w3m: SIGSEV in sk_pop_free(3)

Just found ~/w3m.core on my Pinebook Pro running snapshots with
`vm.malloc_conf=SU':
OpenBSD 6.9-beta (GENERIC.MP) #1094: Fri Mar 26 14:15:00 MDT 2021

I've used w3m extensively to browse several sites and download files,
I cannot tell when or how this happened exactly -- given that it didn't
crash directly while using it, perhaps it dumped core during teardown
when I quit a session?

I keep using it but am unable to reproduce it so far, sorry for the poor
report; anything else I can provide?

Here's the output of `bt full' with debug-w3m installed:

[New process 187909]
[New process 174050]
[New process 252009]
[New process 115020]
[New process 442102]
[New process 522326]
Core was generated by `w3m'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 sk_pop_free (st=0xdfdfdfdfdfdfdfdf, func=0xb88605058 <ASN1_OBJECT_free>) at /usr/src/lib/libcrypto/stack/stack.c:279

warning: Source file is more recent than executable.
279 for (i = 0; i < st->num; i++)
[Current thread is 1 (process 187909)]
#0 sk_pop_free (st=0xdfdfdfdfdfdfdfdf, func=0xb88605058 <ASN1_OBJECT_free>) at /usr/src/lib/libcrypto/stack/stack.c:279
i = <optimized out>
#1 0x0000000b885c4ad8 in x509_verify_param_zero (param=0xbc8b7a380) at /usr/src/lib/libcrypto/x509/x509_vpm.c:183
paramid = <optimized out>
#2 0x0000000b885c4b68 in X509_VERIFY_PARAM_free (param=0xbc8b7a380) at /usr/src/lib/libcrypto/x509/x509_vpm.c:225
No locals.
#3 0x0000000afb5526a4 in SSL_CTX_free (ctx=0xb586d2280) at /usr/src/lib/libssl/ssl_lib.c:1964
i = <optimized out>
#4 0x00000006e72e3f84 in free_ssl_ctx ()
No symbol table info available.
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Re: WIP: QEMU 6.0.0-rc1

On Thu, Apr 01, 2021 at 12:43:41AM -0400, Brad Smith wrote:
> On Sat, Mar 27, 2021 at 02:31:16PM -0400, Brad Smith wrote:
> > Here is a work in progress update to QEMU 6.0.0-rc0.
> >
> > I was able to fix the library detection for a few dependencies,
> > the optimization level being hardcoded and Meson was linking
> > libstdc++ when utilizing Clang (proabably due to only testing
> > on Linux).
> >
> > I'm really hating this conversion to Meson. It really does some
> > oddball crap.
> >
> > Testing and feedback welcome.
>
> Updated for rc1.

fwiw, i've just tested the guest-agent part of this new version, accessing a
-current kvm VM on a proxmox 6.1 host, and it still works as expected.

root@openbsd-amd64:~# qm agent 100 get-host-name
{
"host-name" : "c64.proxmox2"
}
root@openbsd-amd64:~# qm agent 100 get-osinfo
{
"kernel-release" : "6.9",
"kernel-version" : "GENERIC.MP#421",
"machine" : "amd64"
}
root@openbsd-amd64:~# qm guest exec 100 -- ls -l /tmp 2>&1 | jq -r '."out-data"'
total 5496
drwxrwxrwt 2 root wheel 512 Mar 22 13:58 .ICE-unix
drwxrwxrwt 2 root wheel 512 Mar 22 13:58 .X11-unix
-rw------- 1 landry wheel 0 Mar 31 11:13 dep2.vDQ9YP4k1k
-rw-r--r-- 1 root wheel 25 Apr 1 13:59 qga.state
drwxr-xr-x 2 root wheel 512 Mar 22 13:58 sndio
-rw-r--r-- 1 landry wheel 2772992 Mar 24 09:37 srs6.db
drwx------ 2 landry wheel 512 Mar 22 14:51 tmux-1000
drwxrwxrwt 2 root wheel 512 Mar 18 11:59 vi.recover

thanks !

Landry