bugPSPP - Bugs: bug #40380, Crash when opening files from...

 
 

bug #40380: Crash when opening files from directory with no write permission

Submitter:  John Darrington <jmd>
Submitted:  Sat 26 Oct 2013 07:55:46 AM UTC
   
 
Category:  Output Driver Severity:  5 - Average
Status:  Fixed Assigned to:  None
Open/Closed:  Closed Release:  None
Effort:  0.00
* Mandatory Fields

Add a New Comment Rich Markup
   

Fri 01 Nov 2013 09:24:59 AM UTC, comment #4: 

I fixed this.

John Darrington <jmd>
Group administrator
Sun 27 Oct 2013 08:37:50 PM UTC, comment #3: 

It might be obvious (not sure) but the key part of the valgrind output in comment #2 is that output_submit__() is called recursively in the backtrace following "Address 0x5e3e06c is 4 bytes inside a block of size 20 free'd"

Ben Pfaff <blp>
Group administrator
Sun 27 Oct 2013 08:36:29 PM UTC, comment #2: 

Valgrind shows that the underlying problem is that output drivers are being entered recursively:


==30797== Invalid read of size 4
==30797==    at 0x40FC140: output_driver_destroy (driver.c:176)
==30797==    by 0x40FD83D: journal_output (journal.c:95)
==30797==    by 0x40FBD73: output_submit__ (driver.c:102)
==30797==    by 0x40FBEAC: output_submit (driver.c:139)
==30797==    by 0x4104A4A: text_item_submit (text-item.c:90)
==30797==    by 0x4051729: cmd_parse_in_state (command.c:249)
==30797==    by 0x4051D98: cmd_parse (command.c:163)
==30797==    by 0x808C7EC: execute_syntax (executor.c:135)
==30797==    by 0x809B4FA: load_file (psppire-data-window.c:361)
==30797==    by 0x80BCCB3: psppire_window_load (psppire-window.c:674)
==30797==    by 0x809C030: open_data_window (psppire-data-window.c:1374)
==30797==    by 0x809C127: on_recent_data_select (psppire-data-window.c:755)
==30797==    by 0x4C17C56: g_cclosure_marshal_VOID__VOIDv (gmarshal.c:115)
==30797==    by 0x4C16120: _g_closure_invoke_va (gclosure.c:840)
==30797==    by 0x4C2F278: g_signal_emit_valist (gsignal.c:3211)
==30797==    by 0x4C2FCD2: g_signal_emit (gsignal.c:3356)
==30797==    by 0x442C871: gtk_menu_shell_activate_item (gtkmenushell.c:1260)
==30797==    by 0x442CC38: gtk_menu_shell_button_release (gtkmenushell.c:683)
==30797==    by 0x4421010: gtk_menu_button_release (gtkmenu.c:3043)
==30797==    by 0x627800F: ???
==30797==  Address 0x5e3e06c is 4 bytes inside a block of size 20 free'd
==30797==    at 0x402850C: free (in /usr/lib/valgrind/vgpreload_memcheck-x86-linux.so)
==30797==    by 0x40FD5EB: journal_destroy (journal.c:80)
==30797==    by 0x40FC15C: output_driver_destroy (driver.c:180)
==30797==    by 0x40FD83D: journal_output (journal.c:95)
==30797==    by 0x40FD8D9: journal_submit (journal.c:128)
==30797==    by 0x40FBD73: output_submit__ (driver.c:102)
==30797==    by 0x40FE1EA: message_item_submit (message-item.c:60)
==30797==    by 0x808FC29: handle_msg (psppire.c:395)
==30797==    by 0x419B636: ship_message (message.c:283)
==30797==    by 0x419BBDD: msg_emit (message.c:326)
==30797==    by 0x419BD4B: msg_error (message.c:100)
==30797==    by 0x40FD835: journal_output (journal.c:93)
==30797==    by 0x40FBD73: output_submit__ (driver.c:102)
==30797==    by 0x40FBEAC: output_submit (driver.c:139)
==30797==    by 0x4104A4A: text_item_submit (text-item.c:90)
==30797==    by 0x4051729: cmd_parse_in_state (command.c:249)
==30797==    by 0x4051D98: cmd_parse (command.c:163)
==30797==    by 0x808C7EC: execute_syntax (executor.c:135)
==30797==    by 0x809B4FA: load_file (psppire-data-window.c:361)
==30797==    by 0x80BCCB3: psppire_window_load (psppire-window.c:674)
==30797==    by 0x809C030: open_data_window (psppire-data-window.c:1374)
==30797==    by 0x809C127: on_recent_data_select (psppire-data-window.c:755)
==30797==    by 0x4C17C56: g_cclosure_marshal_VOID__VOIDv (gmarshal.c:115)
==30797==    by 0x4C16120: _g_closure_invoke_va (gclosure.c:840)
==30797==    by 0x4C2F278: g_signal_emit_valist (gsignal.c:3211)
==30797==    by 0x4C2FCD2: g_signal_emit (gsignal.c:3356)
==30797==    by 0x442C871: gtk_menu_shell_activate_item (gtkmenushell.c:1260)
==30797==    by 0x442CC38: gtk_menu_shell_button_release (gtkmenushell.c:683)
==30797==    by 0x4421010: gtk_menu_button_release (gtkmenu.c:3043)
==30797==    by 0x627800F: ???


