Crashes after any transfer on Alpha

[Debian Bug Importer]

Automatically imported from Debian bug report #334141 http://bugs.debian.org/334141

[Noël Köthe (noel)]

forwarded 334141 <email address hidden>
tags 334141 + confirmed upstream
severity 334141 normal
merge 334059 334141
thanks

Am Samstag, den 15.10.2005, 22:08 +0200 schrieb Falk Hueffner:

Hello Falk,

> Severity: grave

I downgraded the severity because the file is downloaded correctly.

> falk@juist:/tmp% lftp ftp://ftp.debian.org/debian
> cd ok, cwd=/debian
> lftp ftp.debian.org:/debian> get README
> 1055 bytes transferred
> *** glibc detected *** double free or corruption (!prev): 0x00000001201feff0 ***
> zsh: abort (core dumped) lftp ftp://ftp.debian.org/debian

Yes its a problem with 3.3.1 already reported twice. Its not arch
specific (got report from amd64 and i386).
I'm merging the bugs.

--
Noèl Köthe <noel debian.org>

[Debian Bug Importer (debzilla)]

Automatically imported from Debian bug report #334141 http://bugs.debian.org/334141

[Debian Bug Importer (debzilla)]

Message-Id: <E1EQsKd-0007Fn-FE@juist>
Date: Sat, 15 Oct 2005 22:08:39 +0200
From: Falk Hueffner <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: Crashes after any transfer on Alpha

Package: lftp
Version: 3.3.1-1
Severity: grave
File: /usr/bin/lftp

falk@juist:/tmp% lftp ftp://ftp.debian.org/debian
cd ok, cwd=/debian
lftp ftp.debian.org:/debian> get README
1055 bytes transferred
*** glibc detected *** double free or corruption (!prev): 0x00000001201feff0 ***
zsh: abort (core dumped) lftp ftp://ftp.debian.org/debian
falk@juist:/tmp%

Downgrading lftp from 3.3.1-1 to 3.3.0-1 fixes it.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: alpha
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.13.2
Locale: LANG=C, LC_CTYPE=de_DE@euro (charmap=ISO-8859-15)

Versions of packages lftp depends on:
ii libc6.1 2.3.5-6 GNU C Library: Shared libraries an
ii libgcc1 1:4.0.2-2 GCC support library
ii libgcrypt11 1.2.1-4 LGPL Crypto library - runtime libr
ii libgnutls12 1.2.6-1 the GNU TLS library - runtime libr
ii libgpg-error0 1.1-4 library for common error values an
ii libncurses5 5.4-9 Shared libraries for terminal hand
ii libreadline5 5.0-11 GNU readline and history libraries
ii libtasn1-2 0.2.13-1 Manage ASN.1 structures (runtime)
ii netbase 4.22 Basic TCP/IP networking system
ii zlib1g 1:1.2.3-4 compression library - runtime

lftp recommends no packages.

-- no debconf information

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Sat, 15 Oct 2005 23:25:10 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>, Falk Hueffner <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#334141: Crashes after any transfer on Alpha

--=-yYpXt8/hQ2KKnrs/KWqD
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

forwarded 334141 <email address hidden>
tags 334141 + confirmed upstream
severity 334141 normal
merge 334059 334141
thanks

Am Samstag, den 15.10.2005, 22:08 +0200 schrieb Falk Hueffner:

Hello Falk,

> Severity: grave

I downgraded the severity because the file is downloaded correctly.

> falk@juist:/tmp% lftp ftp://ftp.debian.org/debian=20
> cd ok, cwd=3D/debian =20
> lftp ftp.debian.org:/debian> get README
> 1055 bytes transferred =20
> *** glibc detected *** double free or corruption (!prev): 0x00000001201fe=
ff0 ***
> zsh: abort (core dumped) lftp ftp://ftp.debian.org/debian

Yes its a problem with 3.3.1 already reported twice. Its not arch
specific (got report from amd64 and i386).
I'm merging the bugs.

