After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 379801 - Invalid free() when outgoing call is rejected.
Invalid free() when outgoing call is rejected.
Status: RESOLVED FIXED
Product: ekiga
Classification: Applications
Component: OPAL
2.0.x
Other All
: Normal major
: ---
Assigned To: Ekiga maintainers
Ekiga maintainers
Depends on:
Blocks:
 
 
Reported: 2006-11-27 15:25 UTC by Anders Petersson
Modified: 2006-12-03 17:01 UTC
See Also:
GNOME target: ---
GNOME version: 2.15/2.16


Attachments
valgrind -v ekiga (69.20 KB, text/plain)
2006-11-27 17:57 UTC, Anders Petersson
Details

Description Anders Petersson 2006-11-27 15:25:52 UTC
Steps to reproduce:
1. Launch ekiga (using provider cellip - mysecretary.net).
2. Dial out (in this case to a cellphone).
3. Reject the incoming call (on the cellphone).
4. Ekiga crashes (I can reliably reproduce this).


Stack trace:
*** glibc detected *** /usr/bin/ekiga: free(): invalid pointer: 0x08784fc8 ***
======= Backtrace: =========
/lib/tls/i686/cmov/libc.so.6[0xb639b8bd]
/lib/tls/i686/cmov/libc.so.6(__libc_free+0x84)[0xb639ba44]
/usr/lib/libpt.so.1.10.2(_ZN14PAbstractArray15DestroyContentsEv+0x48)[0xb725a1c8]
/usr/lib/libpt.so.1.10.2(_ZN10PContainer8DestructEv+0x57)[0xb725b207]
/usr/bin/ekiga(_ZN7PStringD1Ev+0x18)[0x80764f8]
/usr/lib/libopal.so.2.2(_ZN7SIP_PDUD0Ev+0x48)[0xb6d72848]
/usr/lib/libopal.so.2.2(_ZN13SIPConnection20HandlePDUsThreadMainER7PThreadi+0x110)[0xb6d5a4b0]
/usr/lib/libopal.so.2.2(_ZNK13SIPConnection30HandlePDUsThreadMain_PNotifier4CallER7PObjecti+0x25)[0xb6d663c5]
/usr/lib/libpt.so.1.10.2(_ZN13PSimpleThread4MainEv+0x2f)[0xb724586f]
/usr/lib/libpt.so.1.10.2(_ZN7PThread14PX_ThreadStartEPv+0x6d)[0xb722e04d]
/lib/tls/i686/cmov/libpthread.so.0[0xb657f504]
/lib/tls/i686/cmov/libc.so.6(__clone+0x5e)[0xb640251e]
======= Memory map: ========
08048000-080fa000 r-xp 00000000 03:02 2041482    /usr/bin/ekiga
080fa000-08101000 rw-p 000b2000 03:02 2041482    /usr/bin/ekiga
08101000-0889d000 rw-p 08101000 00:00 0          [heap]
ada6f000-ada70000 ---p ada6f000 00:00 0 
ada70000-adab0000 rw-p ada70000 00:00 0 
adab0000-adab1000 ---p adab0000 00:00 0 
adab1000-ae2b1000 rw-p adab1000 00:00 0 
aeab2000-aeab3000 ---p aeab2000 00:00 0 
aeab3000-af2b3000 rw-p aeab3000 00:00 0 
b15bf000-b15c0000 ---p b15bf000 00:00 0 
b15c0000-b1621000 rw-p b15c0000 00:00 0 
b1621000-b1700000 ---p b1621000 00:00 0 
b1730000-b1731000 ---p b1730000 00:00 0 
b1731000-b1771000 rw-p b1731000 00:00 0 
b1771000-b17a1000 r-xp 00000000 03:02 1035325    /usr/lib/libcroco-0.6.so.3.0.1
b17a1000-b17a4000 rw-p 0002f000 03:02 1035325    /usr/lib/libcroco-0.6.so.3.0.1
b17a4000-b17cd000 r-xp 00000000 03:02 1032991    /usr/lib/libgsf-1.so.114.0.1
b17cd000-b17d0000 rw-p 00028000 03:02 1032991    /usr/lib/libgsf-1.so.114.0.1
b17d0000-b17d1000 rw-p b17d0000 00:00 0 
b17d1000-b1800000 r-xp 00000000 03:02 1029680    /usr/lib/librsvg-2.so.2.16.0
