Bug#299571: gossip: Segfault when disconnected from the server

Sam Morris Sam Morris <sam@robots.org.uk>, 299571@bugs.debian.org
Tue, 15 Mar 2005 01:36:35 +0000


Package: gossip
Version: 0.8-1
Severity: normal

If the Jabber server Gossip is connected to goes down, or the connection
is otherwise interrupted, Gossip segfaults:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 16384 (LWP 7819)]
0x40d34c2f in strlen (str=0xfff1f0 <Address 0xfff1f0 out of bounds>)
    at ../sysdeps/i386/strlen.c:28
28      ../sysdeps/i386/strlen.c: No such file or directory.
        in ../sysdeps/i386/strlen.c
#0  0x40d34c2f in strlen (str=0xfff1f0 <Address 0xfff1f0 out of bounds>)
    at ../sysdeps/i386/strlen.c:28
        cnt = -1
#1  0x40d083a5 in _IO_vfprintf (s=0xbfffec2c,
    format=0xfff1f0 <Address 0xfff1f0 out of bounds>,
    ap=0xbffff1d0 "\uffff\uffff#:\020\u0127\037\r0\uffff\uffff\uffffKG\u036c\uffff\234<\uffff\uffff\uffff") at vfprintf.c:1526
        len = 0
        string_malloced = 0
        thousands_sep = 0x0
        grouping = 0xffffffff <Address 0xffffffff out of bounds>
        done = 1
        f = (const unsigned char *) 0x4004ecf6 "s'\n"
        lead_str_end = (const unsigned char *) 0x4004ecf5 "%s'\n"
        work_buffer = "6\000\000\uffff\001\000\000\000\f\231\b\b\b\027\uffff@\030\206\023\b\200\uffff\236@H\uffff\uffff\uffff\uffff\uffff\236@~_\uffff@P\000\000\000 \000\000\000\uffff\uffff\237@\b\027\uffff@\000\000\000\000x\uffff\uffff\uffff\000\uffff\uffff@x\031\uffff@\000\000\000\000x\uffff\uffff\uffffz-\uffff@\210\031\uffff@\uffffe\024\b`\027\237@\000\000\000\000\b\027\uffff@\001\000\000\000\uffff\uffff\uffff\uffff@i\237@x\031\uffff@\004\024\uffff@P\uffff\uffff\uffff\000\000\000\000`\uffff\uffff\uffff\030J\035\b\030J\035\b\uffff\uffff~@\uffff\uffff~@\000T\035\b\uffff\uffff\uffff\uffff\b\uffff\016\b\020\uffff\uffff\uffff\233\220\b\bx\220\b\b\000\000\000\000\uffff\uffff\uffff\uffff\001\000\000\000@\uffff\016\b\000\000\000\bt\uffff\uffff\uffff\uffff\uffff\016\b"...
        workstart = 0x0
        workend = 0xbfffebf8 ""
        mbstate = {__count = 0, __value = {__wch = 0, __wchb = "\000\000\000"}}
        ap_save = 0xbffff1cc "\uffff ap_save = 0xbffff1cc "\uffff
        nspecs_done = 0
        save_errno = 0
        jump_table = {1, 0, 0, 4, 0, 14, 0, 6, 0, 0, 7, 2, 0, 3, 9, 0, 5, 8,
  8, 8, 8, 8, 8, 8, 8, 8, 0, 0, 0, 0, 0, 0, 0, 26, 0, 25, 0, 19, 19, 19, 0,
  29, 0, 0, 12, 0, 0, 0, 0, 0, 0, 21, 0, 0, 0, 0, 18, 0, 13, 0, 0, 0, 0, 0, 0,
  26, 0, 20, 15, 19, 19, 19, 10, 15, 28, 0, 11, 24, 23, 17, 22, 12, 0, 21, 27,
  16, 0, 0, 18, 0, 13}
#2  0x40d25fd6 in _IO_vasprintf (result_ptr=0xbfffed24, format=0x0, args=0x0)
    at vasprintf.c:61
        string = 0x827b3c8 "'\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n"
        sf = {_sbf = {_f = {_flags = -72515584,
      _IO_read_ptr = 0x827b3c8 "'\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n",
      _IO_read_end = 0x827b3c8 "'\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n",
      _IO_read_base = 0x827b3c8 "'\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n",
      _IO_write_base = 0x827b3c8 "'\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n",
      _IO_write_ptr = 0x827b3c9 "\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n",
      _IO_write_end = 0x827b42c "Y",
      _IO_buf_base = 0x827b3c8 "'\uffff\uffff@t\uffff\uffff@", '-' <repeats 27 times>, "\n",
      _IO_buf_end = 0x827b42c "Y", _IO_save_base = 0x0, _IO_backup_base = 0x0,
      _IO_save_end = 0x0, _markers = 0x0, _chain = 0x0, _fileno = 0,
