[Dspam-devel] [ dspam-Bug Tracker-2990455 ] glibc detected double free or corruption
Brought to you by:
paulcockings,
sbajic
Menu
▾
▴
[Dspam-devel] [ dspam-Bug Tracker-2990455 ] glibc detected double free or corruption
|
From: SourceForge.net <no...@so...> - 2010-04-22 00:19:12
|
Bug Tracker item #2990455, was opened at 2010-04-21 17:08 Message generated for change (Comment added) made by sbajic You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=1126467&aid=2990455&group_id=250683 Please note that this message will contain a full copy of the comment thread, including the initial issue submission, for this request, not just the latest update. Category: None Group: None Status: Open Resolution: None Priority: 9 Private: No Submitted By: borei (boreix) Assigned to: Stevan Bajic (sbajic) Summary: glibc detected double free or corruption Initial Comment: Training ham / spam corpora... [test: spam ] spam/1270805719.H355503P3831.mai result: *** glibc detected *** /usr/local/bin/dspam: double free or corruption (!prev): 0x08356b08 *** ======= Backtrace: ========= /lib/libc.so.6[0x899595] /lib/libc.so.6(cfree+0x59)[0x8999d9] /usr/local/bin/dspam(process_message+0xaeb)[0x80523fb] /usr/local/bin/dspam(process_users+0x9ac)[0x805362c] /usr/local/bin/dspam(main+0x440)[0x8054340] /lib/libc.so.6(__libc_start_main+0xdc)[0x845e9c] /usr/local/bin/dspam[0x804ae41] ======= Memory map: ======== 00101000-00142000 r-xp 00000000 fd:00 622657 /lib/libssl.so.0.9.8b 00142000-00146000 rwxp 00040000 fd:00 622657 /lib/libssl.so.0.9.8b 001d0000-001d1000 r-xp 001d0000 00:00 0 [vdso] 00254000-0025f000 r-xp 00000000 fd:01 3048022 /usr/local/lib/dspam/libpgsql_drv.so.7.0.0 0025f000-00260000 rwxp 0000b000 fd:01 3048022 /usr/local/lib/dspam/libpgsql_drv.so.7.0.0 00557000-0056b000 r-xp 00000000 fd:01 2624430 /usr/local/lib/libdspam.so.7.0.0 0056b000-0056c000 rwxp 00014000 fd:01 2624430 /usr/local/lib/libdspam.so.7.0.0 0056c000-0056d000 rwxp 0056c000 00:00 0 00812000-0082c000 r-xp 00000000 fd:00 622608 /lib/ld-2.5.so 0082c000-0082d000 r-xp 00019000 fd:00 622608 /lib/ld-2.5.so 0082d000-0082e000 rwxp 0001a000 fd:00 622608 /lib/ld-2.5.so 00830000-0096f000 r-xp 00000000 fd:00 622614 /lib/libc-2.5.so 0096f000-00970000 --xp 0013f000 fd:00 622614 /lib/libc-2.5.so 00970000-00972000 r-xp 0013f000 fd:00 622614 /lib/libc-2.5.so 00972000-00973000 rwxp 00141000 fd:00 622614 /lib/libc-2.5.so 00973000-00976000 rwxp 00973000 00:00 0 00978000-0097a000 r-xp 00000000 fd:00 622628 /lib/libdl-2.5.so 0097a000-0097b000 r-xp 00001000 fd:00 622628 /lib/libdl-2.5.so 0097b000-0097c000 rwxp 00002000 fd:00 622628 /lib/libdl-2.5.so 0097e000-009a3000 r-xp 00000000 fd:00 622615 /lib/libm-2.5.so 009a3000-009a4000 r-xp 00024000 fd:00 622615 /lib/libm-2.5.so 009a4000-009a5000 rwxp 00025000 fd:00 622615 /lib/libm-2.5.so 009a7000-009bb000 r-xp 00000000 fd:00 622632 /lib/libpthread-2.5.so 009bb000-009bc000 r-xp 00013000 fd:00 622632 /lib/libpthread-2.5.so 009bc000-009bd000 rwxp 00014000 fd:00 622632 /lib/libpthread-2.5.so 009bd000-009bf000 rwxp 009bd000 00:00 0 009c1000-009fc000 r-xp 00000000 fd:00 622647 /lib/libsepol.so.1 009fc000-009fd000 rwxp 0003a000 fd:00 622647 /lib/libsepol.so.1 009fd000-00a07000 rwxp 009fd000 00:00 0 00a09000-00a1f000 r-xp 00000000 fd:00 622649 /lib/libselinux.so.1 00a1f000-00a21000 rwxp 00015000 fd:00 622649 /lib/libselinux.so.1 00a23000-00a35000 r-xp 00000000 fd:01 2755350 /usr/lib/libz.so.1.2.3 00a35000-00a36000 rwxp 00011000 fd:01 2755350 /usr/lib/libz.so.1.2.3 00a43000-00a56000 r-xp 00000000 fd:00 622622 /lib/libnsl-2.5.so 00a56000-00a57000 r-xp 00012000 fd:00 622622 /lib/libnsl-2.5.so 00a57000-00a58000 rwxp 00013000 fd:00 622622 /lib/libnsl-2.5.so 00a58000-00a5a000 rwxp 00a58000 00:00 0 00a5c000-00a65000 r-xp 00000000 fd:00 622629 /lib/libcrypt-2.5.so 00a65000-00a66000 r-xp 00008000 fd:00 622629 /lib/libcrypt-2.5.so 00a66000-00a67000 