munmap_chunk: invalid pointer

[Fionn]

Problem arose when trying to access a DDV chip card in a CM4000 reader via aqhbci / gwenhyfar.

This is not reliably reproducable. Sometimes the chip card works as expected. I usually issue a command line "chipcard-tool atr" before I try to use the card productively because this seems to increase chances of everything working as expected.

Ubuntu Version 10.04 with all updates as of 2010-11-06
libchipcard-tools 4.2.8-1ubuntu1

root@rtfm[~] /etc/init.d/libchipcard-tools start
Starting libchipcard daemon: 3:2010/11/06 11-42-50:(null)(7022):chipcardd.c: 1236: Closing GWEN
chipcardd4.
root@rtfm[~] *** glibc detected *** /usr/lib/chipcard/server/drivers/ifd: munmap_chunk(): invalid pointer: 0x096ec6e8 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6(+0x6b591)[0x17b591]
/lib/tls/i686/cmov/libc.so.6(+0x6c80e)[0x17c80e]
/usr/lib/libgwenhywfar.so.47(GWEN_Memory_dealloc+0x27)[0xa8ebc7]
/usr/lib/libgwenhywfar.so.47(GWEN_Buffer_free+0x52)[0xa83a02]
/usr/lib/chipcard/server/drivers/ifd(LCD_Slot_SetAtr+0x33)[0x805b2a3]
/usr/lib/chipcard/server/drivers/ifd(DriverIFD_DisconnectSlot+0x83)[0x804ed83]
/usr/lib/chipcard/server/drivers/ifd(LCD_Driver_DisconnectSlot+0x2f)[0x8051b5f]
/usr/lib/chipcard/server/drivers/ifd(DriverIFD_DisconnectReader+0xec)[0x804d71c]
/usr/lib/chipcard/server/drivers/ifd(LCD_Driver_DisconnectReader+0x37)[0x8052397]
/usr/lib/chipcard/server/drivers/ifd[0x8058ba2]
/usr/lib/chipcard/server/drivers/ifd(LCD_Driver_Work+0x1ac)[0x805975c]
/usr/lib/chipcard/server/drivers/ifd(main+0xb0)[0x8051380]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0x126bd6]
/usr/lib/chipcard/server/drivers/ifd[0x804ca41]

======= Memory map: ========
00110000-00263000 r-xp 00000000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
00263000-00264000 ---p 00153000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
00264000-00266000 r--p 00153000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
00266000-00267000 rw-p 00155000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
00267000-0026a000 rw-p 00000000 00:00 0
0026a000-00300000 r-xp 00000000 fc:02 17424240 /usr/lib/libgnutls.so.26.14.12
00300000-00304000 r--p 00095000 fc:02 17424240 /usr/lib/libgnutls.so.26.14.12
00304000-00305000 rw-p 00099000 fc:02 17424240 /usr/lib/libgnutls.so.26.14.12
00305000-00307000 r-xp 00000000 fc:02 33795796 /lib/tls/i686/cmov/libdl-2.11.1.so
00307000-00308000 r--p 00001000 fc:02 33795796 /lib/tls/i686/cmov/libdl-2.11.1.so
00308000-00309000 rw-p 00002000 fc:02 33795796 /lib/tls/i686/cmov/libdl-2.11.1.so
00309000-00318000 r-xp 00000000 fc:02 17423733 /usr/lib/libtasn1.so.3.1.7
00318000-00319000 r--p 0000e000 fc:02 17423733 /usr/lib/libtasn1.so.3.1.7
00319000-0031a000 rw-p 0000f000 fc:02 17423733 /usr/lib/libtasn1.so.3.1.7
0031a000-0031e000 r-xp 00000000 fc:02 50919155 /usr/local/lib/pcsc/drivers/libcm4000.so
0031e000-0031f000 rw-p 00003000 fc:02 50919155 /usr/local/lib/pcsc/drivers/libcm4000.so
0049e000-004d5000 r-xp 00000000 fc:02 16810159 /lib/libdbus-1.so.3.4.0
004d5000-004d6000 r--p 00036000 fc:02 16810159 /lib/libdbus-1.so.3.4.0
004d6000-004d7000 rw-p 00037000 fc:02 16810159 /lib/libdbus-1.so.3.4.0