b1800000-b1801000 rw-p 0002f000 03:02 1029680    /usr/lib/librsvg-2.so.2.16.0
b1801000-b1802000 ---p b1801000 00:00 0 
b1802000-b2002000 rw-p b1802000 00:00 0 
b2002000-b2003000 ---p b2002000 00:00 0 
b2003000-b2043000 rw-p b2003000 00:00 0 
b2043000-b2044000 ---p b2043000 00:00 0 
b2044000-b2844000 rw-p b2044000 00:00 0 
b2844000-b2845000 ---p b2844000 00:00 0 
b2845000-b3045000 rw-p b2845000 00:00 0 
b3045000-b3046000 ---p b3045000 00:00 0 
b3046000-b3086000 rw-p b3046000 00:00 0 
b3086000-b3087000 ---p b3086000 00:00 0 
b3087000-b30c7000 rw-p b3087000 00:00 0 
b30c7000-b3127000 rw-s 00000000 00:08 87326727   /SYSV00000000 (deleted)
b3127000-b3128000 ---p b3127000 00:00 0 
b3128000-b3168000 rw-p b3128000 00:00 0 
b3168000-b316c000 r-xp 00000000 03:02 701836     /lib/tls/i686/cmov/libnss_dns-2.4.so
b316c000-b316e000 rw-p 00003000 03:02 701836     /lib/tls/i686/cmov/libnss_dns-2.4.so
b3186000-b318d000 r--p 00000000 03:02 2254678    /usr/share/locale-langpack/sv/LC_MESSAGES/gnome-vfs-2.0.mo
b318d000-b31f1000 r--p 00000000 03:02 1697339    /usr/share/fonts/truetype/ttf-dejavu/DejaVuSans-Oblique.ttf
b31f5000-b3204000 r-xp 00000000 03:02 701967     /lib/libbz2.so.1.0.3
b3204000-b3205000 rw-p 0000f000 03:02 701967     /lib/libbz2.so.1.0.3
b3223000-b3224000 r-xp 00000000 03:02 2072732    /usr/lib/gtk-2.0/2.10.0/loaders/svg_loader.so
b3224000-b3225000 rw-p 00001000 03:02 2072732    /usr/lib/gtk-2.0/2.10.0/loaders/svg_loader.so
b3225000-b3232000 r--s 00000000 03:02 1094644    /usr/share/mime/mime.cache
b3232000-b3233000 ---p b3232000 00:00 0 
b3233000-b3273000 rw-p b3233000 00:00 0 
b3273000-b3274000 ---p b3273000 00:00 0 
b3274000-b32b4000 rw-p b3274000 00:00 0 
b32b4000-b32ba000 r-xp 00000000 03:02 2072739    /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b32ba000-b32bb000 rw-p 00005000 03:02 2072739    /usr/lib/gtk-2.0/2.10.0/loaders/libpixbufloader-xpm.so
b32bb000-b32c2000 r-xp 00000000 03:02 1033879    /usr/lib/libfam.so.0.0.0
b32c2000-b32c3000 rw-p 00006000 03:02 1033879    /usr/lib/libfam.so.0.0.0
b32c3000-b32c8000 r-xp 00000000 03:02 702175     /lib/libacl.so.1.1.0
b32c8000-b32c9000 rw-p 00005000 03:02 702175     /lib/libacl.so.1.1.0
b32c9000-b32cc000 r-xp 00000000 03:02 701849     /lib/libattr.so.1.1.0
b32cc000-b32cd000 rw-p 00002000 03:02 701849     /lib/libattr.so.1.1.0
b32cd000-b32e3000 r--p 00000000 03:02 2252519    /usr/share/locale-langpack/sv/LC_MESSAGES/evolution-data-server-1.8.mo
b32e3000-b32e5000 r--p 00000000 03:02 2254178    /usr/share/locale-langpack/sv/LC_MESSAGES/atk10.mo
b32e5000-b32eb000 r--p 00000000 03:02 2254677    /usr/share/locale-langpack/sv/LC_MESSAGES/libgnomeui-2.0.mo
b32eb000-b32f7000 r-xp 00000000 03:02 1534665    /usr/lib/gnome-vfs-2.0/modules/libfile.so
b32f7000-b32f8000 rw-p 0000b000 03:02 
Program received signal SIGABRT, Aborted.
[Switching to Thread -1317598304 (LWP 3534)]
0xffffe410 in __kernel_vsyscall ()
(gdb) thread apply all bt

Thread 1 (Thread -1247730000 (LWP 3183))