--=20
No=C3=A8l K=C3=B6the <noel debian.org>

--=-yYpXt8/hQ2KKnrs/KWqD
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQBDUXO29/DnDzB9Vu0RAmdlAKCEqfAY8Yr92gxUt58IID5UWiJUHACfUddZ
oRrlcrkcDv1AuDb4HKodqHY=
=2rza
-----END PGP SIGNATURE-----

--=-yYpXt8/hQ2KKnrs/KWqD--

[Dennis Kaarsemaker (dennis)]

Architecture unsupported on ubuntu.

[Noël Köthe (noel)]

forwarded 334292 <email address hidden>
tags 334292 + confirmed upstream
severity 334292 normal
merge 334059 334292
thanks

Am Sonntag, den 16.10.2005, 23:38 +0200 schrieb Filippo Giunchedi:

Hello,

> Severity: grave
> Justification: renders package unusable

> consider this sample output
>
> godog@hattori:~$ lftp mysite
> Password:
> cd ok, cwd=/
> lftp <email address hidden>:/> cd www
> cd ok, cwd=/www
> lftp <email address hidden>:/www> put ~/tmp/subscribe.php
> 801 bytes transferred
> *** glibc detected *** double free or corruption (!prev): 0x10139df8 ***
> Aborted
> godog@hattori:~$
>
> note that the file got actually transferred successfully!

Yes this is correct and already reported 3 times. Because the file is
not corrupt the severity of grave is not correct.

--
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 17 Oct 2005 08:30:28 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>, Filippo Giunchedi <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#334292: lftp: illegal instruction/double free detected

--=-uitpv6nd0mEjXEi8uL1R
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

forwarded 334292 <email address hidden>
tags 334292 + confirmed upstream
severity 334292 normal
merge 334059 334292
thanks

Am Sonntag, den 16.10.2005, 23:38 +0200 schrieb Filippo Giunchedi:

Hello,

> Severity: grave
> Justification: renders package unusable

> consider this sample output
>=20
> godog@hattori:~$ lftp mysite=20
> Password:
> cd ok, cwd=3D/
> lftp <email address hidden>:/> cd www
> cd ok, cwd=3D/www
> lftp <email address hidden>:/www> put ~/tmp/subscribe.php
> 801 bytes transferred
> *** glibc detected *** double free or corruption (!prev): 0x10139df8 ***
> Aborted
> godog@hattori:~$
>=20
> note that the file got actually transferred successfully!

Yes this is correct and already reported 3 times. Because the file is
not corrupt the severity of grave is not correct.

--=20
No=C3=A8l K=C3=B6the <noel debian.org>
Debian GNU/Linux, www.debian.org

--=-uitpv6nd0mEjXEi8uL1R
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQBDU0UE9/DnDzB9Vu0RAsXDAKCWsex+0Htb2div1LO0k+Oj4YttWACfQH3r
FfE9O8Ve4lDd7KR4ECtT1U8=
=Jg/H
-----END PGP SIGNATURE-----

--=-uitpv6nd0mEjXEi8uL1R--

[Paul Hampson (paul-hampson)]

tags 334292 +patch
Thankyou Mr Bug Control Robot

The double-free in lftp is caused by the SMTask::Schedule's deleting
of deletable tasks.

Basically, it takes the next pointer of the task before deleting it,
but deleting the task can also delete other tasks. In the case of
a 'put', it seems to quite consistently delete the next task in the
chain. Since the memory is still around, and marked as deleteable,
it tries to delete it again, and causes the double-free.

The below patch fixes this by restarted the Schedule() loop if we've
deleted anything and were not at the end of the chain. (It also
protects the delete call against being called on 0x0, but that might
be a usual idiom in C++.)

(I also had a bit of trouble emulating the brace/indentation style.)

diff -u lftp-3.3.1.orig/src/SMTask.cc lftp-3.3.1/src/SMTask.cc
--- lftp-3.3.1.orig/src/SMTask.cc
+++ lftp-3.3.1/src/SMTask.cc
@@ -211,7 +211,12 @@
 #endif
       Leave(current); // unmark it running and change current.

