Ticket #806 (closed defect: fixed)

Opened 3 months ago

Last modified 3 months ago

"double free" crash in opensync ipc

Reported by: Graham Cobb Assigned to: dgollub
Priority: normal Milestone: 0.38
Component: OpenSync Version: 0.36
Severity: normal Keywords:
Cc:

Description

I am trying to test the changes to the gpe plugin using msynctool.

When I use msynctool --discover, I get a "double free" crash in the opensync IPC code. Note: so far the only GPE plugin code that has been called is get_sync_info (which has been called twice). I presume this IPC code is about to call my initialise routine but it crashes before it can.

The error message is:

*** glibc detected *** /vranx-linux/home/Linux/opensync/build2/bin/msynctool: double free or corruption (fasttop): 0x000000000073b5e0 ***

The gbd backtrace shows:

#0  0x00007ffee52051d5 in raise () from /lib/libc.so.6
#1  0x00007ffee5206680 in abort () from /lib/libc.so.6
#2  0x00007ffee523df4b in ?? () from /lib/libc.so.6
#3  0x00007ffee524301d in ?? () from /lib/libc.so.6
#4  0x00007ffee5244d26 in free () from /lib/libc.so.6
#5  0x00007ffee602f1f5 in osync_demarshal_pluginauthentication (message=0x73fc70, auth=0x4166ddf0, error=<value optimized out>)
    at /home/Linux/opensync/trunk/opensync/ipc/opensync_serializer.c:1185
#6  0x00007ffee6030720 in osync_demarshal_pluginconfig (message=0x73fc70, config=0x4166de70, error=0x4166dea8)
    at /home/Linux/opensync/trunk/opensync/ipc/opensync_serializer.c:1475
#7  0x00007ffee600ffef in _osync_client_message_handler (message=0x73fc70, user_data=0x73b100)
    at /home/Linux/opensync/trunk/opensync/client/opensync_client.c:480
#8  0x00007ffee602d9ad in _incoming_dispatch (source=<value optimized out>, callback=<value optimized out>, 
    user_data=<value optimized out>) at /home/Linux/opensync/trunk/opensync/ipc/opensync_queue.c:229
#9  0x00007ffee5d670f2 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#10 0x00007ffee5d6a396 in ?? () from /usr/lib/libglib-2.0.so.0
#11 0x00007ffee5d6a657 in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#12 0x00007ffee5d8cca4 in ?? () from /usr/lib/libglib-2.0.so.0
#13 0x00007ffee417a017 in start_thread () from /lib/libpthread.so.0
#14 0x00007ffee52995bd in clone () from /lib/libc.so.6
#15 0x0000000000000000 in ?? ()

I will attach the two trace files generated during this test.

Attachments

osync_dbl_free.tgz (5.7 kB) - added by Graham Cobb on 08/15/08 15:03:56.
Trace files (tar'd and gzip'd)

Change History

08/15/08 15:03:56 changed by Graham Cobb

  • attachment osync_dbl_free.tgz added.

Trace files (tar'd and gzip'd)

08/17/08 23:15:24 changed by tuju

  • milestone changed from 0.40 to 0.38.

08/20/08 09:40:29 changed by dgollub

  • status changed from new to closed.
  • resolution set to fixed.

Good catch!

Fix commited with changeset r3565