[Pkg-mpd-maintainers] Bug#981152: ncmpc: Assertion failed: i < filelist->size() during "Browse" while another client is repeatedly clearing the playlist queue

[Daniel Kahn Gillmor]

Package: ncmpc
Version: 0.42-1
Severity: important

running ncmpc to connect to an mpd server, i get a crash with a
warning about "Assertion failed:

ncmpc: ../src/FileListPage.cxx:492: virtual void FileListPage::PaintListItem(WINDOW*, unsigned int, unsigned int, unsigned int, bool) const: Assertion `i < filelist->size()' failed.
                     Aborted

I get this warning by going into the "Browse" view (hitting '3') and
then navigating to any of the listed folders by hitting enter.  It
seems to do this when viewing any of the subfolders i investigate
using "Browse".

Below is a backtrace from such an assertion:

#0  __GI_raise (sig=sig at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007ffff7ae8537 in __GI_abort () at abort.c:79
#2  0x00007ffff7ae840f in __assert_fail_base (fmt=0x7ffff7c51128 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=0x555555593307 "i < filelist->size()", file=0x55555559320b "../src/FileListPage.cxx", line=492, 
    function=<optimized out>) at assert.c:92
#3  0x00007ffff7af7662 in __GI___assert_fail (assertion=assertion at entry=0x555555593307 "i < filelist->size()", file=file at entry=0x55555559320b "../src/FileListPage.cxx", line=line at entry=492, 
    function=function at entry=0x555555593420 "virtual void FileListPage::PaintListItem(WINDOW*, unsigned int, unsigned int, unsigned int, bool) const") at assert.c:101
#4  0x0000555555573070 in FileListPage::PaintListItem (this=<optimized out>, w=<optimized out>, i=<optimized out>, y=1, width=<optimized out>, selected=<optimized out>) at ../src/FileListPage.cxx:492
#5  0x000055555557497d in ListWindow::Paint (this=0x555555608798, renderer=...) at ../src/ListWindow.cxx:56
#6  0x000055555556eaa7 in ScreenManager::Paint (this=0x7fffffffe0a8, main_dirty=<optimized out>) at ../src/screen_paint.cxx:51
#7  0x000055555556dd18 in ScreenManager::Update (this=<optimized out>, c=..., seek=...) at ../src/screen.cxx:226
#8  0x000055555556496e in mpdclient_idle_callback (events=<optimized out>) at ../src/Main.cxx:193
#9  0x00005555555676c8 in mpdclient::OnIdle (this=0x7fffffffdeb0, _events=<optimized out>) at ../src/mpdclient.cxx:72
#10 0x0000555555565c8c in mpdclient::GetConnection (this=this at entry=0x7fffffffdeb0) at ../src/mpdclient.cxx:471
#11 0x0000555555573321 in screen_file_load_list (filelist=..., current_path=0x5555556087f8 "cd-tracks", c=0x7fffffffdeb0) at ../src/FileBrowserPage.cxx:92
#12 FileBrowserPage::Reload (this=this at entry=0x555555608780, c=...) at ../src/FileBrowserPage.cxx:111
#13 0x0000555555573465 in FileBrowserPage::ChangeDirectory (this=this at entry=0x555555608780, c=..., new_path=...) at ../src/FileBrowserPage.cxx:123
#14 0x00005555555736fd in FileBrowserPage::ChangeToEntry (this=0x555555608780, c=..., entry=...) at ../src/FileBrowserPage.cxx:163
#15 0x0000555555573c25 in FileBrowserPage::HandleEnter (this=0x555555608780, c=...) at ../src/FileBrowserPage.cxx:196
#16 0x0000555555572c11 in FileListPage::OnCommand (cmd=Command::PLAY, c=..., this=0x555555608780) at ../src/FileListPage.cxx:431
#17 FileListPage::OnCommand (this=this at entry=0x555555608780, c=..., cmd=cmd at entry=Command::PLAY) at ../src/FileListPage.cxx:372
#18 0x0000555555573cdd in FileBrowserPage::OnCommand (this=0x555555608780, c=..., cmd=Command::PLAY) at ../src/FileBrowserPage.cxx:350
#19 0x000055555556e338 in ScreenManager::OnCommand (this=0x7fffffffe0a8, c=..., seek=..., cmd=cmd at entry=Command::PLAY) at ../src/screen.cxx:232
#20 0x0000555555564558 in do_input_event (event_loop=..., cmd=cmd at entry=Command::PLAY) at ../src/Main.cxx:231
#21 0x000055555556b89a in AsyncUserInput::OnSocketReady (this=0x7fffffffe360) at ../src/event/SocketEvent.hxx:94
#22 0x000055555558dc79 in EventLoop::Run (this=this at entry=0x7fffffffde50) at ../src/event/Loop.cxx:332
#23 0x0000555555564a54 in Instance::Run (this=this at entry=0x7fffffffde50) at ../src/Instance.cxx:100
#24 0x000055555556385c in main (argc=-8624, argv=0x7fffffffe4b8) at ../src/Main.cxx:351

One thing to note: i only see this behavior when the same mpd server
has another client connected to it that is misbehaving.  In
particular, the misbehaving client is constantly clearing the queue
(imagine another ncmpc client attached to a machine where the keyboard
is erroneously sending the "c" keypress).

So this might be some sort of TOCTOU failure associated with testing
membership in the current queue when displaying a list of folders
during browsing?  Feel free to forward the report upstream if you
think it's not a debian-specific issue.  I can reproduce the error
(though not as reliably) on a debian buster system as well, as long as
the same misbehaving mpd client is connected to the same server.

Thanks for maintaining ncmpc in debian!

    --dkg


-- System Information:
Debian Release: bullseye/sid
  APT prefers testing-debug
  APT policy: (500, 'testing-debug'), (500, 'testing'), (200, 'unstable-debug'), (200, 'unstable'), (1, 'experimental-debug'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-1-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_WARN, TAINT_FIRMWARE_WORKAROUND
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages ncmpc depends on:
ii  libc6            2.31-9
ii  libgcc-s1        10.2.1-6
ii  liblirc-client0  0.10.1-6.2+b1
ii  libmpdclient2    2.19-1
ii  libncursesw6     6.2+20201114-2
ii  libpcre3         2:8.39-13
ii  libstdc++6       10.2.1-6
ii  libtinfo6        6.2+20201114-2

ncmpc recommends no packages.

Versions of packages ncmpc suggests:
pn  mpd           <none>
pn  ncmpc-lyrics  <none>

-- no debconf information