- delete to_delete;
+ if(to_delete)
+ {
+ delete to_delete;
+ if( scan != 0) // Side-effects may have boned us
+ scan = chain;
+ }
       if(res==MOVED || to_delete)
   repeat=true;
    }

The below patch is actually fixing an unitialised value error
that valgrind picked up while I was debugging this.

diff -u lftp-3.3.1.orig/src/lftp.cc lftp-3.3.1/src/lftp.cc
--- lftp-3.3.1.orig/src/lftp.cc
+++ lftp-3.3.1/src/lftp.cc
@@ -112,6 +112,7 @@
    {
       tty=isatty(0);
       ctty=(tcgetpgrp(0)!=(pid_t)-1);
+ add_newline=false;
       to_free=0;
       eof_count=0;
       for_history=0;

--
Paul "TBBle" Hampson, <email address hidden>
8th year CompSci/Asian Studies student, ANU

Shorter .sig for a more eco-friendly paperless office.

[Debian Bug Importer (debzilla)]

Message-ID: <email address hidden>
Date: Mon, 17 Oct 2005 19:24:48 +1000
From: Paul TBBle Hampson <email address hidden>
To: <email address hidden>, <email address hidden>,
 <email address hidden>
Subject: Solution to lftp double-free-on-put

--x+6KMIRAuhnl3hBn
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

tags 334292 +patch
Thankyou Mr Bug Control Robot

The double-free in lftp is caused by the SMTask::Schedule's deleting
of deletable tasks.

Basically, it takes the next pointer of the task before deleting it,
but deleting the task can also delete other tasks. In the case of
a 'put', it seems to quite consistently delete the next task in the
chain. Since the memory is still around, and marked as deleteable,
it tries to delete it again, and causes the double-free.

The below patch fixes this by restarted the Schedule() loop if we've
deleted anything and were not at the end of the chain. (It also
protects the delete call against being called on 0x0, but that might
be a usual idiom in C++.)

(I also had a bit of trouble emulating the brace/indentation style.)

diff -u lftp-3.3.1.orig/src/SMTask.cc lftp-3.3.1/src/SMTask.cc
--- lftp-3.3.1.orig/src/SMTask.cc
+++ lftp-3.3.1/src/SMTask.cc
@@ -211,7 +211,12 @@
 #endif
       Leave(current); // unmark it running and change current.
=20
- delete to_delete;
+ if(to_delete)
+ {
+ delete to_delete;
+ if( scan !=3D 0) // Side-effects may have boned us
+ scan =3D chain;
+ }
       if(res=3D=3DMOVED || to_delete)
   repeat=3Dtrue;
    }

The below patch is actually fixing an unitialised value error
that valgrind picked up while I was debugging this.

diff -u lftp-3.3.1.orig/src/lftp.cc lftp-3.3.1/src/lftp.cc
--- lftp-3.3.1.orig/src/lftp.cc
+++ lftp-3.3.1/src/lftp.cc
@@ -112,6 +112,7 @@
    {
       tty=3Disatty(0);
       ctty=3D(tcgetpgrp(0)!=3D(pid_t)-1);
+ add_newline=3Dfalse;
       to_free=3D0;
       eof_count=3D0;
       for_history=3D0;

--=20
Paul "TBBle" Hampson, <email address hidden>
8th year CompSci/Asian Studies student, ANU

Shorter .sig for a more eco-friendly paperless office.

--x+6KMIRAuhnl3hBn
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)

iD8DBQFDU23gexDuohKLFuARAp5tAKCTrzHThIrP6GUQjgA65tOWvDhfRACgvodw
ZmTIvB93vQK8dj2SGetPdvs=
=wY+R
-----END PGP SIGNATURE-----

--x+6KMIRAuhnl3hBn--

[Noël Köthe (noel)]

forwarded 334059 <email address hidden>
tags 334059 + confirmed upstream
merge 334059 334292
thanks

Am Montag, den 17.10.2005, 14:21 +0100 schrieb Alastair McKinstry:

> lftp ftp.debian.org:/debian/pool/main/d/directfb> get libdirectfb-0.9.22-8_i3
> get: Access failed: 550 Failed to open file. (libdirectfb-0.9.22-8_i3)
> *** glibc detected *** corrupted double-linked list: 0x08183c78 ***
> Aborted
> coll:directfb# lftp ftp.debian.org

Yes. Its already reported.

