bc/dc segfaults at a quite big addition

[Florian Koenig]

hi!

i just wanted to calculate a quite big addition. unfortunately bc segfaulted.
i wanted to give you a full output of strace but didn't manage to do so. both
redirecting all output to a file by appending "&> filename" to the line calling
bc and using "tee" didn't work. i then noticed that i got the right result when
doing this, just that it appeared in the file (obviously). bc only segfaults
when the output isn't redirected. i can give you the last lines of stracing bc:

rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(0, "2", 1)                         = 1
write(1, "2", 12)                        = 1
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(0, "3", 1)                         = 1
write(1, "3", 13)                        = 1
rt_sigprocmask(SIG_BLOCK, NULL, [], 8)  = 0
read(0, "\r", 1)                        = 1
write(1, "\n", 1
)                       = 1
rt_sigprocmask(SIG_BLOCK, [INT], [], 8) = 0
ioctl(0, SNDCTL_TMR_STOP, {B38400 opost isig icanon echo ...}) = 0
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
rt_sigaction(SIGINT, {0x8049270, [], SA_RESTART|0x4000000}, {0x4002fbb0, [], 
0x4000000}, 8) = 0
rt_sigaction(SIGALRM, {SIG_DFL}, {0x4002fbb0, [], 0x4000000}, 8) = 0
rt_sigaction(SIGTSTP, {SIG_DFL}, {0x4002fbb0, [], 0x4000000}, 8) = 0
rt_sigaction(SIGTTOU, {SIG_DFL}, {0x4002fbb0, [], 0x4000000}, 8) = 0
rt_sigaction(SIGTTIN, {SIG_DFL}, {0x4002fbb0, [], 0x4000000}, 8) = 0
rt_sigaction(SIGTERM, {SIG_DFL}, {0x4002fbb0, [], 0x4000000}, 8) = 0
rt_sigaction(SIGWINCH, {SIG_DFL}, {0x4002fce0, [], 0x4000000}, 8) = 0
brk(0x8068000)                          = 0x8068000
)                       = 1
--- SIGSEGV (Speicherzugriffsfehler) ---
+++ killed by SIGSEGV +++

the (incomplete) ltrace output is:

printf("%s\n", "bc 1.05\nCopyright 1991, 1992, 19"...bc 1.05
Copyright 1991, 1992, 1993, 1994, 1997, 1998 Free Software Foundation, Inc.
) = 84
printf("This is free software with ABSOL"...This is free software with 
ABSOLUTELY NO WARRANTY.
)     = 51
printf("For details type `warranty'. \n"For details type `warranty'. 
)         = 30
malloc(24)                                        = 0x08056c08
malloc(16386)                                     = 0x08056c28
readline(""17482+86054+0+234503+34905962+771046+6177+625272+56888+405962+30690+149245+50435+89263+8260630+27174608922+369642+336650+61892+25889+594433+894344+703617+99403+8861+1271238+2962340+159391+53341+255811+63954+2646253+1156794+63759+11045+127071+76150+231867+4930+2082382+50320+757943+155909+88000+3447148+5978495+43178+1402+209337+106564+238510+72647+2357406+239615+29281+73805+976350+112688+339555+866923+292693+120220+1343034+1644+2880519+205889+33452+19889+22557+247037+509304+844821+116986+744050+431318+3420686+15449+15844+26282+524569+344955+236921+114285+5494780+253632+405010+133061+324652+346517+3487414+13341+73739+137010+122899+370987+65376+1015247+1125468+445693+206777+358971+33+10937518+35532+7663+540956+84265+2315898+30020+48909+277895+134133+5213921+3031354+31640+4616+9478+571540+111012+172456+1165841+1604166+538652+128636+14427+15740+81532+180623+4117332+236124+240388+288372+41016+491503+6632416+100286+135561+5531+247689+269122+1544582+1912+1769974+195331+41029!
4+477388+515839+25795+24023+212066+258054+1224376+47746+2207928+5988+110346+554704+639599+248801+252552+72582+18921+555148+17055+342945+39879+1340748+6504992+1535915+346360+52631+335287+23791+249928+63505+167493+1925930+1333298+1056895+14005304+2878803+10084808+3455466+32937311+7061124+2234736+218774+129170+1497173+675831+2107376+351101+6272734+85987+1385499+27193405+2631778+251483+302353+4236602+2144718+57678578+386123
)                                      = "17482+86054+0+234503+34905962+77"...
add_history(0x080656c8, 0x08056c29, 1, 1, 0xbffff5d4) = 0x08065c58
printf("\r")                                      = 1
)                                = 0
strncpy(0x08056c29, ???, 4294967175 <unfinished ...>
--- SIGSEGV (Speicherzugriffsfehler) ---
+++ killed by SIGSEGV +++

if you think that long calculation above is what i wanted to do you are
wrong. the line i pasted via clicking the middle button of my mouse and the one
i got in the ltrace output only differ a little (after the 15th + sign). there's
even a system describing the differences.

