Tracker: Bugs

5 segfault in socket_connect_by_name_helper - ID: 1557068
Last Update: Comment added ( sf-robot )

Hi,

I'm using version 0.96.1 with GTK2 on OpenBSD 3.9, and
I've just had a segfault with this backtrace:

#0 0x1c09d81a in socket_connect_by_name_helper
(addr=0x3c142428, user_data=0x89009000) at sockets.c:2610
#1 0x1c14b5a9 in adns_invoke_user_callback
(reply=0x3c142420) at adns.c:393
#2 0x1c14abb2 in adns_reply_callback (data=0x0,
source=5, condition=INPUT_EVENT_R) at adns.c:478
#3 0x1c156e36 in inputevt_dispatch (source=0x8054a200,
condition=G_IO_IN, data=0x8054f000) at inputevt.c:391
#4 0x0f2f3633 in g_vasprintf () from
/usr/local/lib/libglib-2.0.so.800.4
#5 0x0f2d0c34 in g_main_depth () from
/usr/local/lib/libglib-2.0.so.800.4
#6 0x0f2d1c0d in g_main_context_dispatch () from
/usr/local/lib/libglib-2.0.so.800.4
#7 0x0f2d1f32 in g_main_context_dispatch () from
/usr/local/lib/libglib-2.0.so.800.4
#8 0x0f2d243e in g_main_loop_run () from
/usr/local/lib/libglib-2.0.so.800.4
#9 0x0b634953 in gtk_main () from
/usr/local/lib/libgtk-x11-2.0.so.801.0
#10 0x1c0bc701 in main_gui_run () at main.c:774
#11 0x1c00c54f in main (argc=1, argv=0xcfbe01d4) at
main.c:984

Let me know if you need any more info.

Cheers
- Ian


Ian Chard ( flup ) - 2006-09-12 11:48

5

Closed

None

Christian Biere

Core

0.96

Public


Comments ( 7 )

Date: 2006-12-05 03:20
Sender: sf-robotSourceForge.net Site Admin


This Tracker item was closed automatically by the system. It was
previously set to a Pending status, and the original submitter
did not respond within 14 days (the time period specified by
the administrator of this Tracker).


Date: 2006-11-09 01:18
Sender: cbiere

Logged In: YES
user_id=643728

Can you reproduce this with 0.96.2 or current SVN?


Date: 2006-09-14 19:06
Sender: cbiere

Logged In: YES
user_id=643728

It's a bit odd that you cannot read the memory because
according to the stacktrace, the crash occured on write
access, not on read access. I believe this is just same issue
which is also responsible for 'seg fault after "Close
search"'. Since this seems reproducable for you, could you
maybe try gtk-gnutella from current SVN? The other
bug seems fixed in it and if both have the same cause, this
one should have been fixed as well.


Date: 2006-09-14 11:20
Sender: flup

Logged In: YES
user_id=172671

A bit more info: I don't know if it's just coincidence, but
the last message before both crashes was:

06-09-12 12:46:02 (WARNING): adns_do_transfer: EOF (read)



Date: 2006-09-14 08:29
Sender: flup

Logged In: YES
user_id=172671

Don't know if this helps, but it crashed again last night in
the same place, but with a slightly different address (also
invalid).


Date: 2006-09-14 08:28
Sender: flup

Logged In: YES
user_id=172671

As you suspected, the result was:

Cannot access memory at address 0x89009000

- Ian


Date: 2006-09-12 16:22
Sender: cbiere

Logged In: YES
user_id=643728

Could you load the coredump again with gdb and enter this:

frame 0
p *(struct gnutella_socket *) 0x89009000

I suspect the pointer doesn't pointer to a valid socket
anymore but this looks more like a memory corruption -
possibly caused by freeing memory with the wrong function
- than a bug in this place.


Attached File

No Files Currently Attached

Changes ( 5 )

Field Old Value Date By
status_id Pending 2006-12-05 03:20 sf-robot
close_date 2006-11-20 14:31 2006-12-05 03:20 sf-robot
status_id Open 2006-11-20 14:31 cbiere
assigned_to nobody 2006-11-20 14:31 cbiere
close_date - 2006-11-20 14:31 cbiere