--
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org

[Noël Köthe (noel)]

forwarded 334359 <email address hidden>
tags 334359 + confirmed upstream
merge 334359 334292
thanks

--
Noèl Köthe <email address hidden>
Hostsharing eG, www.hostsharing.net

[Noël Köthe (noel)]

forwarded 334376 <email address hidden>
tags 334376 + confirmed upstream
merge 334376 334292
thanks

--
Noèl Köthe <noel debian.org>
Debian GNU/Linux, www.debian.org

[Noël Köthe (noel)]

Source: lftp
Source-Version: 3.3.2-1

We believe that the bug you reported is fixed in the latest version of
lftp, which is due to be installed in the Debian FTP archive:

lftp_3.3.2-1.diff.gz
  to pool/main/l/lftp/lftp_3.3.2-1.diff.gz
lftp_3.3.2-1.dsc
  to pool/main/l/lftp/lftp_3.3.2-1.dsc
lftp_3.3.2-1_i386.deb
  to pool/main/l/lftp/lftp_3.3.2-1_i386.deb
lftp_3.3.2.orig.tar.gz
  to pool/main/l/lftp/lftp_3.3.2.orig.tar.gz

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noèl Köthe <email address hidden> (supplier of updated lftp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 17 Oct 2005 17:22:35 +0200
Source: lftp
Binary: lftp
Architecture: source i386
Version: 3.3.2-1
Distribution: unstable
Urgency: low
Maintainer: Noèl Köthe <email address hidden>
Changed-By: Noèl Köthe <email address hidden>
Description:
 lftp - Sophisticated command-line FTP/HTTP client programs
Closes: 334059
Changes:
 lftp (3.3.2-1) unstable; urgency=low
 .
   * new upstream from 2005-10-17
     (closes: Bug#334059)
Files:
 7aa0b81985f0c63f15cef08096011ca1 611 net optional lftp_3.3.2-1.dsc
 5779f71226e2fb75fb3cb642dfd9708e 1723768 net optional lftp_3.3.2.orig.tar.gz
 476f94cbb484f8b36c526d2eba19ec62 10767 net optional lftp_3.3.2-1.diff.gz
 a0b306a4409456106cd708e6efeeb71a 570946 net optional lftp_3.3.2-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDU5uU9/DnDzB9Vu0RAsEKAJoD1PfFYHgSqB/po6XOj7R5XTiLHwCggTNL
HQ6KL0saW4dmy6xWMEN5iYo=
=Wuq4
-----END PGP SIGNATURE-----

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 17 Oct 2005 17:08:08 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>, Alastair McKinstry <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#334359: problem detected with latest glibc - double-linked
 list

--=-UuwYL0aYUL/D80vKZlI/
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

forwarded 334059 <email address hidden>
tags 334059 + confirmed upstream
merge 334059 334292
thanks

Am Montag, den 17.10.2005, 14:21 +0100 schrieb Alastair McKinstry:

> lftp ftp.debian.org:/debian/pool/main/d/directfb> get libdirectfb-0.9.22-=
8_i3
> get: Access failed: 550 Failed to open file. (libdirectfb-0.9.22-8_i3)
> *** glibc detected *** corrupted double-linked list: 0x08183c78 ***
> Aborted
> coll:directfb# lftp ftp.debian.org

Yes. Its already reported.