  • #0 __kernel_vsyscall
  • #1 __lll_mutex_lock_wait
    from /lib/tls/i686/cmov/libc.so.6
  • #2 _L_mutex_lock_4345
    from /lib/tls/i686/cmov/libc.so.6
  • #3 ??
  • #4 IA__g_slice_free1
  • #5 IA__g_free
    at gmem.c line 187
  • #6 IA__gtk_target_list_unref
    at gtkselection.c line 249
  • #7 IA__gtk_selection_clear_targets
    at gtkselection.c line 852
  • #8 gtk_clipboard_set_contents
    at gtkclipboard.c line 526
  • #9 gtk_label_select_region_index
    at gtklabel.c line 3374
  • #10 gtk_label_grab_focus
    at gtklabel.c line 2839
  • #11 IA__g_cclosure_marshal_VOID__VOID
    at gmarshal.c line 77
  • #12 g_type_class_meta_marshal
    at gclosure.c line 567
  • #13 IA__g_closure_invoke
    at gclosure.c line 490
  • #14 signal_emit_unlocked_R
  • #15 IA__g_signal_emit_valist
    at gsignal.c line 2199
  • #16 IA__g_signal_emit
    at gsignal.c line 2243
  • #17 IA__gtk_widget_grab_focus
    at gtkwidget.c line 4216
  • #18 gtk_widget_real_focus
    at gtkwidget.c line 4323
  • #19 _gtk_marshal_BOOLEAN__ENUM
    at gtkmarshalers.c line 164
  • #20 g_type_class_meta_marshal
    at gclosure.c line 567
  • #21 IA__g_closure_invoke
    at gclosure.c line 490
  • #22 signal_emit_unlocked_R
  • #23 IA__g_signal_emit_valist
    at gsignal.c line 2209
  • #24 IA__g_signal_emit
    at gsignal.c line 2243
  • #25 IA__gtk_widget_child_focus
    at gtkwidget.c line 5895
  • #26 gtk_container_focus
    at gtkcontainer.c line 2036
  • #27 _gtk_marshal_BOOLEAN__ENUM
    at gtkmarshalers.c line 164
  • #28 g_type_class_meta_marshal
    at gclosure.c line 567
  • #29 IA__g_closure_invoke
    at gclosure.c line 490
  • #30 signal_emit_unlocked_R
    at gsignal.c line 2478
  • #31 IA__g_signal_emit_valist
    at gsignal.c line 2209
  • #32 IA__g_signal_emit
    at gsignal.c line 2243
  • #33 IA__gtk_widget_child_focus
    at gtkwidget.c line 5895
  • #34 gtk_container_focus
    at gtkcontainer.c line 2036
  • #35 _gtk_marshal_BOOLEAN__ENUM
    at gtkmarshalers.c line 164
  • #36 g_type_class_meta_marshal
    at gclosure.c line 567
  • #37 IA__g_closure_invoke
    at gclosure.c line 490
  • #38 signal_emit_unlocked_R
    at gsignal.c line 2478
  • #39 IA__g_signal_emit_valist
    at gsignal.c line 2209
  • #40 IA__g_signal_emit
    at gsignal.c line 2243
  • #41 IA__gtk_widget_child_focus
  • #42 gtk_container_focus
    at gtkcontainer.c line 2036
  • #43 _gtk_marshal_BOOLEAN__ENUM
    at gtkmarshalers.c line 164
  • #44 g_type_class_meta_marshal
    at gclosure.c line 567
  • #45 IA__g_closure_invoke
    at gclosure.c line 490
  • #46 signal_emit_unlocked_R
    at gsignal.c line 2478
  • #47 IA__g_signal_emit_valist
    at gsignal.c line 2209
  • #48 IA__g_signal_emit
    at gsignal.c line 2243
  • #49 IA__gtk_widget_child_focus
    at gtkwidget.c line 5895
  • #50 gtk_window_focus
    at gtkwindow.c line 4938
  • #51 _gtk_marshal_BOOLEAN__ENUM
    at gtkmarshalers.c line 164
  • #52 g_type_class_meta_marshal
    at gclosure.c line 567
  • #53 IA__g_closure_invoke
    at gclosure.c line 490
  • #54 signal_emit_unlocked_R
    at gsignal.c line 2478
  • #55 IA__g_signal_emit_valist
    at gsignal.c line 2209
  • #56 IA__g_signal_emit
    at gsignal.c line 2243
  • #57 IA__gtk_widget_child_focus
    at gtkwidget.c line 5895
  • #58 gtk_window_move_focus
    at gtkwindow.c line 4744
  • #59 IA__g_cclosure_marshal_VOID__ENUM
    at gmarshal.c line 356
  • #60 g_type_class_meta_marshal
    at gclosure.c line 567
  • #61 IA__g_closure_invoke
    at gclosure.c line 490
  • #62 signal_emit_unlocked_R
    at gsignal.c line 2478
  • #63 IA__g_signal_emit_valist
    at gsignal.c line 2199
  • #64 IA__g_signal_emit_by_name
    at gsignal.c line 2267
  • #65 gtk_dialog_map
    at gtkdialog.c line 319
  • #66 IA__g_cclosure_marshal_VOID__VOID
    at gmarshal.c line 77
  • #67 g_type_class_meta_marshal
    at gclosure.c line 567
  • #68 IA__g_closure_invoke
    at gclosure.c line 490
  • #69 signal_emit_unlocked_R
    at gsignal.c line 2370
  • #70 IA__g_signal_emit_valist
    at gsignal.c line 2199
  • #71 IA__g_signal_emit
    at gsignal.c line 2243
  • #72 IA__gtk_widget_map
    at gtkwidget.c line 2415
  • #73 gtk_window_show
    at gtkwindow.c line 4068
  • #74 IA__g_cclosure_marshal_VOID__VOID
    at gmarshal.c line 77
  • #75 g_type_class_meta_marshal
    at gclosure.c line 567
  • #76 IA__g_closure_invoke
    at gclosure.c line 490
  • #77 signal_emit_unlocked_R
    at gsignal.c line 2370
  • #78 IA__g_signal_emit_valist
    at gsignal.c line 2199
  • #79 IA__g_signal_emit
    at gsignal.c line 2243
  • #80 IA__gtk_widget_show
    at gtkwidget.c line 2222
  • #81 IA__gtk_window_present_with_time
    at gtkwindow.c line 6248
  • #82 IA__gtk_window_present
    at gtkwindow.c line 6200
  • #83 gnomemeeting_threads_dialog_show_all
    at gmdialog.c line 280
  • #84 gnomemeeting_dialog
    at gmdialog.c line 557
  • #85 gnomemeeting_error_dialog
    at gmdialog.c line 323
  • #86 assert_error_msg
    at gui/misc.cpp line 116
  • #87 g_idle_dispatch
    at gmain.c line 3926
  • #88 IA__g_main_context_dispatch
  • #89 g_main_context_iterate
    at gmain.c line 2677
  • #90 IA__g_main_loop_run
    at gmain.c line 2881
  • #91 IA__gtk_main
    at gtkmain.c line 1024
  • #92 main
    at gui/main.cpp line 4658
  • #93 __libc_start_main
    from /lib/tls/i686/cmov/libc.so.6
  • #94 _start
    at /usr/include/ptclib/http.h line 494
  • #0 __kernel_vsyscall