rwxp 00009000 fd:00 622629 /lib/libcrypt-2.5.so 00a67000-00a8e000 rwxp 00a67000 00:00 0 00a90000-00a9f000 r-xp 00000000 fd:00 622627 /lib/libresolv-2.5.so 00a9f000-00aa0000 r-xp 0000e000 fd:00 622627 /lib/libresolv-2.5.so 00aa0000-00aa1000 rwxp 0000f000 fd:00 622627 /lib/libresolv-2.5.so 00aa1000-00aa3000 rwxp 00aa1000 00:00 0 00aa5000-00ab0000 r-xp 00000000 fd:00 622618 /lib/libgcc_s-4.1.2-20080825.so.1 00ab0000-00ab1000 rwxp 0000a000 fd:00 622618 /lib/libgcc_s-4.1.2-20080825.so.1 00ae9000-00b08000 r-xp 00000000 fd:01 2755358 /usr/lib/libpq.so.4.1 00b08000-00b09000 rwxp 0001f000 fd:01 2755358 /usr/lib/libpq.so.4.1 00b45000-00b47000 r-xp 00000000 fd:00 622654 /lib/libcom_err.so.2.1 00b47000-00b48000 rwxp 00001000 fd:00 622654 /lib/libcom_err.so.2.1 00b4a000-00b4c000 r-xp 00000000 fd:00 622646 /lib/libkeyutils-1.2.so 00b4c000-00b4d000 rwxp 00001000 fd:00 622646 /lib/libkeyutils-1.2.so 00b4f000-00c6c000 r-xp 00000000 fd:00 622655 /lib/libcrypto.so.0.9.8b 00c6c000-00c7f000 rwxp 0011c000 fd:00 622655 /lib/libcrypto.so.0.9.8b 00c7f000-00c82000 rwxp 00c7f000 00:00 0 00c84000-00d14000 r-xp 00000000 fd:01 2755133 /usr/lib/libkrb5.so.3.3 00d14000-00d17000 rwxp 0008f000 fd:01 2755133 /usr/lib/libkrb5.so.3.3 00d19000-00d21000 r-xp 00000000 fd:01 2755054 /usr/lib/libkrb5support.so.0.1 00d21000-00d22000 rwxp 00007000 fd:01 2755054 /usr/lib/libkrb5support.so.0.1 00d24000-00d49000 r-xp 00000000 fd:01 2755128 /usr/lib/libk5crypto.so.3.1 00d49000-00d4a000 rwxp 00025000 fd:01 2755128 /usr/lib/libk5crypto.so.3.1 00d4c000-00d79000 r-xp 00000000 fd:01 2755142 /usr/lib/libgssapi_krb5.so.2.2 00d79000-00d7a000 rwxp 0002d000 fd:01 2755142 /usr/lib/libgssapi_krb5.so.2.2 00fa4000-00fad000 r-xp 00000000 fd:00 622665 /lib/libnss_files-2.5.so 00fad000-00fae000 r-xp 00008000 fd:00 622665 /lib/libnss_files-2.5.so 00fae000-00faf000 rwxp 00009000 fd:00 622665 /lib/libnss_files-2.5.so 08048000-0805e000 r-xp 00000000 fd:01 2624431 /usr/local/bin/dspam 0805e000-0805f000 rw-p 00015000 fd:01 2624431 /usr/local/bin/dspam 08344000-083bf000 rw-p 08344000 00:00 0 [heap] b7f12000-b7f15000 rw-p b7f12000 00:00 0 b7f1b000-b7f1c000 rw-p b7f1b000 00:00 0 bf96e000-bf983000 rw-p bffea000 00:00 0 [stack] sh: line 1: 28938 Aborted valgrind points to dsapm.c line 856 ==29060== Invalid free() / delete / delete[] ==29060== at 0x4004FDA: free (vg_replace_malloc.c:233) ==29060== by 0x80523FA: process_message (dspam.c:856) ==29060== by 0x805362B: process_users (dspam.c:1869) ==29060== by 0x805433F: main (dspam.c:265) ==29060== Address 0x42A7E90 is 0 bytes inside a block of size 12,744 free'd ==29060== at 0x4004FDA: free (vg_replace_malloc.c:233) ==29060== by 0x4016CF6: _ds_operate (libdspam.c:1150) ==29060== by 0x4017A47: dspam_process (libdspam.c:593) ==29060== by 0x804DB3A: user_classify (dspam.c:1471) ==29060== by 0x804DD63: ensure_confident_result (dspam.c:2760) ==29060== by 0x8052681: process_message (dspam.c:556) ==29060== by 0x805362B: process_users (dspam.c:1869) ==29060== by 0x805433F: main (dspam.c:265) ==29060== ==29060== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 68 from 1) ==29060== malloc/free: in use at exit: 40 bytes in 2 blocks. ==29060== malloc/free: 10,138 allocs, 10,137 frees, 1,463,740 bytes allocated. ==29060== For counts of detected errors, rerun with: -v ==29060== searching for pointers to 2 not-freed blocks. ==29060== checked 87,252 bytes. ==29060== ==29060== LEAK SUMMARY: ==29060== definitely lost: 0 bytes in 0 blocks. ==29060== possibly lost: 0 bytes in 0 blocks. ==29060== still reachable: 40 bytes in 2 blocks. ==29060== suppressed: 0 bytes in 0 blocks. ==29060== Reachable blocks (those to which a pointer was found) are not shown. ==29060== To see them, rerun with: --show-reachable=yes ---------------------------------------------------------------------- >Comment By: Stevan Bajic (sbajic) Date: 2010-04-22 02:19 Message: btw: What version of DSPAM are you using? 