Making terminal font larger when in ascii callgraph mode causes crash

[crowell]

1. Go to ascii graph view ("VVV")
2. make terminal font bigger.
3. r2 will crash

this is on linux_x86-64

gdb-peda$ bt
#0  0x00007fc95f106bb9 in __GI_raise (sig=sig@entry=0x6)                                      
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:56                                                  
#1  0x00007fc95f109fc8 in __GI_abort () at abort.c:89                                                     
#2  0x00007fc95f143e14 in __libc_message (do_abort=do_abort@entry=0x1,                                            
    fmt=fmt@entry=0x7fc95f252668 "*** Error in `%s': %s: 0x%s ***\n")                                             
    at ../sysdeps/posix/libc_fatal.c:175                                                                                  
#3  0x00007fc95f1500ee in malloc_printerr (ptr=<optimized out>,                                                           
    str=0x7fc95f2527e0 "free(): invalid next size (normal)", action=0x1) at malloc.c:4996                                 
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0x0) at malloc.c:3840                                                
#5  0x00007fc9625a298b in r_cons_canvas_print (c=0x24cabc0) at canvas.c:145                                                          
#6  0x00007fc962c62536 in r_core_graph_refresh (core=0x607540 <r>) at graph.c:334                                                                
#7  0x00007fc96259f97a in resize (sig=0x1c) at cons.c:139                                                                                        
#8  <signal handler called>                                                                                                                                    
#9  0x00007fc95f1bc34e in __read_nocancel () at ../sysdeps/unix/syscall-template.S:81                                                                          
#10 0x00007fc9625a7590 in r_cons_readchar () at input.c:212                                                                                                    
#11 0x00007fc962c62789 in r_core_visual_graph (core=0x607540 <r>, _fcn=0x0) at graph.c:377                                                                     
#12 0x00007fc962c5bd48 in r_core_visual_cmd (core=0x607540 <r>, ch=0x56) at visual.c:761                                                                       
#13 0x00007fc962c5df28 in r_core_visual (core=0x607540 <r>, input=0x24caba1 "VV")                                                                              
    at visual.c:1308                                                                                                                                           
#14 0x00007fc962c4e37b in cmd_visual (data=0x607540 <r>, input=0x24caba1 "VV") at cmd.c:612                                                                                      
#15 0x00007fc962c6f754 in r_cmd_call (cmd=0x22b0e20, input=0x24caba0 "VVV") at cmd_api.c:179                                                                                     
#16 0x00007fc962c50786 in r_core_cmd_subst_i (core=0x607540 <r>, cmd=0x24caba0 "VVV")                                                                                                                  
    at cmd.c:1237                                                                                                                                                                                      
#17 0x00007fc962c4ebfa in r_core_cmd_subst (core=0x607540 <r>, cmd=0x24caba0 "VVV")                                                                                                                    
    at cmd.c:790                                                                                                                                                                                                                    
#18 0x00007fc962c51402 in r_core_cmd (core=0x607540 <r>, cstr=0x22d1860 "VVV", log=0x1)                                                                                                                                             
    at cmd.c:1435                                                                                                                                                                                                                   
#19 0x00007fc962c1f4b9 in r_core_prompt_exec (r=0x607540 <r>) at core.c:776                                                                                                                                                         
#20 0x0000000000404bcd in main (argc=0x3, argv=0x7fffc5cb2898, envp=0x7fffc5cb28b8)                                                                                                                                                 
    at radare2.c:648                                                                                                                                                                                                                
#21 0x00007fc95f0f1ec5 in __libc_start_main (main=0x402da5 <main>, argc=0x3, 
    argv=0x7fffc5cb2898, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffc5cb2888) at libc-start.c:287
#22 0x0000000000402899 in _start ()

[Maijin]

Can't reproduce with terminator x86_64 Ubuntu 14.04 using ctrl+"-", ctrl+"+" shortcuts

[crowell]

@Maijin I'm seeing this with Konsole on Ubuntu 14.04. Changing the font by holding control and using scroll wheel.

[jvoisin]

Double-free confirmed on x64.

[radare]

Should be fixed now in git. thanks!

On 08 Sep 2014, at 14:44, Jeffrey Crowell [email protected] wrote:

1. Go to ascii graph view ("VVV")
2. make terminal font bigger.
3. r2 will crash

gdb-peda$ bt
#0 0x00007fc95f106bb9 in __GI_raise (sig=sig@entry=0x6)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007fc95f109fc8 in __GI_abort () at abort.c:89
#2 0x00007fc95f143e14 in __libc_message (do_abort=do_abort@entry=0x1,
fmt=fmt@entry=0x7fc95f252668 "*** Error in `%s': %s: 0x%s ***\n")
at ../sysdeps/posix/libc_fatal.c:175
#3 0x00007fc95f1500ee in malloc_printerr (ptr=,
str=0x7fc95f2527e0 "free(): invalid next size (normal)", action=0x1) at malloc.c:4996
#4 _int_free (av=, p=, have_lock=0x0) at malloc.c:3840
#5 0x00007fc9625a298b in r_cons_canvas_print (c=0x24cabc0) at canvas.c:145
#6 0x00007fc962c62536 in r_core_graph_refresh (core=0x607540 ) at graph.c:334
#7 0x00007fc96259f97a in resize (sig=0x1c) at cons.c:139
#8
#9 0x00007fc95f1bc34e in __read_nocancel () at ../sysdeps/unix/syscall-template.S:81
#10 0x00007fc9625a7590 in r_cons_readchar () at input.c:212
#11 0x00007fc962c62789 in r_core_visual_graph (core=0x607540 , _fcn=0x0) at graph.c:377
#12 0x00007fc962c5bd48 in r_core_visual_cmd (core=0x607540 , ch=0x56) at visual.c:761
#13 0x00007fc962c5df28 in r_core_visual (core=0x607540 , input=0x24caba1 "VV")
at visual.c:1308
#14 0x00007fc962c4e37b in cmd_visual (data=0x607540 , input=0x24caba1 "VV") at cmd.c:612
#15 0x00007fc962c6f754 in r_cmd_call (cmd=0x22b0e20, input=0x24caba0 "VVV") at cmd_api.c:179
#16 0x00007fc962c50786 in r_core_cmd_subst_i (core=0x607540 , cmd=0x24caba0 "VVV")
at cmd.c:1237
#17 0x00007fc962c4ebfa in r_core_cmd_subst (core=0x607540 , cmd=0x24caba0 "VVV")
at cmd.c:790
#18 0x00007fc962c51402 in r_core_cmd (core=0x607540 , cstr=0x22d1860 "VVV", log=0x1)
at cmd.c:1435
#19 0x00007fc962c1f4b9 in r_core_prompt_exec (r=0x607540 ) at core.c:776
#20 0x0000000000404bcd in main (argc=0x3, argv=0x7fffc5cb2898, envp=0x7fffc5cb28b8)
at radare2.c:648
#21 0x00007fc95f0f1ec5 in __libc_start_main (main=0x402da5

, argc=0x3,
argv=0x7fffc5cb2898, init=, fini=,
rtld_fini=, stack_end=0x7fffc5cb2888) at libc-start.c:287
#22 0x0000000000402899 in _start ()
—
Reply to this email directly or view it on GitHub.

[jvoisin]

It's fixed here.