original calculation:
17482+86054+0+234503+34905962+771046+6177+625272+56888+405962+30690+149245+50435+89263+8260630+2717498+243608+1608922+369642+336650+61892+25889+594433+894344+703617+99403+8861+1271238+2962340+159391+53341+255811+63954+2646253+1156794+63759+11045+127071+76150+231867+4930+2082382+50320+757943+155909+88000+3447148+5978495+43178+1402+209337+106564+238510+72647+2357406+239615+29281+73805+976350+112688+339555+866923+292693+120220+1343034+1644+2880519+205889+33452+19889+22557+247037+509304+844821+116986+744050+431318+3420686+15449+15844+26282+524569+344955+236921+114285+5494780+253632+405010+133061+324652+346517+3487414+13341+73739+137010+122899+370987+65376+1015247+1125468+445693+206777+358971+33+10937518+35532+7663+540956+84265+2315898+30020+48909+277895+134133+5213921+3031354+31640+4616+9478+571540+111012+172456+1165841+1604166+538652+128636+14427+15740+81532+180623+4117332+236124+240388+288372+41016+491503+6632416+100286+135561+5531+247689+269122+1544582+1912+1769974+195331+41029!
4+477388+515839+25795+24023+212066+258054+1224376+47746+2207928+5988+110346+554704+639599+248801+252552+72582+18921+555148+17055+342945+39879+1340748+6504992+1535915+346360+52631+335287+23791+249928+63505+167493+1925930+1333298+1056895+14005304+2878803+10084808+3455466+32937311+7061124+2234736+218774+129170+1497173+675831+2107376+351101+6272734+85987+1385499+27193405+2631778+251483+302353+4236602+2144718+57678578+386123

calculation output by ltracing bc:
17482+86054+0+234503+34905962+771046+6177+625272+56888+405962+30690+149245+50435+89263+8260630+27174608922+369642+336650+61892+25889+594433+894344+703617+99403+8861+1271238+2962340+159391+53341+255811+63954+2646253+1156794+63759+11045+127071+76150+231867+4930+2082382+50320+757943+155909+88000+3447148+5978495+43178+1402+209337+106564+238510+72647+2357406+239615+29281+73805+976350+112688+339555+866923+292693+120220+1343034+1644+2880519+205889+33452+19889+22557+247037+509304+844821+116986+744050+431318+3420686+15449+15844+26282+524569+344955+236921+114285+5494780+253632+405010+133061+324652+346517+3487414+13341+73739+137010+122899+370987+65376+1015247+1125468+445693+206777+358971+33+10937518+35532+7663+540956+84265+2315898+30020+48909+277895+134133+5213921+3031354+31640+4616+9478+571540+111012+172456+1165841+1604166+538652+128636+14427+15740+81532+180623+4117332+236124+240388+288372+41016+491503+6632416+100286+135561+5531+247689+269122+1544582+1912+1769974+195331+410294+477388+51!
5839+25795+24023+212066+258054+1224376+47746+2207928+5988+110346+554704+639599+248801+252552+72582+18921+555148+17055+342945+39879+1340748+6504992+1535915+346360+52631+335287+23791+249928+63505+167493+1925930+1333298+1056895+14005304+2878803+10084808+3455466+32937311+7061124+2234736+218774+129170+1497173+675831+2107376+351101+6272734+85987+1385499+27193405+2631778+251483+302353+4236602+2144718+57678578+386123

calculating the second line doesn't cause any of the problems described
above. the result is 27221004884.

just to be sure you have all the information you need. here you are:

address@hidden /root]# free
             total       used       free     shared    buffers     cached
Mem:         79684      77204       2480      10044       2824      13344
-/+ buffers/cache:      61036      18648
Swap:       136512       9264     127248

address@hidden /root]# cat /proc/cpuinfo
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 5
model           : 2
model name      : Pentium 75 - 200
stepping        : 6
cpu MHz         : 119.754
fdiv_bug        : no
hlt_bug         : no
sep_bug         : no
f00f_bug        : yes
coma_bug        : no
fpu             : yes
fpu_exception   : yes
cpuid level     : 1
wp              : yes
flags           : fpu vme de pse tsc msr mce cx8
bogomips        : 238.39

address@hidden /root]# uname -a
Linux michael.gym 2.2.17 #2 Sat Sep 16 21:57:35 EDT 2000 i586 unknown

address@hidden /root]# rpm -q bc
bc-1.05a-5

it's a redhat 6.2 box

address@hidden /root]# ldd /usr/bin/bc
        libreadline.so.3 => /usr/lib/libreadline.so.3 (0x40019000)
        libncurses.so.4 => /usr/lib/libncurses.so.4 (0x4003d000)
        libc.so.6 => /lib/libc.so.6 (0x4007f000)
        libtermcap.so.2 => /lib/libtermcap.so.2 (0x40174000)
        /lib/ld-linux.so.2 => /lib/ld-linux.so.2 (0x40000000)

ncurses-5.0-11
readline-2.2.1-6
glibc-2.1.3-21
libtermcap-2.0.8-20
ld.so-1.9.5-13
bash-1.14.7-22

i can reproduce the segfault and the successful calculationon of the second
addition on my machine at home. if you want to have information about the
configuration of it, just ask me.

okay, and finally a core dump (attached)

hope having helped you, good luck
floki

PS: btw, the result is 354569382 ;-)

bc-segfault.core
Description: application/coredump