[pptp-devel] Occasional segfault in pptpcm

[Paul H. <pa...@ci...>]

This is from https://bugzilla.redhat.com/show_bug.cgi?id=749455

The pptp version in Fedora has most of the updates from CVS apart from a 
couple of recent enhancements.

Backtrace:

# gdb /usr/sbin/pptp core.13323
GNU gdb (GDB) Fedora (7.3.50.20110722-9.fc16)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "i686-redhat-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/sbin/pptp...Reading symbols from
/usr/lib/debug/usr/sbin/pptp.debug...done.
done.

warning: core file may not match specified executable file.
[New LWP 13323]

Core was generated by `pptp xxxx.xxxxxx.xxx --nolaunchpppd --loglevel 0
--logstring vpn_ppp9'.
Program terminated with signal 11, Segmentation fault.
#0  0x0804e796 in binary_search (key=29712, v=<optimized out>) at 
vector.c:149
149             if (key <  v->item[x].key) r = x - 1; else l = x + 1;
(gdb) thread apply all bt full

Thread 1 (LWP 13323):
#0  0x0804e796 in binary_search (key=29712, v=<optimized out>) at 
vector.c:149
         l = <optimized out>
         r = 13923351
         x = 6961675
#1  0x0804e9ba in vector_contains (v=0x9e78560, key=29712) at vector.c:138
         __PRETTY_FUNCTION__ = "vector_contains"
#2  0x0804bda4 in pptp_call_destroy (conn=0x9e784a0, call=0x9e78978) at
pptp_ctrl.c:410
         __PRETTY_FUNCTION__ = "pptp_call_destroy"
#3  0x0804bea9 in pptp_conn_destroy (conn=0x9e784a0) at pptp_ctrl.c:449
         i = 0
         __PRETTY_FUNCTION__ = "pptp_conn_destroy"
#4  0x08050ee3 in callmgr_main (argc=3, argv=0xbf81fe60, envp=0xbf8211f4) at
pptp_callmgr.c:297
         rc = <optimized out>
         read_set = {__fds_bits = {0 <repeats 32 times>}}
         write_set = {__fds_bits = {0 <repeats 32 times>}}
         tv = {tv_sec = 0, tv_usec = 0}
         inetaddr = {s_addr = 47496396}
         inet_sock = 0
         unix_sock = 1
         call_set = {__fds_bits = {0 <repeats 32 times>}}
         conn = 0x9e784a0
         call_list = 0x9e7a688
         max_fd = 6
         first = 0
         retval = <optimized out>
         i = <optimized out>
         phonenr = 0x0
         __FUNCTION__ = "callmgr_main"
         __PRETTY_FUNCTION__ = "callmgr_main"
#5  0x0804a312 in launch_callmgr (inetaddr=..., phonenr=0x0, argc=7,
argv=0xbf8211d4, envp=0xbf8211f4) at pptp.c:505
         my_argv = {0xbf82296f "pptp", 0xb77c56a0 "xxx.xxx.xxx.x", 0x0}
         buf = "pptp: call manager for
xxx.xxx.xxx.x\000z\324\000\001\000\000\000IM\301\000\364o\324\000\230\210\324\000\000\000\000\000\370\376\201\277Wz\305\000\034\207\004\bhf\005\b\334\376\201\277\000\000\000\000\376\063\000\000\300V|\267\240\376\201\277\000\000\000\000\062\065\065.\001\000\000\000>\377\201\277\364o\324\000\324\021\202\277\220?\000\v",
<incomplete sequence \305>
         rc = <optimized out>
#6  0x0804a4c4 in open_callmgr (inetaddr=..., phonenr=0x0, argc=7,
argv=0xbf8211d4, envp=0xbf8211f4, pty_fd=0, gre_fd=4)
     at pptp.c:474
         where = {sun_family = 1,
           sun_path =
"/var/run/pptp/255.255.255.255:xxx.xxx.xxx.x\000\260\254\004\b\004\000\000\000\234\377\201\277\020\000\000\000\000\000\000\000\034\207\004\bxe\005\b(\021\202\277|\241\004\bt)\202\277\310b\272\000\a\000\000\000\002\000\000\000?\324\002\324\021\202\277\a\000\000"}
         fd = 1
         pid = <optimized out>
         status = 4
         __FUNCTION__ = "open_callmgr"
#7  0x08049720 in main (argc=Cannot access memory at address 0x7410
) at pptp.c:375
         inetaddr = {s_addr = 47496396}
         callmgr_sock = -1
         ttydev = '\000' <repeats 2113 times>, "?\224", '\000' <repeats 45
times>,
"x\006}\267(\t\202\277d\225\000\b\v\202\277\200\347\223\000\000\200\324\000\\*\000\000\003\000\000\000\062\000\000\000\377\377\377\377\000\000\000\000\000\000\000\000\330\003}\267X\t\202\277d\225\000\330\003}\267\367\341\223\000x\340r\000\000\000\000\000\b\000\000\000\200?\000\000\000\000\000\000P\032\000\070N\032\000\070N\032\000\000\000\000\000\005\000\000\000\000P\032\000\000\200\032\000|~\032\000\\\252\032\000\000P\032\000\003\000\000\000\b\000\000\000r\002\000\000\240\030\000\000\240\030\000\000d\225\000x\006}\267T\232\225\000\243?\000\b\000\000\000\017\000\000\000\000\020\000\000\003\000\000\000d\225\000\000\000\000\000d\225\000\340,\224\000\360\b}\267h\006}\267\017\000\000\000\000\000\000\000d\225\000\000\000\000\000/\b}\267\325)\224\000?\225\000h\006}\267\022"...
         tty_name = <optimized out>
         pty_fd = 0
         tty_fd = 0
         gre_fd = 4
         rc = <optimized out>
         parent_pid = 0
         child_pid = 13310
         call_id = <optimized out>
         peer_call_id = <optimized out>
         buf =
"\000t\021\202\277\377\377\377\377\071\032\224\000\020\021\202\277<\203\004\b\370\020\202\277d\225\000\370\230\225\000\001\000\000\000\000\000\000\000\333b\224\000\260\232\225\000b\000\000\000\030\000\000\000\362;\005\b\a\000\000\000\326\331\310\000\002\217\324\000Qk\320\000l\000\000\000\000\000\000\000\034\207\004\b\360e\005\b",
'\000' <repeats 12 times>"\230,
u\272\000\000p\237\252\364o\324\000\030\000\000\000\362;\005\b\a\000"
         pppdargc = 0
         pppdargv = 0xbf8211f0
         phonenrbuf =
"\000\356\341\310\000\a\000\000\000\220?\000\a\000\000\000\240\341\310\000\\e\005\b\000\000\000\000\245\330\310\000\260\235\004\b\000\000\000\000\001\000\000\000\030\000\000\000!\216\004\b\364o\324\000\320Q\324\000\\e\005\b"
         phonenr = 0x0
         launchpppd = 0
         debug = 0
         __FUNCTION__ = "main"
(gdb)

Any thoughts?

Paul.