: Sun Nov 11 10:51:01 2001
Subsys: Dot
Version: 1.7c
System: x86-Linux-2.2.5-15 #5
Severity: critical
Problem:
The following input yiels a segmentation violation (in 1.5 source version and in binary 1.7c) It happens also on other versions of Linux

simply call dot filename
Input: 

digraph G{
	ordering=out;
	{rank=same;"1";"2"};
	"1"->"2";
	{rank=same;"4";"5"};
	"4"->"5";
	"7"->"5";
	"7"->"4";
	"6"->"1";
	"3"->"6";
	"6"->"4";
	"3"->"8";
}
Comments: 

[ulrich@p0 /tmp]$ gdb gv1.7c/bin/dot
GNU gdb 4.17.0.11 with Linux support
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...
(gdb) run segvmin.dot
Starting program: /tmp/gv1.7c/bin/dot segvmin.dot


Program received signal SIGSEGV, Segmentation fault.
0x8057493 in getmainedge ()
(gdb) backtrace
#0  0x8057493 in getmainedge ()
#1  0x8053748 in dot_splines ()
#2  0x804a1ef in dot_layout ()
#3  0x8049913 in main ()
#4  0x40060cb3 in __libc_start_main (main=0x80498c0 <main>, argc=2, argv=0xbffff964, init=0x8049298 <_init>,
    fini=0x80adf8c <_fini>, rtld_fini=0x4000a350 <_dl_fini>, stack_end=0xbffff95c)
    at ../sysdeps/generic/libc-start.c:78
(gdb)


Ellson confirms the bug is still there in 1.7.11:
Program received signal SIGSEGV, Segmentation fault.
0x080581ee in getmainedge (e=0x80c8e60) at splines.c:1707
1707            le = le->u.to_virt;
(gdb) where
#0  0x080581ee in getmainedge (e=0x80c8e60) at splines.c:1707
#1  0x080538ca in edgecmp (ptr0=0x80cace8, ptr1=0x80cacec) at splines.c:395
#2  0x4010483e in msort_with_tmp (b=0x80cace8, n=2, s=4,
    cmp=0x8053868 <edgecmp>,
    t=0xbffff780 "¸237fb ¡fb230¡fbÎ207006bЬfb") at msort.c:56
#3  0x40104729 in msort_with_tmp (b=0x80cace0, n=4, s=4,
    cmp=0x8053868 <edgecmp>,
    t=0xbffff780 "¸237fb ¡fb230¡fbÎ207006bЬfb") at msort.c:48
#4  0x40104729 in msort_with_tmp (b=0x80cacd0, n=8, s=4,
    cmp=0x8053868 <edgecmp>,
    t=0xbffff780 "¸237fb ¡fb230¡fbÎ207006bЬfb") at msort.c:48
#5  0x401048d8 in qsort (b=0x80cacd0, n=8, s=4, cmp=0x8053868 <edgecmp>)
    at msort.c:98
#6  0x08052fe4 in dot_splines (g=0x80c6db0) at splines.c:232
#7  0x0804c393 in dot_layout (g=0x80c6db0) at init.c:247
#8  0x0804b7d8 in main (argc=2, argv=0xbffff9e4) at dot.c:59
#9  0x400f0627 in __libc_start_main (main=0x804b780 <main>, argc=2,
    ubp_av=0xbffff9e4, init=0x804add4 <_init>, fini=0x8090a90 <_fini>,
    rtld_fini=0x4000dcd4 <_dl_fini>, stack_end=0xbffff9dc)
    at ../sysdeps/generic/libc-start.c:129

Owner: north
Status: Fixed