Crafty-22.8 Segmentation Fault

[zullil]

Yes, the position I set is empty, but it could be handled better! Does this occur for you?

Code: Select all

Crafty v22.8 (1 cpus)

White(1): setboard
side to move is bad
Segmentation fault

Here's the crash report:

Code: Select all

Process:         crafty-22.8 [394]
Path:            ./crafty-22.8
Identifier:      crafty-22.8
Version:         ??? (???)
Code Type:       X86-64 (Native)
Parent Process:  bash [136]

Date/Time:       2009-01-07 06:07:55.419 -0500
OS Version:      Mac OS X 10.5.6 (9G55)
Report Version:  6

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: 0x000000000000000d, 0x0000000000000000
Crashed Thread:  Unknown

Backtrace not available

Unknown thread crashed with X86 Thread State (64-bit):
  rax: 0x0000000000000000  rbx: 0x0000000000000000  rcx: 0x0000000000177c30  rdx: 0x0000000000000000
  rdi: 0x000000010013c560  rsi: 0x0000000000000000  rbp: 0x0000000000000040  rsp: 0x00007fff5fbdd170
   r8: 0x000000010013c760   r9: 0x000000010013c260  r10: 0x000000010013c360  r11: 0x0040201008040200
  r12: 0x0000000000000000  r13: 0x0000000000000000  r14: 0x00000001002d1000  r15: 0x00000001002624e8
  rip: 0x000000010009ec0c  rfl: 0x0000000000010246  cr2: 0x0000000100068ae0

[Sven]

The SetBoard() function in "setboard.c" requires a valid argument vector, i.e. nargs >= 2 and corresponding args[]. It actually does not check for nargs >= 2, so each caller has to perform such a check, usally combined with printing a "usage: ..." message in case of failure. For "setboard", that check is missing, so maybe either strcpy() or strlen() crashes when accessing an illegal address.

So perhaps a fix in "option.c", around line 3286, would be to change

Code: Select all

  else if (OptionMatch("setboard", *args)) {
    if (shared->thinking || shared->pondering)
      return (2);
    nargs = ReadParse(buffer, args, " 	;=");
    SetBoard(tree, nargs - 1, args + 1, 0);

into something like

Code: Select all

  else if (OptionMatch("setboard", *args)) {
    if (shared->thinking || shared->pondering)
      return (2);
    nargs = ReadParse(buffer, args, " 	;=");
    if (nargs < 3) {
      printf("usage:  setboard <fen>\n");
      printf("  where <fen> contains board and color parts at least\n");
      return (1);
    }
    SetBoard(tree, nargs - 1, args + 1, 0);

where the "usage:" text could of course be improved.
Note that the version I'm looking at currently is 22.1, but I guess this code hasn't changed until 22.8 (?).

Sven

[Dirt]

Yes, the position I set is empty, but it could be handled better! Does this occur for you?

Code: Select all

Crafty v22.8 (1 cpus)

White(1): setboard
side to move is bad
Segmentation fault

I'm not getting a seg fault with 22.8 JA. I'm probably just lucky in what was in uninitialized memory, but maybe it has something to do with how JA compiled it.