polipo 1.0.4.1-1.1 segfaults inside ___vsnprintf_chk on connection failure when using unbound as a dns server

[Leif Walsh]

Binary package hint: polipo

I recently changed my polipo config to do a bunch of things. In some quick A/B testing, I think the change that caused this to start happening was "pipelineAdditionalRequests = true". (the others were to point to a local instance of unbound for recursive DNS resolution (dnsNameServer = 127.0.0.1), and to log issues to syslog instead of its own logfile (logFile = "", logSyslog = yes).)

Every few requests, it crashes with a segfault when printing an error message, in ___vsnprintf_chk, but I don't have debugging symbols above that call. I've attached my config file and a coredump after the segfault, please advise as to how to continue debugging. For the moment, I'm fairly convinced it's just that one config option (pipelineAdditionalRequests), which I can live without, but it would be nice to fix this, if only for other people that want that option.

[Leif Walsh (leif.walsh)]

Never mind, the bug still occurs even with that line commented out, it's got to be the logging stuff. I really would much rather it go to syslog so this is a bit more critical for me.

I have a second backtrace and coredump, this time from it segfaulting when printing a different error. Here is the backtrace:

Program received signal SIGSEGV, Segmentation fault.
0x00007f5d12bcc7aa in _IO_vfprintf_internal (s=0x7fff966ba1f0,
    format=<value optimized out>, ap=0x7fff966ba390) at vfprintf.c:1614
1614 vfprintf.c: No such file or directory.
 in vfprintf.c
(gdb) bt
#0 0x00007f5d12bcc7aa in _IO_vfprintf_internal (s=0x7fff966ba1f0,
    format=<value optimized out>, ap=0x7fff966ba390) at vfprintf.c:1614
#1 0x00007f5d12c80a80 in ___vsnprintf_chk (
    s=0x11c2690 "Inconsistent \"from client: Connection reset by peer",
    maxlen=<value optimized out>, flags=1, slen=<value optimized out>,
    format=0x4288c4 "Inconsistent \"%s\" reply for ", args=0x7fff966ba390)
    at vsnprintf_chk.c:65

The coredump will follow in another attachment. (please note these are amd64 dumps)

If someone can get me the debugging symbols for polipo I can probably debug this myself. It seems to just be a null pointer getting passed into a printf somewhere but I can't see where it comes from.

[Leif Walsh (leif.walsh)]

It's been over a month with no response, even an "ask upstream".

Is there any other information I should provide? Can someone at least tell me how to get debugging symbols for the package?

[Rolf Leggewie (r0lf)]

For those of you who would like to test my wip packages before I upload them to Debian, you can get them for precise (and later) from my stable PPA: https://launchpad.net/~r0lf/+archive/stable

Please kindly let me know if you can reproduce the issue with the latest package.

[Launchpad Janitor (janitor)]

[Expired for polipo (Ubuntu) because there has been no activity for 60 days.]