005c0000-00630000 r-xp 00000000 fc:02 17394996 /lib/libgcrypt.so.11.5.2
00630000-00631000 r--p 00070000 fc:02 17394996 /lib/libgcrypt.so.11.5.2
00631000-00633000 rw-p 00071000 fc:02 17394996 /lib/libgcrypt.so.11.5.2
006e2000-006e9000 r-xp 00000000 fc:02 33795824 /lib/tls/i686/cmov/librt-2.11.1.so
006e9000-006ea000 r--p 00006000 fc:02 33795824 /lib/tls/i686/cmov/librt-2.11.1.so
006ea000-006eb000 rw-p 00007000 fc:02 33795824 /lib/tls/i686/cmov/librt-2.11.1.so
00714000-00715000 r-xp 00000000 00:00 0 [vdso]
00779000-00789000 r-xp 00000000 fc:02 16861694 /usr/lib/libhal.so.1.0.0
00789000-0078a000 r--p 0000f000 fc:02 16861694 /usr/lib/libhal.so.1.0.0
0078a000-0078b000 rw-p 00010000 fc:02 16861694 /usr/lib/libhal.so.1.0.0
008e6000-00903000 r-xp 00000000 fc:02 17337709 /lib/libgcc_s.so.1
00903000-00904000 r--p 0001c000 fc:02 17337709 /lib/libgcc_s.so.1
00904000-00905000 rw-p 0001d000 fc:02 17337709 /lib/libgcc_s.so.1
00945000-0095a000 r-xp 00000000 fc:02 33795818 /lib/tls/i686/cmov/libpthread-2.11.1.so
0095a000-0095b000 r--p 00014000 fc:02 33795818 /lib/tls/i686/cmov/libpthread-2.11.1.so
0095b000-0095c000 rw-p 00015000 fc:02 33795818 /lib/tls/i686/cmov/libpthread-2.11.1.so
0095c000-0095e000 rw-p 00000000 00:00 0
009e6000-00a01000 r-xp 00000000 fc:02 17430490 /lib/ld-2.11.1.so
00a01000-00a02000 r--p 0001a000 fc:02 17430490 /lib/ld-2.11.1.so
00a02000-00a03000 rw-p 0001b000 fc:02 17430490 /lib/ld-2.11.1.so

00a57000-00b50000 r-xp 00000000 fc:02 16777685 /usr/lib/libgwenhywfar.so.47.11.3
00b50000-00b51000 r--p 000f8000 fc:02 16777685 /usr/lib/libgwenhywfar.so.47.11.3
00b51000-00b52000 rw-p 000f9000 fc:02 16777685 /usr/lib/libgwenhywfar.so.47.11.3
00b94000-00b97000 r-xp 00000000 fc:02 17364578 /lib/libgpg-error.so.0.4.0
00b97000-00b98000 r--p 00002000 fc:02 17364578 /lib/libgpg-error.so.0.4.0
00b98000-00b99000 rw-p 00003000 fc:02 17364578 /lib/libgpg-error.so.0.4.0
00ea3000-00eb6000 r-xp 00000000 fc:02 16842206 /lib/libz.so.1.2.3.3
00eb6000-00eb7000 r--p 00012000 fc:02 16842206 /lib/libz.so.1.2.3.3
00eb7000-00eb8000 rw-p 00013000 fc:02 16842206 /lib/libz.so.1.2.3.3
08048000-08063000 r-xp 00000000 fc:02 51177622 /usr/lib/chipcard/server/drivers/ifd
08063000-08064000 r--p 0001a000 fc:02 51177622 /usr/lib/chipcard/server/drivers/ifd
08064000-08065000 rw-p 0001b000 fc:02 51177622 /usr/lib/chipcard/server/drivers/ifd
096d6000-09717000 rw-p 00000000 00:00 0 [heap]
b766c000-b76ab000 r--p 00000000 fc:02 17394988 /usr/lib/locale/de_DE.utf8/LC_CTYPE
b76ab000-b77c9000 r--p 00000000 fc:02 67192039 /usr/lib/locale/de_DE.utf8/LC_COLLATE
b77c9000-b77cd000 rw-p 00000000 00:00 0

