xchat-gnome crashed with SIGSEGV in g_hash_table_foreach()

[Li Li]

I'm using the latest Oneiric (upgraded daily from beta1). Xchat-gnome crashed when I disconnect and reconnect to a WIFI AP (to refresh my IP address). Not sure if this would trigger the crash always. File a bug first and would try the same operation later to confirm.

ProblemType: Crash
DistroRelease: Ubuntu 11.10
Package: xchat-gnome 1:0.30.0~git20100421.29cc76-1ubuntu7
ProcVersionSignature: Ubuntu 3.0.0-11.18-generic 3.0.4
Uname: Linux 3.0.0-11-generic i686
ApportVersion: 1.23-0ubuntu1
Architecture: i386
Date: Fri Sep 16 00:09:31 2011
ExecutablePath: /usr/bin/xchat-gnome
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Beta i386 (20110901)
ProcCmdline: xchat-gnome
ProcEnviron:
 SHELL=/bin/bash
 PATH=(custom, no user)
 LANG=en_US.UTF-8
SegvAnalysis:
 Segfault happened at: 0xf1e63c <g_hash_table_foreach+28>: mov 0x2c(%esi),%ebp
 PC (0x00f1e63c) ok
 source "0x2c(%esi)" (0x0000002c) not located in a known VMA region (needed readable region)!
 destination "%ebp" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: xchat-gnome
StacktraceTop:
 g_hash_table_foreach () from /lib/i386-linux-gnu/libglib-2.0.so.0
 ?? () from /usr/lib/xchat-gnome/plugins/netmonitor.so
 ?? () from /usr/lib/xchat-gnome/plugins/netmonitor.so
 dbus_connection_dispatch () from /lib/i386-linux-gnu/libdbus-1.so.3
 ?? () from /usr/lib/i386-linux-gnu/libdbus-glib-1.so.2
Title: xchat-gnome crashed with SIGSEGV in g_hash_table_foreach()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

[Apport retracing service (apport)]

StacktraceTop:
 g_hash_table_foreach (hash_table=0x0, func=0x1640eb0 <connect_to_network>, user_data=0x0) at /build/buildd/glib2.0-2.29.90/./glib/ghash.c:1407
 set_network_mode (status=<optimized out>) at net-monitor.c:179
 determine_network_status () at net-monitor.c:215
 filter_func (connection=0x8932f00, message=0x8c6ff08, data=0x0) at net-monitor.c:238
 dbus_connection_dispatch (connection=0x8932f00) at ../../dbus/dbus-connection.c:4603

[Li Li (lli5)]

I can confirm that this bug is easily reproduced by reconnect a WIFI AP (via network-manager applet).

PS: this never happens in Natty before.

[Li Li (lli5)]

Update: backtrace in gdb

(gdb) bt
#0 0x00b6f61c in g_hash_table_foreach ()
   from /lib/i386-linux-gnu/libglib-2.0.so.0
#1 0x019be08c in set_network_mode (status=<optimized out>)
    at net-monitor.c:179
#2 0x019be48f in determine_network_status () at net-monitor.c:215
#3 filter_func (connection=0x8316e40, message=0x8305800, data=0x0)
    at net-monitor.c:238
#4 0x00fd6441 in dbus_connection_dispatch ()
   from /lib/i386-linux-gnu/libdbus-1.so.3
#5 0x0026e95d in ?? () from /usr/lib/i386-linux-gnu/libdbus-glib-1.so.2
#6 0x00b812ef in g_main_context_dispatch ()
   from /lib/i386-linux-gnu/libglib-2.0.so.0
#7 0x00b81a20 in ?? () from /lib/i386-linux-gnu/libglib-2.0.so.0
#8 0x00b8202b in g_main_loop_run () from /lib/i386-linux-gnu/libglib-2.0.so.0
#9 0x00442faf in gtk_main () from /usr/lib/i386-linux-gnu/libgtk-x11-2.0.so.0
#10 0x080651b8 in fe_main () at fe-gnome.c:220
#11 0x0805e2e5 in main (argc=1, argv=0xbffff394) at xchat.c:1066
(gdb)

[Li Li (lli5)]

For some unknown reason, the plugin detect NETWORK_UP only without NETWORK_DOWN, with "networks" being NULL, causing the segfault. Should protect this by checking the value of networks before calling g_hash_table_foreach.

[Li Li (lli5)]

The following small patch fixes the segfault when network status is changing.

--- xchat-gnome-0.30.0~git20100421.29cc76.orig/plugins/net-monitor/net-monitor.c
+++ xchat-gnome-0.30.0~git20100421.29cc76/plugins/net-monitor/net-monitor.c
@@ -176,7 +176,8 @@ set_network_mode (NetworkStatus status)
    */
   res_init();

- g_hash_table_foreach (networks, (GHFunc) connect_to_network, NULL);
+ if(networks)
+ g_hash_table_foreach (networks, (GHFunc) connect_to_network, NULL);
  }
 }

[Li Li (lli5)]

Hi all,

I met a segfault issue with xchat-gnome in Ubuntu Oneiric.

The following small patch fixes the segfault when network status is changing.

--- xchat-gnome-0.30.0~git20100421.29cc76.orig/plugins/net-monitor/net-monitor.c
+++ xchat-gnome-0.30.0~git20100421.29cc76/plugins/net-monitor/net-monitor.c
@@ -176,7 +176,8 @@ set_network_mode (NetworkStatus status)
    */
   res_init();

- g_hash_table_foreach (networks, (GHFunc) connect_to_network, NULL);
+ if(networks)
+ g_hash_table_foreach (networks, (GHFunc) connect_to_network, NULL);
  }
 }

Please find more details here:
https://bugs.launchpad.net/ubuntu/+source/xchat-gnome/+bug/851058

Thanks,
Li

[Marc Deslauriers (mdeslaur)]

Thanks for the patch. I'll upload it to xchat-gnome once the archive is unfrozen.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat-gnome - 1:0.30.0~git20100421.29cc76-1ubuntu8

---------------
xchat-gnome (1:0.30.0~git20100421.29cc76-1ubuntu8) oneiric; urgency=low

  * debian/patches/117-fix-net-monitor-segfault.patch: fix segfault in
    the net monitor plugin. (LP: #851058)
  * debian/patches/118-fix-net-monitor-reconnect.patch: correctly reconnect
    after suspend and resume. (LP: #855853)
 -- Marc Deslauriers <email address hidden> Sat, 24 Sep 2011 12:31:58 -0400