After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 711016 - g_settings_list_keys () segfaults for empty schemas
g_settings_list_keys () segfaults for empty schemas
Status: RESOLVED FIXED
Product: glib
Classification: Platform
Component: gio
2.39.x
Other Linux
: Normal normal
: ---
Assigned To: gtkdev
gtkdev
Depends on:
Blocks:
 
 
Reported: 2013-10-28 14:42 UTC by Martin Pitt
Modified: 2013-10-29 05:51 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
g_settings_schema_list: some fixes (2.04 KB, patch)
2013-10-28 16:34 UTC, Allison Karlitskaya (desrt)
committed Details | Review

Description Martin Pitt 2013-10-28 14:42:42 UTC
I noticed that pygobject's test case for empty schemas now segfaults. This started to happen recently, 2.38.1 still works fine.

Reproducer:
 * Download https://git.gnome.org/browse/pygobject/tree/tests/org.gnome.test.gschema.xml into /tmp/
 * cd /tmp/
 * glib-compile-schemas --targetdir=. --schema-file=org.gnome.test.gschema.xml
 * GSETTINGS_BACKEND=memory GSETTINGS_SCHEMA_DIR=. python -c 'from gi.repository import Gio; s = Gio.Settings("org.gnome.empty"); print(s.list_keys())'

On my installed system with glib 2.38.1 this prints "[]" as expected. But in jhbuild, this segfaults:

$ GSETTINGS_BACKEND=memory GSETTINGS_SCHEMA_DIR=. jhbuild run gdb --args python -c 'from gi.repository import Gio; s = Gio.Settings("org.gnome.empty"); print(s.list_keys())'

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff5577bea in g_settings_schema_list (schema=0xb534a0, n_items=0x7fffffffd0ec)
    at gsettingsschema.c:1015
1015	          for (i = 0; list[i]; i++)

In "bt full" it's clear that list is NULL:

  • #0 g_settings_schema_list
    at gsettingsschema.c line 1015
  • #1 g_settings_list_keys
    at gsettings.c line 2138
  • #2 ffi_call_unix64
    from /usr/lib/x86_64-linux-gnu/libffi.so.6

Comment 1 Martin Pitt 2013-10-28 14:46:26 UTC
Looks like this was introduced with https://git.gnome.org/browse/glib/commit/?id=cbf8cf8598e52

Before that it did

  len = list ? g_strv_length (list) : 0;

which was save against NULL, now it isn't any more.
Comment 2 Allison Karlitskaya (desrt) 2013-10-28 16:34:24 UTC
Created attachment 258316 [details] [review]
g_settings_schema_list: some fixes

Prevent a crash in the case that gvdb_table_list() returns NULL (ie:
because a schema has no keys).

Stop a memory leak caused by pointlessly stealing keys from a hashtable
(after we quarked them already).

Stop allocating an extra entry at the end of an array for a terminator
(that we never wrote anyway) when all functions using this API refer to
the out-parameter length array.
Comment 3 Lars Karlitski 2013-10-28 16:43:49 UTC
Review of attachment 258316 [details] [review]:

Ok.
Comment 4 Allison Karlitskaya (desrt) 2013-10-28 16:44:25 UTC
Attachment 258316 [details] pushed as 066df98 - g_settings_schema_list: some fixes
Comment 5 Martin Pitt 2013-10-29 05:51:43 UTC
Thanks! I confirm that pygobject's test suite works again.