simple-scan crashed with SIGSEGV in gl646_setup_registers()

[Павел Трифонов]

[Impact]
Unable to scan from some HP scanners

[Test Case]
1. Connect affected HP scanner
2. Open Simple Scan
3. Click Scan
Expected result:
Page is scanned from scanner
Observed result:
Simple Scan crashes

[Regression Potential]
Low; fix is a backport from upstream git to fix reading past the end of an array.

[francesco (francesco-redhat-bugs)]

Version-Release number of selected component:
xsane-0.999-1.fc19

Additional info:
reporter: libreport-2.1.5
backtrace_rating: 4
cmdline: xsane
crash_function: gl646_setup_registers
executable: /usr/bin/xsane
kernel: 3.9.9-301.fc19.x86_64
runlevel: N 5
uid: 1000
xsession_errors:

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 gl646_setup_registers at genesys_gl646.c:748
 #1 setup_for_scan at genesys_gl646.c:3509
 #2 simple_scan at genesys_gl646.c:4994
 #3 gl646_offset_calibration at genesys_gl646.c:4088
 #4 genesys_scanner_calibration at genesys.c:3339
 #5 sane_genesys_start at genesys.c:4187
 #6 xsane_start_scan at ../../src/xsane-scan.c:1665
 #7 xsane_scan_dialog at ../../src/xsane-scan.c:2162
 #8 _g_closure_invoke_va at gclosure.c:840
 #11 gtk_real_button_released at gtkbutton.c:1712

[francesco (francesco-redhat-bugs)]

Created attachment 772344
File: backtrace

[francesco (francesco-redhat-bugs)]

Created attachment 772345
File: cgroup

[francesco (francesco-redhat-bugs)]

Created attachment 772346
File: core_backtrace

[francesco (francesco-redhat-bugs)]

Created attachment 772347
File: dso_list

[francesco (francesco-redhat-bugs)]

Created attachment 772348
File: environ

[francesco (francesco-redhat-bugs)]

Created attachment 772349
File: limits

[francesco (francesco-redhat-bugs)]

Created attachment 772350
File: maps

[francesco (francesco-redhat-bugs)]

Created attachment 772351
File: open_fds

[francesco (francesco-redhat-bugs)]

Created attachment 772352
File: proc_pid_status

[francesco (francesco-redhat-bugs)]

Created attachment 772353
File: var_log_messages

[Nils (nils-redhat-bugs)]

The crash happens in the genesys (gl646) SANE backend.

[Nils (nils-redhat-bugs)]

Upstream bug report: https://alioth.debian.org/tracker/?group_id=30186&atid=410366&func=detail&aid=314293

[Fedora (fedora-redhat-bugs)]

sane-backends-1.0.23-13.fc18 has been submitted as an update for Fedora 18.
https://admin.fedoraproject.org/updates/sane-backends-1.0.23-13.fc18

[Fedora (fedora-redhat-bugs)]

sane-backends-1.0.23-13.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/sane-backends-1.0.23-13.fc19

[Fedora (fedora-redhat-bugs)]

Package sane-backends-1.0.23-13.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing sane-backends-1.0.23-13.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-12911/sane-backends-1.0.23-13.fc19
then log in and leave karma (feedback).

[Fedora (fedora-redhat-bugs)]

sane-backends-1.0.23-13.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

[Fedora (fedora-redhat-bugs)]

sane-backends-1.0.23-13.fc18 has been pushed to the Fedora 18 stable repository. If problems still persist, please make note of it in this bug report.

[Apport retracing service (apport)]

StacktraceTop:
 gl646_setup_registers (depth=8, color=1, endx=10887, startx=15, linecnt=10, move=0, resolution=300, slope_table2=0x7fbabc149334, slope_table1=0x7fbabc149134, regs=0x7fbabc148be8, dev=0x7fbabc148bc0, scan_settings=...) at genesys_gl646.c:748
 setup_for_scan (dev=dev@entry=0x7fbabc148bc0, split=split@entry=1, xcorrection=xcorrection@entry=0, ycorrection=ycorrection@entry=0, settings=...) at genesys_gl646.c:3509
 simple_scan (dev=dev@entry=0x7fbabc148bc0, move=move@entry=0, forward=forward@entry=1, data=data@entry=0x7fbac382e9c0, shading=0, settings=...) at genesys_gl646.c:4994
 gl646_offset_calibration (dev=0x7fbabc148bc0) at genesys_gl646.c:4088
 genesys_flatbed_calibration (dev=0x7fbabc148bc0) at genesys.c:3339

[Robert Ancell (robert-ancell)]

This is the top crash report for simple-scan in Ubuntu 14.04 on errors.ubuntu.com:
https://errors.ubuntu.com/problem/c19bf493ba6ec077aa0a438cc5c7f8ce928c1403

[Launchpad Janitor (janitor)]

This bug was fixed in the package sane-backends - 1.0.23-3ubuntu4

---------------
sane-backends (1.0.23-3ubuntu4) utopic; urgency=medium

  * debian/patches/fix-gl646-setup-registers.patch:
    - Fix crash using some HP scanners (LP: #1301161)
 -- Robert Ancell <email address hidden> Fri, 09 May 2014 11:05:29 +1200

[Brian Murray (brian-murray)]

Its possible for me to query the error tracker instances for the mentioned problem to check the dependencies for the new version of sane-backends if we don't get enough positive confirmation about the fix.

[Brian Murray (brian-murray)]

Hello Павел, or anyone else affected,

Accepted sane-backends into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/sane-backends/1.0.23-3ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[danjjl (danjjl)]

Hello,
If I am not mistaken i was affected by the same bug (see attached stack trace).
Updating to the -proposed repository fixes the segmentation fault. Simple-scan now runs normally with my HP scanjet G2410.

Thank you for the fix.
Jonathan

[Robert Ancell (robert-ancell)]

Setting to verification-done based on danjjl's comment

[Robert Ancell (robert-ancell)]

Thanks danjjl for confirming!

[Launchpad Janitor (janitor)]

This bug was fixed in the package sane-backends - 1.0.23-3ubuntu3.1

---------------
sane-backends (1.0.23-3ubuntu3.1) trusty; urgency=medium

  * debian/patches/fix-gl646-setup-registers.patch:
    - Fix crash using some HP scanners (LP: #1301161)
 -- Robert Ancell <email address hidden> Fri, 09 May 2014 11:05:29 +1200

[Scott Kitterman (kitterman)]

The verification of the Stable Release Update for sane-backends has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[epek (epek)]

The same here with HP scanjet 3500c and Libsane 1.0.23 und LTS 14.04:
[ 1547.625813] scan-thread[11048]: segfault at 9b1813e8 ip 9b173e5b sp a1c1bf80 error 7 in libsane-hp3500.so.1.0.23[9b171000+12000]

[rimbullis (rimbullis)]

Hello!

libsane:i386 1.0.23-3ubuntu3.1

Nov 26 21:20:21 19C6GAXVM kernel: [ 7630.984305] scan-thread[6454]: segfault at ac1bc3e8 ip ac1aee5b sp ad96df80 error 7 in libsane-hp3500.so.1.0.23[ac1ac000+12000]

Linux 19C6GAXVM 3.13.0-40-generic #69-Ubuntu SMP Thu Nov 13 17:56:26 UTC 2014 i686 i686 i686 GNU/Linux