b77d6000-b77d7000 r--p 00000000 fc:02 67184610 /usr/lib/locale/de_DE.utf8/LC_NUMERIC
b77d7000-b77d8000 r--p 00000000 fc:02 67192032 /usr/lib/locale/de_DE.utf8/LC_TIME
b77d8000-b77d9000 r--p 00000000 fc:02 67192064 /usr/lib/locale/de_DE.utf8/LC_MONETARY
b77d9000-b77da000 r--p 00000000 fc:02 68029407 /usr/lib/locale/de_DE.utf8/LC_PAPER
b77da000-b77db000 r--p 00000000 fc:02 67192065 /usr/lib/locale/de_DE.utf8/LC_NAME
b77db000-b77dc000 r--p 00000000 fc:02 67192066 /usr/lib/locale/de_DE.utf8/LC_ADDRESS
b77dc000-b77dd000 r--p 00000000 fc:02 67192067 /usr/lib/locale/de_DE.utf8/LC_TELEPHONE
b77dd000-b77de000 r--p 00000000 fc:02 68029411 /usr/lib/locale/de_DE.utf8/LC_MEASUREMENT
b77de000-b77e5000 r--s 00000000 fc:02 35010491 /usr/lib/gconv/gconv-modules.cache
b77e5000-b77e6000 r--p 00000000 fc:02 67192068 /usr/lib/locale/de_DE.utf8/LC_IDENTIFICATION
b77e6000-b77e8000 rw-p 00000000 00:00 0
bfb92000-bfbb3000 rwxp 00000000 00:00 0 [stack]
*** glibc detected *** /usr/lib/chipcard/server/drivers/ifd: munmap_chunk(): invalid pointer: 0x099316e8 ***
======= Backtrace: =========

/lib/tls/i686/cmov/libc.so.6(+0x6b591)[0x4b6591]
/lib/tls/i686/cmov/libc.so.6(+0x6c80e)[0x4b780e]
/usr/lib/libgwenhywfar.so.47(GWEN_Memory_dealloc+0x27)[0xe5fbc7]
/usr/lib/libgwenhywfar.so.47(GWEN_Buffer_free+0x52)[0xe54a02]
/usr/lib/chipcard/server/drivers/ifd(LCD_Slot_SetAtr+0x33)[0x805b2a3]
/usr/lib/chipcard/server/drivers/ifd(DriverIFD_DisconnectSlot+0x83)[0x804ed83]
/usr/lib/chipcard/server/drivers/ifd(LCD_Driver_DisconnectSlot+0x2f)[0x8051b5f]
/usr/lib/chipcard/server/drivers/ifd(DriverIFD_DisconnectReader+0xec)[0x804d71c]
/usr/lib/chipcard/server/drivers/ifd(LCD_Driver_DisconnectReader+0x37)[0x8052397]
/usr/lib/chipcard/server/drivers/ifd[0x8058ba2]
/usr/lib/chipcard/server/drivers/ifd(LCD_Driver_Work+0x1ac)[0x805975c]
/usr/lib/chipcard/server/drivers/ifd(main+0xb0)[0x8051380]
/lib/tls/i686/cmov/libc.so.6(__libc_start_main+0xe6)[0x461bd6]
/usr/lib/chipcard/server/drivers/ifd[0x804ca41]
======= Memory map: ========
00110000-00125000 r-xp 00000000 fc:02 33795818 /lib/tls/i686/cmov/libpthread-2.11.1.so
00125000-00126000 r--p 00014000 fc:02 33795818 /lib/tls/i686/cmov/libpthread-2.11.1.so
00126000-00127000 rw-p 00015000 fc:02 33795818 /lib/tls/i686/cmov/libpthread-2.11.1.so
00127000-00129000 rw-p 00000000 00:00 0

