bugGNU gv - Bugs: bug #30243, gv-3.7.1 segfaults when printing

 
 

You are not allowed to post comments on this tracker with your current authentication level.

bug #30243: gv-3.7.1 segfaults when printing

Submitter:  pavel sanda <pstw>
Submitted:  Thu 24 Jun 2010 11:25:37 AM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  Fixed
Privacy:  Public Assigned to:  msteinbo
Open/Closed:  Closed Release:  3.7.1

Jump to the original submission

Sun 24 Apr 2011 07:04:22 AM UTC, comment #7: 

This bug has been fixed with the new prerelease GNU gv 3.7.1.90.

Markus Steinborn <msteinbo>
Group administrator
Fri 25 Jun 2010 05:56:59 AM UTC, comment #6: 

Well, the valgrind run helps:

Now I am sure that no known Xaw3d bug causes the crash. You see, in the past we had bug reports where Xaw3d wrongly freed some strings.

Firthermore we guess that there is no buffer overflow (valgrind would have reported that the adress is n bytes after an allocated area).

Together with your new gdb output, I can find the problem: YouÄ're right, n is uninitialized, so obviously HAVE_XAW3D_INTERNATIONAL is undefined in your system.

HAVE_XAW3D_INTERNATIONAL should be defined for Xaw3d 1.5E, but undefined for Xaw3d 1.5. Xaw3d 1.5E has some useful new fearures, enabling GNU gv to use UTF-8 encoding in international mode for the user interface and thus being able to show any UTF-8 filenames to the user.

I think I'll move "n=0" before the #ifdef.

Markus Steinborn <msteinbo>
Group administrator
Thu 24 Jun 2010 11:22:10 PM UTC, comment #5: 

initializing Cardinal n=0; just in the begining is perhaps the beast practise to avoid this crash again when new ifdef gymnastics is done in the code.

i'm not on the right box to test printing works, but at least the crash is fixed by this initialization.

pavel sanda <pstw>
Thu 24 Jun 2010 11:10:51 PM UTC, comment #4: 

new gdb session:
Breakpoint 1, DialogPopupSetText (s=0x80abaf0 "lpr") at dialog.c:302
302           XtSetArg(args[n], XtNfont, &font);        n++;

(gdb) print args[n]
Cannot access memory at address 0x2d8a1c

so clearly n was not initialized.
n=0 is inside #ifdef HAVE_XAW3D_INTERNATIONAL which is most probaly not defined.

i ahve no idea what HAVE_XAW3D_INTERNATIONAL is for.

pavel sanda <pstw>
Thu 24 Jun 2010 10:59:25 PM UTC, comment #3: 

i'm not sure it tells anything new...

==2622== Invalid write of size 4
==2622==    at 0x805D847: DialogPopupSetText (dialog.c:302)
==2622==    by 0x805BE0F: cb_print (callbacks.c:634)
==2622==    by 0x40BD51A: XtCallCallbackList (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x4051DBE: ??? (in /usr/lib/libXaw3d.so.8.0)
==2622==    by 0x40F1466: ??? (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40F181A: ??? (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40F1E03: _XtTranslateEvent (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CAA2C: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CB205: ??? (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CA204: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CA375: XtAppMainLoop (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x806294F: main (main.c:1380)
==2622==  Address 0xfeb459ac is not stack'd, malloc'd or (recently) free'd
==2622==
==2622==
==2622== Process terminating with default action of signal 11 (SIGSEGV)
==2622==  Access not within mapped region at address 0xFEB459AC
==2622==    at 0x805D847: DialogPopupSetText (dialog.c:302)
==2622==    by 0x805BE0F: cb_print (callbacks.c:634)
==2622==    by 0x40BD51A: XtCallCallbackList (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x4051DBE: ??? (in /usr/lib/libXaw3d.so.8.0)
==2622==    by 0x40F1466: ??? (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40F181A: ??? (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40F1E03: _XtTranslateEvent (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CAA2C: XtDispatchEventToWidget (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CB205: ??? (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CA204: XtDispatchEvent (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x40CA375: XtAppMainLoop (in /usr/lib/libXt.so.6.0.0)
==2622==    by 0x806294F: main (main.c:1380)
==2622==  If you believe this happened as a result of a stack
==2622==  overflow in your program's main thread (unlikely but
==2622==  possible), you can try to increase the size of the
==2622==  main thread stack using the --main-stacksize= flag.
==2622==  The main thread stack size used in this run was 8388608.

pavel sanda <pstw>
Thu 24 Jun 2010 04:14:27 PM UTC, comment #2: 

Thanks for your bug report.

I am sorry to tell you that I cannot reproduce the segfault.

Could you please provide the output of "valgrind gv" in the situation of the segfault?

Markus Steinborn <msteinbo>
Group administrator
Thu 24 Jun 2010 11:26:54 AM UTC, comment #1: 

(ghostscript 8.71 used)

pavel sanda <pstw>
Thu 24 Jun 2010 11:25:37 AM UTC, original submission:  

after upgrading from 3.6.3, 3.7.1 no more print and segfaults immediatelly after an attempt to print (just after pushing Print All button, before dialog appears).

i observed that after crash zombie 'gs' process remains in memory:
gs -sDEVICE=x11 -dTextAlphaBits=4 -dGraphicsAlphaBits=2 -dAlignToPixels=0 -dMaxBitmap=10000000 -dNOPLATFONTS -dNOPROMPT -dNOPAUSE -dQUIET -P- -dSAFER -dFIXEDMEDIA -


backtrace under gdb shows:
Program received signal SIGSEGV, Segmentation fault.
0x0805d847 in DialogPopupSetText (s=0x80ab378 "lpr") at dialog.c:302
302           XtSetArg(args[n], XtNfont, &font);        n++;
(gdb) bt
#0  0x0805d847 in DialogPopupSetText (s=0x80ab378 "lpr") at dialog.c:302
#1  0x0805be10 in cb_print (w=0x80d7a50, client_data=0x1, call_data=0x0) at callbacks.c:634
#2  0xb7f1c51b in XtCallCallbackList () from /usr/lib/libXt.so.6
#3  0xb7f93dbf in ?? () from /usr/lib/libXaw3d.so.8

pavel sanda <pstw>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by msteinbo (Posted a comment)
  • -email is unavailable- added by pstw (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

     

    Follow 4 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2011-05-05 msteinbo Open/ClosedOpen Closed
    2011-04-24 msteinbo StatusNone Fixed
        Assigned toNone msteinbo
        ReleaseNone 3.7.1

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code