Other information:
Running Ubuntu Edgy (6.10). (Using as many dbgsym packages as want to install.)
Using Ekiga 2.0.3.
Comment 1 Damien Sandras 2006-11-27 16:12:06 UTC
Thanks for taking the time to report this bug.
Unfortunately, that stack trace is missing some elements that will help a lot to solve the problem, so it will be hard for the developers to fix that crash. Can you get us a stack trace with debugging symbols and which is not corrupted? 

Please see http://live.gnome.org/GettingTraces for more information on how to do so. Thanks in advance!

The problem can not be reproduced here. 

Setting priority as Low.
Comment 2 Anders Petersson 2006-11-27 17:57:01 UTC
Further testing reveals that the bug is not triggered by rejecting the call, but also by not accepting it within a short period of time.

When running through valgrind it does not abort but instead pops up a number (once I got 20 or so, once I got 2) of error dialogs saying "Invalid array index".

Even further testing reveals that those dialogs pop up, and the valgrind message below appears even without connecting (just launching and waiting), this time running valgrind -v ekiga.

Seeing how (from the regular gdb session) this

  • #0 __kernel_vsyscall
  • #1 raise
    from /lib/tls/i686/cmov/libc.so.6
  • #2 abort
    from /lib/tls/i686/cmov/libc.so.6
  • #3 __libc_message
    from /lib/tls/i686/cmov/libc.so.6
  • #4 _int_free
    from /lib/tls/i686/cmov/libc.so.6
  • #5 free
    from /lib/tls/i686/cmov/libc.so.6
  • #6 PAbstractArray::DestroyContents
    at ../common/contain.cxx line 850
  • #7 PContainer::Destruct
    at ../common/contain.cxx line 767
  • #8 ~PString
    at /usr/include/ptlib/array.h line 171
  • #9 SIP_PDU::~SIP_PDU
    from /usr/lib/libopal.so.2.2
  • #10 ??
  • #11 ??