00129000-001bf000 r-xp 00000000 fc:02 17424240 /usr/lib/libgnutls.so.26.14.12
001bf000-001c3000 r--p 00095000 fc:02 17424240 /usr/lib/libgnutls.so.26.14.12
001c3000-001c4000 rw-p 00099000 fc:02 17424240 /usr/lib/libgnutls.so.26.14.12
001c4000-001c8000 r-xp 00000000 fc:02 50919155 /usr/local/lib/pcsc/drivers/libcm4000.so
001c8000-001c9000 rw-p 00003000 fc:02 50919155 /usr/local/lib/pcsc/drivers/libcm4000.so
001c9000-001e6000 r-xp 00000000 fc:02 17337709 /lib/libgcc_s.so.1
001e6000-001e7000 r--p 0001c000 fc:02 17337709 /lib/libgcc_s.so.1
001e7000-001e8000 rw-p 0001d000 fc:02 17337709 /lib/libgcc_s.so.1
00231000-00238000 r-xp 00000000 fc:02 33795824 /lib/tls/i686/cmov/librt-2.11.1.so
00238000-00239000 r--p 00006000 fc:02 33795824 /lib/tls/i686/cmov/librt-2.11.1.so
00239000-0023a000 rw-p 00007000 fc:02 33795824 /lib/tls/i686/cmov/librt-2.11.1.so
0029a000-0029d000 r-xp 00000000 fc:02 17364578 /lib/libgpg-error.so.0.4.0
0029d000-0029e000 r--p 00002000 fc:02 17364578 /lib/libgpg-error.so.0.4.0
0029e000-0029f000 rw-p 00003000 fc:02 17364578 /lib/libgpg-error.so.0.4.0
002de000-0034e000 r-xp 00000000 fc:02 17394996 /lib/libgcrypt.so.11.5.2
0034e000-0034f000 r--p 00070000 fc:02 17394996 /lib/libgcrypt.so.11.5.2
0034f000-00351000 rw-p 00071000 fc:02 17394996 /lib/libgcrypt.so.11.5.2
0038b000-0039b000 r-xp 00000000 fc:02 16861694 /usr/lib/libhal.so.1.0.0
0039b000-0039c000 r--p 0000f000 fc:02 16861694 /usr/lib/libhal.so.1.0.0
0039c000-0039d000 rw-p 00010000 fc:02 16861694 /usr/lib/libhal.so.1.0.0