If I revert commit fce028c380d4 (Use the msg function to report errors wherever possible.) then that fixes the problem, so this is a regression.  It seems that its approach to reentrancy avoidance is incomplete.  I like that commit's goal, so I'd prefer to fix it up rather than revert it.

Ben Pfaff <blp>
Group administrator
Sat 26 Oct 2013 07:46:57 PM UTC, comment #1: 

Backtrace:


#0  0x00000019 in ?? ()
#1  0xb7fa40bf in output_driver_destroy (driver=driver@entry=0x8173a10)
    at ../src/output/driver.c:177
#2  0xb7fa579e in journal_output (j=0x8173a10, s=<optimized out>)
    at ../src/output/journal.c:95
#3  journal_output (j=0x8173a10, s=<optimized out>)
    at ../src/output/journal.c:86
#4  0xb7fa3d2c in output_submit__ (item=0x82c22a8)
    at ../src/output/driver.c:101
#5  0xb7fa3e5d in output_submit (item=item@entry=0x81594b0)
    at ../src/output/driver.c:137
#6  0xb7fac9ab in text_item_submit (item=0x81594b0)
    at ../src/output/text-item.c:90
#7  0xb7ef96ea in do_parse_command (state=CMD_STATE_INITIAL, ds=0x8174288,
    lexer=0x82c8338) at ../src/language/command.c:249
#8  cmd_parse_in_state (lexer=lexer@entry=0x82c8338, ds=ds@entry=0x8174288,
    state=CMD_STATE_INITIAL) at ../src/language/command.c:148
#9  0xb7ef9d59 in cmd_parse (lexer=lexer@entry=0x82c8338, ds=0x8174288)
    at ../src/language/command.c:163
#10 0x0808c7ed in execute_syntax (window=0x8176018,
    lex_reader=lex_reader@entry=0x829d238) at ../src/ui/gui/executor.c:135
#11 0x0809b4fb in load_file (de=0x8176018,
    file_name=0x8197898 "/home/blp/pspp/master/_build/BDI_II_SAV.sav", syn=0x0)
    at ../src/ui/gui/psppire-data-window.c:361
#12 0x080bccb4 in psppire_window_load (w=0x8176018,
    file=file@entry=0x8197898 "/home/blp/pspp/master/_build/BDI_II_SAV.sav",
    hint=hint@entry=0x0) at ../src/ui/gui/psppire-window.c:674
#13 0x0809c031 in open_data_window (victim=victim@entry=0x8176018,
    file_name=file_name@entry=0x8197898 "/home/blp/pspp/master/_build/BDI_II_SAV.sav", hint=hint@entry=0x0) at ../src/ui/gui/psppire-data-window.c:1374
#14 0x0809c128 in on_recent_data_select (menushell=0x8226058, window=0x8176018)
    at ../src/ui/gui/psppire-data-window.c:755
#15 0xb73c8c57 in g_cclosure_marshal_VOID__VOIDv (
    closure=closure@entry=0x819bce0, return_value=return_value@entry=0x0,
    instance=instance@entry=0x8226058,
    args=args@entry=0xbffff0bc "Lz\323\267\067\005\264\267Lz\323\267\340Z!\b\300\334&\b\340Z!\b\220u\031\b9\347\241\267Lz\323\267X`\"\b\340Z!\b\020a\"\b9\354\241\267X`\"\b\340Z!\b\001", marshal_data=marshal_data@entry=0x0,
    n_params=n_params@entry=0, param_types=param_types@entry=0x0)