--=20
No=C3=A8l K=C3=B6the <noel debian.org>
Debian GNU/Linux, www.debian.org

--=-UuwYL0aYUL/D80vKZlI/
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBDU75Y9/DnDzB9Vu0RAie7AJ0bC+Fds63EPJRJK5Ff7v1NnJflPQCfbAZs
BXdUkVv1mCGnkn+JFCQxGdk=
=bZHw
-----END PGP SIGNATURE-----

--=-UuwYL0aYUL/D80vKZlI/--

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 17 Oct 2005 17:27:22 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>
Subject:

--=-jCyh80qF6eib/BJFJJ3T
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

forwarded 334359 <email address hidden>
tags 334359 + confirmed upstream
merge 334359 334292
thanks

--=20
No=C3=A8l K=C3=B6the <email address hidden>
Hostsharing eG, www.hostsharing.net

--=-jCyh80qF6eib/BJFJJ3T
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBDU8La9/DnDzB9Vu0RAqwdAJ40eWrJUsKIEIDwpOqNQgRyi0u8ygCfZxFw
i+mrXYvd5vY2IDGwqB9n/3Y=
=fO0d
-----END PGP SIGNATURE-----

--=-jCyh80qF6eib/BJFJJ3T--

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 17 Oct 2005 17:29:47 +0200
From: =?ISO-8859-1?Q?No=E8l_K=F6the?= <email address hidden>
To: <email address hidden>
Subject: 334376

--=-EayJ0ZC3P5/C+ECNjAr+
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

forwarded 334376 <email address hidden>
tags 334376 + confirmed upstream
merge 334376 334292
thanks

--=20
No=C3=A8l K=C3=B6the <noel debian.org>
Debian GNU/Linux, www.debian.org

--=-EayJ0ZC3P5/C+ECNjAr+
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQBDU8Nr9/DnDzB9Vu0RAoCmAJ9TqHziu8iX8PtudOlEUiVTj8P2hACggf1z
5lDMysFtehwg5L+Yim4nJMc=
=0/dm
-----END PGP SIGNATURE-----

--=-EayJ0ZC3P5/C+ECNjAr+--

[Debian Bug Importer (debzilla)]

Message-Id: <email address hidden>
Date: Mon, 17 Oct 2005 08:32:12 -0700
From: =?utf-8?b?Tm/DqGwgS8O2dGhl?= <email address hidden>
To: <email address hidden>
Subject: Bug#334059: fixed in lftp 3.3.2-1

Source: lftp
Source-Version: 3.3.2-1

We believe that the bug you reported is fixed in the latest version of
lftp, which is due to be installed in the Debian FTP archive:

lftp_3.3.2-1.diff.gz
  to pool/main/l/lftp/lftp_3.3.2-1.diff.gz
lftp_3.3.2-1.dsc
  to pool/main/l/lftp/lftp_3.3.2-1.dsc
lftp_3.3.2-1_i386.deb
  to pool/main/l/lftp/lftp_3.3.2-1_i386.deb
lftp_3.3.2.orig.tar.gz
  to pool/main/l/lftp/lftp_3.3.2.orig.tar.gz

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to <email address hidden>,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Noèl Köthe <email address hidden> (supplier of updated lftp package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing <email address hidden>)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Mon, 17 Oct 2005 17:22:35 +0200
Source: lftp
Binary: lftp
Architecture: source i386
Version: 3.3.2-1
Distribution: unstable
Urgency: low
Maintainer: Noèl Köthe <email address hidden>
Changed-By: Noèl Köthe <email address hidden>
Description:
 lftp - Sophisticated command-line FTP/HTTP client programs
Closes: 334059
Changes:
 lftp (3.3.2-1) unstable; urgency=low
 .
   * new upstream from 2005-10-17
     (closes: Bug#334059)
Files:
 7aa0b81985f0c63f15cef08096011ca1 611 net optional lftp_3.3.2-1.dsc
 5779f71226e2fb75fb3cb642dfd9708e 1723768 net optional lftp_3.3.2.orig.tar.gz
 476f94cbb484f8b36c526d2eba19ec62 10767 net optional lftp_3.3.2-1.diff.gz
 a0b306a4409456106cd708e6efeeb71a 570946 net optional lftp_3.3.2-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFDU5uU9/DnDzB9Vu0RAsEKAJoD1PfFYHgSqB/po6XOj7R5XTiLHwCggTNL
HQ6KL0saW4dmy6xWMEN5iYo=
=Wuq4
-----END PGP SIGNATURE-----