      _flags2 = 0, _old_offset = 0, _cur_column = 0, _vtable_offset = 0 '\0',
      _shortbuf = "", _lock = 0x0, _offset = 0, _codecvt = 0x0,
      _wide_data = 0x0, _mode = -1,
      _unused2 = '\0' <repeats 16 times>, "\uffff\uffffq'p\u016f@\uffff\uffff\uffff\uffff\uffffH\uffff@@\000\000\000\000\000\000\000~_\uffff@\000\000\000\000\000\000\000"}, _vtable = 0x40de8260}, _s = {
    _allocate_buffer = 0x40d2fe60 <__libc_malloc>,
    _free_buffer = 0x40d30020 <__libc_free>}}
        ret = 36
        needed = 136819656
#3  0x40a68e27 in IA__g_vasprintf (string=0xbfffed24, format=0x0, args=0x0)
    at gprintf.c:312
        len = 512
#4  0x40a59c56 in IA__g_strdup_vprintf (format=0x0, args=0x0)
    at gstrfuncs.c:187
        string = (gchar *) 0x0
#5  0x40a4bed4 in IA__g_logv (log_domain=0x4004ec05 "LM", log_level=512,
    format=0x4004ecf4 "'%s'\n", args1=0xbffff1cc "\uffff\uffff\uffff") at gmessages.c:467
        depth = 1
        domain = (GLogDomain *) 0x2889
        data = 0x0
        log_func = 0x4004a170 <lm_connection_unref+144>
        domain_fatal_mask = 5
        test_level = 512
        was_recursion = 0
        i = 9
#6  0x40a4c086 in IA__g_log (log_domain=0x0, log_level=0, format=0x0)
    at gmessages.c:512
No locals.
#7  0x40047c77 in _lm_connection_failed () from /usr/lib/libloudmouth-1.so.0
No symbol table info available.
#8  0x40a68f5f in g_io_unix_dispatch (source=0x4004ec05, callback=0x811d340,
    user_data=0x0) at giounix.c:162
        buffer_condition = 10377
#9  0x40a436c2 in g_main_dispatch (context=0x80bf348) at gmain.c:1947
        dispatch = (gboolean (*)(GSource *, GSourceFunc,
    gpointer)) 0x40a68f10 <g_io_unix_dispatch>
        was_in_call = 0
        user_data = 0x811d340
        callback = 0x40047b40 <_lm_connection_failed+2016>
        cb_funcs = (GSourceCallbackFuncs *) 0x40a9e100
        cb_data = 0x81d99e8
        need_destroy = 135000904
        source = (GSource *) 0x81d4da8
        depth = (gint *) 0x80c7f98
        i = 0
#10 0x40a44748 in IA__g_main_context_dispatch (context=0x80bf348)
    at gmain.c:2497
No locals.
#11 0x40a44a80 in g_main_context_iterate (context=0x80bf348, block=1,
    dispatch=1, self=0x808e388) at gmain.c:2578
        got_ownership = 0
        max_priority = 2147483647
        timeout = 606
        some_ready = 1
        nfds = 1
        allocated_nfds = 606
        fds = (GPollFD *) 0x81d66d0
#12 0x40a45023 in IA__g_main_loop_run (loop=0x81d2450) at gmain.c:2782
        got_ownership = 1073789920
        self = (GThread *) 0x808e388
#13 0x4053ea23 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
No symbol table info available.
#14 0x0806955d in main (argc=10377, argv=0x2889) at gossip-main.c:170
        account = (GossipAccount *) 0x807f79d
        program = (GnomeProgram *) 0x0
        no_connect = 0
        list_accounts = 0
        popt_context = 0x8092de8
        account_name = (gchar *) 0x0
        options = {{longName = 0x8081fdf "no-connect", shortName = 110 'n',
    argInfo = 0, arg = 0xbffff7cc, val = 0,
    descrip = 0x8081fea "Don't connect on startup", argDescrip = 0x0}, {
    longName = 0x808317d "account", shortName = 97 'a', argInfo = 1,
    arg = 0xbffff7c8, val = 0,
    descrip = 0x8082100 "Which account to connect to on startup",
    argDescrip = 0x8082003 "ACCOUNT-NAME"}, {
    longName = 0x8082010 "list-accounts", shortName = 108 'l', argInfo = 0,
    arg = 0xbffff7c4, val = 0,
    descrip = 0x808201e "List the available accounts", argDescrip = 0x0}, {
    longName = 0x0, shortName = 0 '\0', argInfo = 0, arg = 0x0, val = 0,
    descrip = 0x0, argDescrip = 0x0}}


