Segmentation fatal in quick_send_bits

[skypexu]

(gdb) run -l1 c enwik8.pmd tmp1
Starting program: /home/yifeng.xyf/example31 -l1 c enwik8.pmd tmp1
Mode: c, Level: 1
Input File: "enwik8.pmd"
Output File: "tmp1"
Input file size: 21388296

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bdf069 in quick_send_bits (s=0x802490, flush=0) at deflate_quick.c:91
91 *(unsigned *)(s->pending_buf + s->pending) = out;
Missing separate debuginfos, use: debuginfo-install glibc-2.12-1.47.el6.x86_64

(gdb) print s
$1 = {strm = 0x7fffffffe320, status = 113,
pending_buf = 0x81bc70 ";\321\025NU\266z\327O\035MZ\223\242\262\264X\353j\307k\211놉\233\026(O\340\333|\356\330/\211\354{\177;\317\324^\330t\177\303E\t[\301\216O\034\033;\037n\224\372Q\266fW\364\257)U\242\237w\355\373\277b\347\325\334w\277\n\267\266\237\336:\263\201O=\323\352Lg\221\261\201\324\253\311\002Wj\375J\223\071\035\342Φ\250[\374\367I\377\377\341vȅ\326C=?\216\230\273\233\027>\262\022\371\067\301\361A\353C\265S\315\001\267\027\032\nl\234\261\357\343\352e\261k\267\256\374(\261jI\273\301\236\267\261\241{\256\037\310a\026\277\221\261\344\345\332w\271\276z\356\276fsfN?l\030+\256e"..., pending_buf_size = 65536,
pending_out = 0x821a05 "\276\207G\365=\357<y\367\216k\301\245e\376\256+zrh\354\023\273\070\327um\272{[\263l\364\304\031\031\263\257]\370\303s\300\362\254J\313\306X\237\206ɓ/\236\233$\244\370y>#[\243\200\224c\327\371\237\306Y\246\027\236\v\277o\377"\331\341zKL\341\354\364\245\232%W\312N/2bS,\334\377\371C\345f\teǾ_\232\307K\n&-\t!?u\257\350\034\225\203:;5\323\032\255>\253{<\177\024ﲮo\037\313\333o\332\034\261\027N+\204\070\375\063Y(\272@]\351\350k1}\375\260\245\375lq\327\312\032\217\345t<\350n\376\310 \271\250\346\263X\307f\261\345z2I-\217"..., pending = 197518, wrap = 1, gzhead = 0x0, gzindex = 0, method = 8 '\b', last_flush = 0, crc0 = {
0 <repeats 20 times>}, w_size = 8192, w_bits = 13, w_mask = 8191,
window = 0x803c30 "H\377\334\tK\262%\202\344?mԶ]\023\246\210\177\340Z\217n\250\217\314\330.\a48\366\237\030C_j\315=\232&", window_size = 16384, prev = 0x807c50,
head = 0x80bc60, ins_h = 24445, hash_size = 32768, hash_bits = 15, hash_mask = 32767, hash_shift = 5, block_start = -1007877, match_length = 2, prev_match = 0,
match_available = 0, strstart = 9685, match_start = 4290813952, lookahead = 6699, prev_length = 2, max_chain_length = 4, max_lazy_match = 4, level = 1,
strategy = 0, good_match = 4, nice_match = 8, dyn_ltree = {{fc = {freq = 0, code = 0}, dl = {dad = 0, len = 0}} <repeats 256 times>, {fc = {freq = 1, code = 1},
dl = {dad = 0, len = 0}}, {fc = {freq = 0, code = 0}, dl = {dad = 0, len = 0}} <repeats 316 times>}, dyn_dtree = {{fc = {freq = 0, code = 0}, dl = {dad = 0,
len = 0}} <repeats 61 times>}, bl_tree = {{fc = {freq = 0, code = 0}, dl = {dad = 0, len = 0}} <repeats 39 times>}, l_desc = {dyn_tree = 0x8025b4,
max_code = 0, stat_desc = 0x7ffff7df9bc0}, d_desc = {dyn_tree = 0x802ea8, max_code = 0, stat_desc = 0x7ffff7df9be0}, bl_desc = {dyn_tree = 0x802f9c,
max_code = 0, stat_desc = 0x7ffff7df9c00}, bl_count = {0 <repeats 16 times>}, heap = {0 <repeats 573 times>}, heap_len = 0, heap_max = 0,
depth = '\000' <repeats 572 times>,
l_buf = 0x827c70 "g\027_Tx'\230z\255w\266\211\263\273U\331\304"\373\254\314Jd\377\255Ow\205\177>}\236{\234\241t\207\366\277]?\312v\371M^\374o\375\331]\242\334,K$L\343\nͧ|;\020\022\366\342Ζ\344,\215\031\241Ƭ;΅\262\361\027\365\234|\273\244\360\205\344;\226\264\210\025\365\226\025\231\342\314q{\362\237\204\177\315\323g\337\367H\342\324\352\306\022w\355\362ٷOOT\236\331_\371u_p\360\273\365\065Kn+\257w\332\340\335\373\246\325O1(\372\330\003\071\265\345a\335\362s\266M\371R\024\177\350\376>]\376\253\353\217\316l\272"\306\362*\356M̛\306\315\317Z?ש\025X.\237\351\374\376"..., lit_bufsize = 16384, last_lit = 0, d_buf = 0x81fc70, opt_len = 0, static_len = 0,
matches = 0, insert = 0, bi_buf = 0, bi_valid = 0, high_water = 16384}

sample source code is here:
https://code.google.com/p/miniz/source/browse/trunk/example3.c?r=45

replace #include "miniz.c" with #include <zlib.h> and fix some minor compiling errors.
data file to test:
http://cs.fit.edu/~mmahoney/compression/enwik8.pmd

[jtkukunas]

Hi skypexu,

Thanks for reporting this. I have confirmed your test case triggers a bug where both the available output (strm.next_out) and the internal pending buffers are completely filled. There needs to be an additional check in deflate_quick() to return from deflate() in this case, so the user can free up some space by flushing the available output buffer.

[jtkukunas]

Hi skypexu,

I've pushed a branch, issue8, which should fix this issue. Could you confirm that this branch, specifically commit 20489ba, fixes the issue for you?

Thanks.

[skypexu]

Thank you for your quick response. I can confirm the bug is fixed!--------- Original Message ---------From: Jim Kukunas To: jtkukunas/zlib Date: Sat Jul 26 07:45:47 GMT+08:00 2014Subject: Re: [zlib] Segmentation fatal in quick_send_bits (#8)
Hi skypexu,

I've pushed a branch, issue8, which should fix this issue. Could you confirm that this branch, specifically commit 20489ba, fixes the issue for you?

Thanks.

—Reply to this email directly or view it on GitHub.