bugiGNUit - Bugs: bug #54095, segfault with consecutive searches

 
 

bug #54095: segfault with consecutive searches

Submitter:  Dennis Nezic <dennisne>
Submitted:  Mon 11 Jun 2018 01:38:15 AM UTC
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Open
* Mandatory Fields

Add a New Comment (Rich Markup)
   

Comment Type & Canned Response:
       No canned response available

 

Thu 09 Dec 2021 10:23:05 PM UTC, comment #2: 

This patch fixes a similar segfault that happens with repeated "Find All Cards" searches in app-window.c's cb_m_find_simple() ... an uncommon use case, but I managed to bump into it. The cause is similar, app_window_update_appbar() is sometimes (not always, there's a race condition I guess) called before file_set_current_category(), which causes it to work with a junk current cat value, which is reset every time a new find_simple search is performed via file_clear_search().

Also, unrelated, when clicking on "Previous Category", d->last_selected_category can be null if there is only one category in a deck. So we don't need to fail the assertion test in cb_m_category_previous() ... instead we can go to that first category.

(file #52473)

Dennis Nezic <dennisne>
Wed 18 Dec 2019 08:35:18 PM UTC, comment #1: 

Fixed. Patch is attached.

With the last release 2.24.3, I get a Segmentation fault after successful searches. The easiest way to reproduce it is to repeat the same search consecutively.

This is because in dialog-find.c, file_clear_search clears the special search current_category, but file_set_current_category is called AFTER app_window_refresh_card_pane, which calls cb_treev_cards_selection, which calls app_window_update_appbar, which will have a recently freed (junk, non-null) value for "cat", which will cause a segfault when s2 is being set in the calls to category_get_.

The patch fixes this simply by moving the file_set_current_ function before the app_window_refresh function.

(file #48087)

Dennis Nezic <dennisne>
Mon 11 Jun 2018 01:38:15 AM UTC, original submission:  

I'm getting segfaults when I do repeated searches. (Consecutive searches - ie. it won't crash if I select a category in between searches.) In app-window.c, app_window_update_appbar is being called on the search results, and then it's crashing when it tries to get the number of expired/untested/selected cards within the search results. I'm not sure what Category *cat is being passed to category_get_n_untested/_expired during the searches, but I think sometimes (always?) it's a garbage value.

From gdb:

#0  0x0000555555567c95 in category_get_n_untested (cat=0x555555940cf0)
    at card.c:727
#1  0x000055555555d117 in app_window_update_appbar (ig=0x5555557aa990)
    at app-window.c:362
#2  0x00005555555634af in cb_treev_cards_selection (sel=0x55555592b580,
    d=0x55555583cba0) at app-window.c:2981

The same problem will happen in category_get_n_expired if I comment out the offending lines in _get_n_untested. Ie. the problem is most likely with the *cat value.

#0  0x0000555555567c47 in category_get_n_expired (cat=0x5555558ee540)
    at card.c:713
#1  0x000055555555d126 in app_window_update_appbar (ig=0x5555557aa990)
    at app-window.c:362
#2  0x00005555555634af in cb_treev_cards_selection (sel=0x55555592b580,
    d=0x55555583cba0) at app-window.c:2981

Dennis Nezic <dennisne>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #52473:  6statusbarupdatefixandprevcategory.patch added by dennisne (2KiB - text/x-patch - another fix for a segfault and assertion fault)
file #48087:  1multiplesearchsegfault.patch added by dennisne (667B - text/x-patch - fixes the segfault)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by dennisne (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

     

     

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2021-12-09 dennisne Attached File- Added 6statusbarupdatefixandprevcategory.patch, #52473
    2019-12-18 dennisne Attached File- Added 1multiplesearchsegfault.patch, #48087

    Back to the top


    Powered by Savane 3.9