-- System Information:
Debian Release: 3.1
  APT prefers testing
  APT policy: (700, 'testing'), (600, 'unstable'), (550, 'experimental')
Architecture: i386 (i686)
Kernel: Linux 2.6.8-2-k7
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)

Versions of packages gossip depends on:
ii  gconf2                   2.8.1-4         GNOME configuration database syste
ii  libart-2.0-2             2.3.17-1        Library of functions for 2D graphi
ii  libatk1.0-0              1.8.0-4         The ATK accessibility toolkit
ii  libaudiofile0            0.2.6-5         Open-source version of SGI's audio
ii  libbonobo2-0             2.8.1-2         Bonobo CORBA interfaces library
ii  libbonoboui2-0           2.8.1-1         The Bonobo UI library
ii  libc6                    2.3.2.ds1-20    GNU C Library: Shared libraries an
ii  libesd-alsa0 [libesd0]   0.2.35-2        Enlightened Sound Daemon (ALSA) - 
ii  libgconf2-4              2.8.1-4         GNOME configuration database syste
ii  libgcrypt11              1.2.0-4         LGPL Crypto library - runtime libr
ii  libglade2-0              1:2.4.2-1       library to load .glade files at ru
ii  libglib2.0-0             2.6.3-1         The GLib library of C routines
ii  libgnome2-0              2.8.1-2         The GNOME 2 library - runtime file
ii  libgnomecanvas2-0        2.8.0-1         A powerful object-oriented display
ii  libgnomeui-0             2.8.0-3         The GNOME 2 libraries (User Interf
ii  libgnomevfs2-0           2.8.4-2         The GNOME virtual file-system libr
ii  libgnutls11              1.0.16-9        GNU TLS library - runtime library
ii  libgpg-error0            1.0-1           library for common error values an
ii  libgtk2.0-0              2.6.2-3         The GTK+ graphical user interface 
ii  libhowl0                 0.9.8-2         Library for Zeroconf service disco
ii  libice6                  4.3.0.dfsg.1-10 Inter-Client Exchange library
ii  libloudmouth1-0          0.17.2-1        Lightweight C Jabber library
ii  liborbit2                1:2.10.5-0.1    libraries for ORBit2 - a CORBA ORB
ii  libpango1.0-0            1.8.1-1         Layout and rendering of internatio
ii  libpopt0                 1.7-5           lib for parsing cmdline parameters
ii  libsm6                   4.3.0.dfsg.1-10 X Window System Session Management
ii  libtasn1-2               0.2.10-3        Manage ASN.1 structures (runtime)
ii  libx11-6                 4.3.0.dfsg.1-10 X Window System protocol client li
ii  libxext6                 4.3.0.dfsg.1-10 X Window System miscellaneous exte
ii  libxml2                  2.6.16-3        GNOME XML library
ii  libxslt1.1               1.1.12-5        XSLT processing library - runtime 
ii  xlibs                    4.3.0.dfsg.1-10 X Keyboard Extension (XKB) configu
ii  zlib1g                   1:1.2.2-3       compression library - runtime

-- no debconf information