    at /build/buildd-glib2.0_2.33.12+really2.32.4-5-i386-eISom6/glib2.0-2.33.12+really2.32.4/./gobject/gmarshal.c:115
#16 0xb73c7121 in _g_closure_invoke_va (closure=0x819bce0,
    return_value=return_value@entry=0x0, instance=instance@entry=0x8226058,
    args=args@entry=0xbffff0bc "Lz\323\267\067\005\264\267Lz\323\267\340Z!\b\300\334&\b\340Z!\b\220u\031\b9\347\241\267Lz\323\267X`\"\b\340Z!\b\020a\"\b9\354\241\267X`\"\b\340Z!\b\001", n_params=0, param_types=0x0)
    at /build/buildd-glib2.0_2.33.12+really2.32.4-5-i386-eISom6/glib2.0-2.33.12+really2.32.4/./gobject/gclosure.c:840
#17 0xb73e0279 in g_signal_emit_valist (instance=instance@entry=0x8226058,
    signal_id=signal_id@entry=122, detail=detail@entry=0,
    var_args=var_args@entry=0xbffff0bc "Lz\323\267\067\005\264\267Lz\323\267\340Z!\b\300\334&\b\340Z!\b\220u\031\b9\347\241\267Lz\323\267X`\"\b\340Z!\b\020a\"\b9\354\241\267X`\"\b\340Z!\b\001")
    at /build/buildd-glib2.0_2.33.12+really2.32.4-5-i386-eISom6/glib2.0-2.33.12+really2.32.4/./gobject/gsignal.c:3211
#18 0xb73e0cd3 in g_signal_emit (instance=0x8226058, signal_id=122,
    detail=detail@entry=0)
    at /build/buildd-glib2.0_2.33.12+really2.32.4-5-i386-eISom6/glib2.0-2.33.12+really2.32.4/./gobject/gsignal.c:3356
#19 0xb7a1e872 in IA__gtk_menu_shell_activate_item (
    menu_shell=menu_shell@entry=0x8226058,
    menu_item=menu_item@entry=0x8215ae0,
    force_deactivate=force_deactivate@entry=1)
    at /build/buildd-gtk+2.0_2.24.10-2-i386-Tg7Q_2/gtk+2.0-2.24.10/gtk/gtkmenushell.c:1260
#20 0xb7a1ec39 in gtk_menu_shell_button_release (widget=0x8226058,
    event=0x8129790)
    at /build/buildd-gtk+2.0_2.24.10-2-i386-Tg7Q_2/gtk+2.0-2.24.10/gtk/gtkmenushell.c:683
#21 0xb7a13011 in gtk_menu_button_release (event=0x8129790, widget=0x8226058)
    at /build/buildd-gtk+2.0_2.24.10-2-i386-Tg7Q_2/gtk+2.0-2.24.10/gtk/gtkmenu.c:3043


Ben Pfaff <blp>
Group administrator
Sat 26 Oct 2013 07:55:46 AM UTC, original submission:  

1. Change to a directory for which you have no write permission (eg: cd /usr/bin)

2. Start psppire

3. From the "Recently Used Data" menu select a file to open.

4. I see :
 
 error opening output file `pspp.jnl': Permission denied
 Segmentation fault

Strangely, the segfault seems only to come when opening from the recently used filelist.

John Darrington <jmd>
Group administrator

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by blp (Posted a comment)
  • -email is unavailable- added by jmd (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-01 jmd StatusConfirmed Fixed
        Open/ClosedOpen Closed
    2013-10-26 blp StatusNone Confirmed

    Back to the top

    Powered by Savane 3.13-758e.
    Corresponding source code