3.9.0? GIT? If not git, would it be possible to checkout DSPAM from GIT and try if you get the same issue there as well? ---------------------------------------------------------------------- Comment By: Stevan Bajic (sbajic) Date: 2010-04-22 02:17 Message: To run in gdb do this: --------------------------------------------------- # gdb /usr/local/bin/dspam (gdb) run --debug --user spa...@pa... --deliver=summary --stdout < 'spam/1270805719.H355503P3831.mail2.server.parasun.com,S=6979:2,S' --------------------------------------------------- ---------------------------------------------------------------------- Comment By: borei (boreix) Date: 2010-04-22 01:38 Message: issue reproduced 100 % using the following command: /usr/local/bin/dspam --debug --user spa...@pa... --deliver=summary --stdout < 'spam/1270805719.H355503P3831.mail2.server.parasun.com,S=6979:2,S' for any email under spam/directory as well as from exim during scan process. I'm bit confused how to run it within gdb, because gdb is not happy with "<" sign. valgrind shows the following: ==27223== Invalid free() / delete / delete[] ==27223== at 0x4004FDA: free (vg_replace_malloc.c:233) ==27223== by 0x80523FA: process_message (dspam.c:856) ==27223== by 0x805362B: process_users (dspam.c:1869) ==27223== by 0x805433F: main (dspam.c:265) ==27223== Address 0x413F028 is 0 bytes inside a block of size 12,768 free'd ==27223== at 0x4004FDA: free (vg_replace_malloc.c:233) ==27223== by 0x4016CF6: _ds_operate (libdspam.c:1150) ==27223== by 0x4017A47: dspam_process (libdspam.c:593) ==27223== by 0x804DB3A: user_classify (dspam.c:1471) ==27223== by 0x804DD63: ensure_confident_result (dspam.c:2760) ==27223== by 0x8052681: process_message (dspam.c:556) ==27223== by 0x805362B: process_users (dspam.c:1869) ==27223== by 0x805433F: main (dspam.c:265) ==27223== ==27223== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 67 from 1) ==27223== malloc/free: in use at exit: 40 bytes in 2 blocks. ==27223== malloc/free: 9,171 allocs, 9,170 frees, 1,368,176 bytes allocated. ==27223== For counts of detected errors, rerun with: -v ==27223== searching for pointers to 2 not-freed blocks. ==27223== checked 87,252 bytes. ---------------------------------------------------------------------- Comment By: Stevan Bajic (sbajic) Date: 2010-04-21 20:16 Message: Hallo boreix Are you able to trigger that error when ever you need/want? Could you try to run that command then from within GDB and produce an backtrace? Stevan ---------------------------------------------------------------------- Comment By: borei (boreix) Date: 2010-04-21 17:27 Message: [root@ex-relay04 dspam]# gcc -v Using built-in specs. Target: i386-redhat-linux Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --infodir=/usr/share/info --enable-shared --enable-threads=posix --enable-checking=release --with-system-zlib --enable-__cxa_atexit --disable-libunwind-exceptions --enable-libgcj-multifile --enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk --disable-dssi --enable-plugin --with-java-home=/usr/lib/jvm/java-1.4.2-gcj-1.4.2.0/jre --with-cpu=generic --host=i386-redhat-linux Thread model: posix gcc version 4.1.2 20080704 (Red Hat 4.1.2-44) ---------------------------------------------------------------------- Comment By: borei (boreix) Date: 2010-04-21 17:26 Message: [root@ex-relay04 dspam]# rpm -qa | grep glibc glibc-common-2.5-42.el5_4.3 glibc-2.5-42.el5_4.3 glibc-devel-2.5-42.el5_4.3 glibc-headers-2.5-42.el5_4.3 [root@ex-relay04 dspam]# uname -a Linux ex-relay04.server.parasun.com 2.6.18-128.1.6.el5 #1 SMP Wed Apr 1 09:19:18 EDT 2009 i686 i686 i386 GNU/Linux ---------------------------------------------------------------------- You can respond by visiting: https://sourceforge.net/tracker/?func=detail&atid=1126467&aid=2990455&group_id=250683 |