After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 742019 - Setting musicbrainz proxy values to NULL causing segfault
Setting musicbrainz proxy values to NULL causing segfault
Status: RESOLVED FIXED
Product: sound-juicer
Classification: Applications
Component: metadata
3.14.x
Other FreeBSD
: Normal normal
: ---
Assigned To: Sound Juicer Maintainers
Sound Juicer Maintainers
Depends on:
Blocks:
 
 
Reported: 2014-12-27 05:26 UTC by Peter Johanson
Modified: 2015-01-23 13:09 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
Potential fix (1.28 KB, patch)
2014-12-27 05:26 UTC, Peter Johanson
committed Details | Review

Description Peter Johanson 2014-12-27 05:26:54 UTC
Created attachment 293374 [details] [review]
Potential fix

Trying to run sound-juicer on FreeBSD 11.0-CURRENT results in a segfault:

(gdb) bt
  • #0 strlen
    from /lib/libc.so.7
  • #1 mb5_query_set_proxyhost
    at string line 651
  • #2 setup_http_proxy
    at sj-metadata-musicbrainz5.c line 818
  • #3 sj_metadata_musicbrainz5_set_property
    at sj-metadata-musicbrainz5.c line 916
  • #4 g_object_set_valist
    from /usr/local/lib/libgobject-2.0.so.0
  • #5 g_object_set_property
    from /usr/local/lib/libgobject-2.0.so.0
  • #6 g_settings_bind_writable
    from /usr/local/lib/libgio-2.0.so.0
  • #7 g_settings_bind_with_mapping
    from /usr/local/lib/libgio-2.0.so.0
  • #8 g_settings_bind
    from /usr/local/lib/libgio-2.0.so.0
  • #9 bind_http_proxy_settings
    at sj-metadata-getter.c line 146
  • #10 lookup_cd
    at sj-metadata-getter.c line 219

Using "" instead of NULL for the values passed to MB seems to fix the issue. (std:string not liking NULL?)

Patch attached. My C++ fu is non-existant, so I'm not sure how right the fix is.

Thanks.
Comment 1 Phillip Wood 2015-01-08 14:29:43 UTC
Thanks for taking the time to report this problem. I've just checked and on linux there is no problem passing NULL to mb5_query_set_proxyhost(). I think it would be worth digging a bit deeper to find out what the problem is on FreeBSD, it could be libmusicbraniz, neon or libstdc++. Are you able to get a back trace with debuginfo so we can see where in mb5_query_set_proxyhost() happens please?
Comment 2 Peter Johanson 2015-01-08 16:38:49 UTC
I think this is blowing up deep in libstdc++, and I haven't found an easy way yet to get debuginfo for that.

AFAICT, the following is happening:

b5_query_set_proxyhost(Mb5Query Query, const char *ProxyHost) just calls MusicBrainz5::CQuery::SetProxyHost(const std::string& ProxyHost)

(Generated by the macros found in src/md5_c.cc in the libmusicbrainz source)

Which invokes the std::string constructor automatically. But everything I've found digging into std:string says that passing in a NULL pointer to std::string constructor results in undefined behaviour. This may seem to work on Linux, but I think because the behaviour is undefined, it is not guaranteed to and is resulting in problems on FreeBSD 11. Ultimately, to avoid the undefined behaviour, I think that at some point that "" needs to be passed to the std::string constructor and not NULL. I don't know if libmusicbrainz should be doing this for us, or if SJ should be passing it.

Thoughts? Am I understanding this right?

References:

* http://stackoverflow.com/questions/17464514/initialize-stdstring-from-a-possibly-null-char-pointer
* http://www.cplusplus.com/reference/string/string/string/
Comment 3 Phillip Wood 2015-01-09 11:54:36 UTC
Thanks for looking into the problem, I think your assessment is correct, it sounds like libstdc++ on FreeBSD is less forgiving than on linux but is complying with the c++ standard. I think it is worth raising this with the musicbraniz developers to see if they will fix it there so that it gets fixed for everyone. Are you happy to raise it with them? If not I can do it next week.
Comment 4 Peter Johanson 2015-01-09 16:27:31 UTC
I've tested a fix in libmusicbrainz that makes this work fine w/ the current SJ code, and submitted a PR for their project on GitHub:

https://github.com/metabrainz/libmusicbrainz/pull/6

We'll see what comes of that discussion.
Comment 5 Peter Johanson 2015-01-21 15:58:29 UTC
Comment on the GitHub PR from a libmusicbrainz dev:

"To be honest, I think it's quite clear that the C interface is expecting a null terminated string here, so ultimately the calling application should be responsible for passing correct data. I'd suggest an update to sound-juicer to ensure that it passes an empty string (or doesn't call the method at all) if no proxy is required."
Comment 6 Phillip Wood 2015-01-23 11:17:26 UTC
Comment on attachment 293374 [details] [review]
Potential fix

Thanks for following this up with the libmusicbrainz developers. As
they are reluctant to fix it there I've applied your patch with some
changes to the comments.

Attachment 293374 [details] pushed as 4ee58ce - Fix crash on FreeBSD