seems to be where it's triggered makes the following excerpt from the valgrind log seem interesting (it's the only one not regarding gdk using calloc on previously malloced memory, or the soundsystem calling an ioctl with uninitialized data) (the message is also triggered at the same time as the dialogs):

==13264== Thread 13:
==13264== Invalid write of size 1
==13264==    at 0x572394A: SIP_PDU::Read(OpalTransport&) (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x56FD605: SIPEndPoint::HandlePDU(OpalTransport&) (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x56FD28E: SIPEndPoint::TransportThreadMain(PThread&, int) (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x57098F4: SIPEndPoint::TransportThreadMain_PNotifier::Call(PObject&, int) const (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x4E7886E: PSimpleThread::Main() (osutils.cxx:2199)
==13264==    by 0x4E6104C: PThread::PX_ThreadStart(void*) (tlibthrd.cxx:1340)
==13264==    by 0x59A1503: start_thread (in /lib/tls/i686/cmov/libpthread-2.4.so)
==13264==    by 0x5B8D51D: clone (in /lib/tls/i686/cmov/libc-2.4.so)
==13264==  Address 0x77EAA84 is 4 bytes before a block of size 1 alloc'd
==13264==    at 0x4021492: realloc (vg_replace_malloc.c:306)
==13264==    by 0x4E8DF78: PAbstractArray::InternalSetSize(int, int) (contain.cxx:988)
==13264==    by 0x4E8E0AB: PString::SetSize(int) (contain.cxx:1641)
==13264==    by 0x4E8EFC7: PContainer::SetMinSize(int) (contain.cxx:782)
==13264==    by 0x5723916: SIP_PDU::Read(OpalTransport&) (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x56FD605: SIPEndPoint::HandlePDU(OpalTransport&) (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x56FD28E: SIPEndPoint::TransportThreadMain(PThread&, int) (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x57098F4: SIPEndPoint::TransportThreadMain_PNotifier::Call(PObject&, int) const (in /usr/lib/libopal.so.2.2.3)
==13264==    by 0x4E7886E: PSimpleThread::Main() (osutils.cxx:2199)
==13264==    by 0x4E6104C: PThread::PX_ThreadStart(void*) (tlibthrd.cxx:1340)
==13264==    by 0x59A1503: start_thread (in /lib/tls/i686/cmov/libpthread-2.4.so)
==13264==    by 0x5B8D51D: clone (in /lib/tls/i686/cmov/libc-2.4.so)

Unfortunately I seem to be having little luck getting gdb/valgrind to pick up the opal debug symbols.

--15587-- Reading syms from /usr/lib/libopal.so.2.2.3 (0x4F44000)

--15587-- Reading debug info from /usr/lib/libopal.so.2.2.3...

--15587-- ... CRC mismatch (computed AAE95E15 wanted DF5CDA77)

--15587-- Reading debug info from /usr/lib/debug/usr/lib/libopal.so.2.2.3...

--15587-- warning: DiCfSI 0xFFA29B37 .. 0xFFA29B38 outside segment 0x4F44000 .. 0x5997FFF

--15587-- warning: DiCfSI 0xFFA22F53 .. 0xFFA22F54 outside segment 0x4F44000 .. 0x5997FFF

--15587-- warning: DiCfSI 0xFFA22F4F .. 0xFFA22F50 outside segment 0x4F44000 .. 0x5997FFF

I'll attach the valgrind -v log and look into rebuilding the opal package with debugging symbols locally sometime later.
Comment 3 Anders Petersson 2006-11-27 17:57:58 UTC
Created attachment 77233 [details]
valgrind -v ekiga
Comment 4 Damien Sandras 2006-11-27 19:48:52 UTC
I don't think that valgrind indicates teh source of the problem. 
(It is a double free).

Can you mail me privately account information so that I can reproduce the problem?
Comment 5 Damien Sandras 2006-12-03 17:01:44 UTC
I could reproduce the problem on my machine thanks to the information that you gave me.

The problem is that your provider was sending a malformed "180 Ringing" response, and OPAL was deducing a negative value for the contentLength of the body.

I have added guards against that and I have tested, it works well.

The patch is available here :
http://openh323.cvs.sourceforge.net/openh323/opal/src/sip/sippdu.cxx?r1=2.113&r2=2.114

It has been backported to the Phobos branch of OPAL, it means that both CVS HEAD and Ekiga 2.0.4 will contain the fix.

Thanks for reporting it, and providing the relevant information allowing me to fix it!