After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 742688 - camel-db.c: Segfault due to accessing an already destroyed `sqlite3_file` object
camel-db.c: Segfault due to accessing an already destroyed `sqlite3_file` object
Status: RESOLVED FIXED
Product: evolution-data-server
Classification: Platform
Component: general
3.12.x (obsolete)
Other Linux
: Normal critical
: ---
Assigned To: Evolution Shell Maintainers Team
Evolution QA team
Depends on:
Blocks:
 
 
Reported: 2015-01-10 09:27 UTC by Paul Menzel
Modified: 2015-02-05 15:40 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
(gdb) t a a bt f (86.95 KB, text/x-log)
2015-01-10 09:27 UTC, Paul Menzel
Details

Description Paul Menzel 2015-01-10 09:27:12 UTC
Created attachment 294207 [details]
(gdb) t a a bt f

Using Debian Sid/unstable with the Evolution-Data-Server package 3.12.9~git20141128.5242b0-2 and SQLite 3.8.7.4, Evolution crashed with a segmentation fault.

    0xb3f9af51 in sqlite3Strlen30 (z=0x18 <error: Cannot access memory at address 0x18>) at sqlite3.c:22902

Here is the backtrace.

Thread 53 (Thread 0xa7e04b40 (LWP 3576))

  • #0 sqlite3Strlen30
    at sqlite3.c line 22902
  • #1 sqlite3VXPrintf
    at sqlite3.c line 21385
  • #2 sqlite3_vsnprintf
    at sqlite3.c line 21731
  • #3 sqlite3_snprintf
    at sqlite3.c line 21738
  • #4 openDirectory
    at sqlite3.c line 28334
  • #5 unixSync
    at sqlite3.c line 28396
  • #6 call_old_file_Sync
    at camel-db.c line 66
  • #7 sync_request_thread_cb
    at camel-db.c line 92
  • #8 g_thread_pool_thread_proxy
    at /build/glib2.0-EvFudu/glib2.0-2.42.1/./glib/gthreadpool.c line 307
  • #9 g_thread_proxy
    at /build/glib2.0-EvFudu/glib2.0-2.42.1/./glib/gthread.c line 764
  • #10 start_thread
    at pthread_create.c line 309
  • #11 clone
    at ../sysdeps/unix/sysv/linux/i386/clone.S line 129

Please find the full backtrace attached.

The SQLite developer D. Richard Hipp also analyzed this issue on the mailing lists sqlite-users [1].

>         #6  0xb7ad33d6 in call_old_file_Sync (flags=<optimized out>,
> > cFile=<optimized out>) at camel-db.c:66
>
> The pFile object with the invalid zPath field is a parameter to
> unixSync(), and hence comes from call_old_file_Sync(), which is not a
> part of the SQLite source tree.  I don't have the sources to
> camel-db.c so I cannot trace this any further.  My guess (based on the
> name of the function) is that camel-db.c is trying to "sync" an
> sqlite3_file object that has been previously destroyed.
>
> This appears to be completely unrelated to the previous issue.  The
> previous issue was that a file was not being extended correctly
> because of a lack of disk space, so that a memcpy() into a mmap() of
> that file segfaulted.  That does not appear to be what is happening
> here, unless I'm missing something.

Here is the corresponding function.

static gint
call_old_file_Sync (CamelSqlite3File *cFile,
                    gint flags)
{
	g_return_val_if_fail (old_vfs != NULL, SQLITE_ERROR);
	g_return_val_if_fail (cFile != NULL, SQLITE_ERROR);

	g_return_val_if_fail (cFile->old_vfs_file->pMethods != NULL, SQLITE_ERROR);
→	return cFile->old_vfs_file->pMethods->xSync (cFile->old_vfs_file, flags);
}

[1] https://www.mail-archive.com/sqlite-users@sqlite.org/msg88083.html
[2] http://sources.debian.net/src/evolution-data-server/3.12.9~git20141128.5242b0-2/camel/camel-db.c/#L66
Comment 1 Milan Crha 2015-01-12 13:36:20 UTC
Thanks fro a bug report. Evolution-data-server 3.12.9, (the official release, not your custom), contains a fix for this [1]. If I read your package name properly, then your git-snapshot doesn't contain it.

[1] https://git.gnome.org/browse/evolution-data-server/commit/?id=a1bc3301e7
Comment 2 Paul Menzel 2015-01-12 16:19:04 UTC
(In reply to comment #1)
> Thanks fro a bug report. Evolution-data-server 3.12.9, (the official release,
> not your custom), contains a fix for this [1]. If I read your package name
> properly, then your git-snapshot doesn't contain it.

Thanks, that is indeed the case.

As the commit message of [1] does not contain a bug number, did you experience that crash or did you fix it by justing reading the code?

> [1] https://git.gnome.org/browse/evolution-data-server/commit/?id=a1bc3301e7
Comment 3 Milan Crha 2015-02-05 15:40:03 UTC
I was notified about it in a downstream bugzilla, which I didn't upstream for some reason.