[apport] iceauth crashed with SIGSEGV in strlen()

[evilhomer]

Binary package hint: iceauth

Crash icon was on my taskbar after I booted up

ProblemType: Crash
Architecture: i386
Date: Fri Apr 6 16:07:52 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/bin/iceauth
Package: iceauth 1:1.0.1-0ubuntu2
PackageArchitecture: i386
ProcCmdline: iceauth remove netid=local/roc-ahubbard:/tmp/.ICE-unix/dcop5674-1175861561
ProcCwd: /home/ahubbard
ProcEnviron:
 PATH=/home/ahubbard/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: iceauth
Stacktrace:
 #0 0xb7e31c23 in strlen () from /lib/tls/i686/cmov/libc.so.6
 #1 0xb7f093e3 in IceUnlockAuthFile () from /usr/lib/libICE.so.6
 #2 0x0804992b in ?? ()
 #3 0x00000000 in ?? ()
StacktraceTop:
 strlen () from /lib/tls/i686/cmov/libc.so.6
 IceUnlockAuthFile () from /usr/lib/libICE.so.6
 ?? ()
 ?? ()
Uname: Linux roc-ahubbard 2.6.20-12-generic #2 SMP Wed Mar 21 20:55:46 UTC 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev scanner video

[Apport retracing service (apport)]

StacktraceTop:strlen () from /lib/tls/i686/cmov/libc.so.6
IceUnlockAuthFile (file_name=0x0) at ../../src/authutil.c:230
?? ()
?? ()

[didier (did447-deactivatedaccount)]

iceauth can dump a core in auth_initialize() if a signal is caught before iceauth_filename has been malloced.

[didier (did447-deactivatedaccount)]

seems that the signal handler is called before file_name is 'malloced'

[Timo Aaltonen (tjaalton)]

You all seem to have something in common.. the hostname includes a dash. Could you rename the host so it doesn't have a dash, and then try to reproduce this.

[didier (did447-deactivatedaccount)]

No,

In my understanding, on exit a lot of stuffs are killed *very*
quickly. It could be the reason why there's so many reports of SIGSEV
in a lot of packages.

For iceauth

--- process.c~ 2007-05-10 16:53:29.000000000 +0200
+++ process.c 2007-05-10 16:53:29.000000000 +0200
@@ -742,7 +742,7 @@
        }
     }

- if (!ignore_locks) {
+ if (!ignore_locks && iceauth_filename) {
        IceUnlockAuthFile (iceauth_filename);
     }
     (void) umask (original_umask);

[Alan Coopersmith (alan-coopersmith)]

Yep - was able to trigger it by running on Solaris and using dtrace to fire a
signal in auth_initialize between the call to register_signals() and the malloc
of iceauth_filename.

Stack trace showed crash in:

program terminated by signal SEGV (no mapping at the fault address)
0xfef74e0f: IceUnlockAuthFile+0x0027: repnz scasb
Current function is auth_finalize
  726 IceUnlockAuthFile (iceauth_filename);
(dbx) where
  [1] IceUnlockAuthFile(0x0), at 0xfef74e0f
=>[2] auth_finalize(), line 726 in "process.c"
  [3] die(sig = 1), line 501 in "process.c"
  [4] catchsig(sig = 1), line 523 in "process.c"
  [5] __sighndlr(0x1, 0x0, 0x8047860, 0x80534a0), at 0xfef1d39f
  [6] call_user_handler(0x1, 0x0, 0x8047860), at 0xfef128ab
  [7] sigacthandler(0x1, 0x0, 0x8047860, 0xf, 0x0, 0x0), at 0xfef12a52
  ---- called from signal handler with signal 1 (SIGHUP) ------
  [8] auth_initialize(authfilename = 0x80681d0 "/.ICEauthority"), line 584 in "process.c"
  [9] main(argc = 1, argv = 0x8047af0), line 157 in "iceauth.c"

Adding a test for NULL filename before calling IceUnlockAuthFile cleared the
crash, but left the lock file behind. Moving the initialization of
authfilename to earlier in auth_initialize allowed the locks to be cleaned up
as well.

Committed fix to git master in commit 0022cf7baf11bccea0024d0dc8c1ecc37e46ef3d.

[didier (did447-deactivatedaccount)]

Fixed upstream cf:

http://bugs.freedesktop.org/show_bug.cgi?id=10739

[Timo Aaltonen (tjaalton)]

Fixed in gutsy, which has iceauth 1.0.2.