0044b000-0059e000 r-xp 00000000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
0059e000-0059f000 ---p 00153000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
0059f000-005a1000 r--p 00153000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
005a1000-005a2000 rw-p 00155000 fc:02 33668448 /lib/tls/i686/cmov/libc-2.11.1.so
005a2000-005a5000 rw-p 00000000 00:00 0
0062e000-0063d000 r-xp 00000000 fc:02 17423733 /usr/lib/libtasn1.so.3.1.7
0063d000-0063e000 r--p 0000e000 fc:02 17423733 /usr/lib/libtasn1.so.3.1.7
0063e000-0063f000 rw-p 0000f000 fc:02 17423733 /usr/lib/libtasn1.so.3.1.7
00753000-00755000 r-xp 00000000 fc:02 33795796 /lib/tls/i686/cmov/libdl-2.11.1.so
00755000-00756000 r--p 00001000 fc:02 33795796 /lib/tls/i686/cmov/libdl-2.11.1.so
00756000-00757000 rw-p 00002000 fc:02 33795796 /lib/tls/i686/cmov/libdl-2.11.1.so
00832000-00845000 r-xp 00000000 fc:02 16842206 /lib/libz.so.1.2.3.3
00845000-00846000 r--p 00012000 fc:02 16842206 /lib/libz.so.1.2.3.3
00846000-00847000 rw-p 00013000 fc:02 16842206 /lib/libz.so.1.2.3.3
0090c000-00927000 r-xp 00000000 fc:02 17430490 /lib/ld-2.11.1.so
00927000-00928000 r--p 0001a000 fc:02 17430490 /lib/ld-2.11.1.so
00928000-00929000 rw-p 0001b000 fc:02 17430490 /lib/ld-2.11.1.so
00a95000-00a96000 r-xp 00000000 00:00 0 [vdso]
00c9e000-00cd5000 r-xp 00000000 fc:02 16810159 /lib/libdbus-1.so.3.4.0
00cd5000-00cd6000 r--p 00036000 fc:02 16810159 /lib/libdbus-1.so.3.4.0
00cd6000-00cd7000 rw-p 00037000 fc:02 16810159 /lib/libdbus-1.so.3.4.0
00e28000-00f21000 r-xp 00000000 fc:02 16777685 /usr/lib/libgwenhywfar.so.47.11.3
00f21000-00f22000 r--p 000f8000 fc:02 16777685 /usr/lib/libgwenhywfar.so.47.11.3
00f22000-00f23000 rw-p 000f9000 fc:02 16777685 /usr/lib/libgwenhywfar.so.47.11.3
08048000-08063000 r-xp 00000000 fc:02 51177622 /usr/lib/chipcard/server/drivers/ifd
08063000-08064000 r--p 0001a000 fc:02 51177622 /usr/lib/chipcard/server/drivers/ifd
08064000-08065000 rw-p 0001b000 fc:02 51177622 /usr/lib/chipcard/server/drivers/ifd
0991b000-0995b000 rw-p 00000000 00:00 0 [heap]
b776f000-b77ae000 r--p 00000000 fc:02 17394988 /usr/lib/locale/de_DE.utf8/LC_CTYPE
b77ae000-b78cc000 r--p 00000000 fc:02 67192039 /usr/lib/locale/de_DE.utf8/LC_COLLATE
b78cc000-b78d0000 rw-p 00000000 00:00 0
b78d9000-b78da000 r--p 00000000 fc:02 67184610 /usr/lib/locale/de_DE.utf8/LC_NUMERIC
b78da000-b78db000 r--p 00000000 fc:02 67192032 /usr/lib/locale/de_DE.utf8/LC_TIME
b78db000-b78dc000 r--p 00000000 fc:02 67192064 /usr/lib/locale/de_DE.utf8/LC_MONETARY
b78dc000-b78dd000 r--p 00000000 fc:02 68029407 /usr/lib/locale/de_DE.utf8/LC_PAPER
b78dd000-b78de000 r--p 00000000 fc:02 67192065 /usr/lib/locale/de_DE.utf8/LC_NAME
b78de000-b78df000 r--p 00000000 fc:02 67192066 /usr/lib/locale/de_DE.utf8/LC_ADDRESS
b78df000-b78e0000 r--p 00000000 fc:02 67192067 /usr/lib/locale/de_DE.utf8/LC_TELEPHONE
b78e0000-b78e1000 r--p 00000000 fc:02 68029411 /usr/lib/locale/de_DE.utf8/LC_MEASUREMENT
b78e1000-b78e8000 r--s 00000000 fc:02 35010491 /usr/lib/gconv/gconv-modules.cache
b78e8000-b78e9000 r--p 00000000 fc:02 67192068 /usr/lib/locale/de_DE.utf8/LC_IDENTIFICATION
b78e9000-b78eb000 rw-p 00000000 00:00 0
bfb5f000-bfb7f000 rwxp 00000000 00:00 0 [stack]
bfb7f000-bfb80000 rw-p 00000000 00:00 0

[Micha Lenk (micha)]

The issue was related to the libchipcard daemon. With libchipcard 5.0.0-1 in Ubuntu natty, there is no libchipcard daemon anymore. Hence I mark this bug as "Fix Released".