[Help-gnunet] [BUG] gnunetd crash (0.8.0pre0)

[David Kuehling]

Hi,

after noticing that gnunetd 0.8.0pre0 uptime did not reach more than a
few days, I ran it from gdb this time.  After almost a week of uptime it
crashed again:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1314849872 (LWP 25232)]
put (key=0xb03f7144, value=0x0) at mysql.c:788
788       if (((ntohl (value->size) < sizeof (GNUNET_DatastoreValue))) ||

(gdb) bt
#0  put (key=0xb03f7144, value=0x0) at mysql.c:788
#1  0xb4543a1c in handleGet (sender=0xb090548c, msg=0xb03f7134)
    at routing.c:525
#2  0xb7f6dd59 in GNUNET_CORE_p2p_inject_message (sender=0xb090548c, 
    msg=0xb03f7134 "", size=80, wasEncrypted=1, session=0xb0907e58)
    at handler.c:499
#3  0xb7f6e011 in threadMain (cls=0xbf940508) at handler.c:614
#4  0xb7e380bd in start_thread () from /lib/tls/libpthread.so.0
#5  0xb7dcd01e in clone () from /lib/tls/libc.so.6

(gdb) frame 1
#1  0xb4543a1c in handleGet (sender=0xb090548c, msg=0xb03f7134)
    at routing.c:525
525       total = dstore->get (&get->key, ntohl (get->type), &routeResult, 
NULL);
(gdb) print *dstore
$5 = {put = 0xb454a550 <getSize>, get = 0xb454c980 <put>}

print *(GNUNET_SQstore_ServiceAPI*)dstore
$8 = {getSize = 0xb454a550 <getSize>, put = 0xb454c980 <put>, 
  get = 0xb454bde0 <get>, update = 0xb454a660 <update>, 
  iterateLowPriority = 0xb454bda0 <iterateLowPriority>, 
  iterateNonAnonymous = 0xb454bd60 <iterateNonAnonymous>, 
  iterateExpirationTime = 0xb454bd20 <iterateExpirationTime>, 
  iterateMigrationOrder = 0xb454bce0 <iterateMigrationOrder>, 
  iterateAllNow = 0xb454bca0 <iterateAllNow>, drop = 0xb454a340 <drop>}


I don't quite understand what happened here.  If the debugger is right,
then the 'dstore' pointer got overridden by a pointer to a
GNUNET_SQstore_ServiceAPI object.  But maybe that's just artefacts from
debugging a program compiled with -O2?  Disassembling shows, that the
crash really occured on a null-pointer dereference:

(gdb) info reg
eax            0x0      0
ecx            0x0      0
edx            0xb03f7144       -1338019516
ebx            0xb454f53c       -1269500612
esp            0xb1a0ee20       0xb1a0ee20
ebp            0xb1a0f0f8       0xb1a0f0f8
esi            0xb090548c       -1332718452
edi            0x1      1
eip            0xb454c99a       0xb454c99a <put+26>

(gdb) disas $pc
Dump of assembler code for function put:
0xb454c980 <put+0>:     push   %ebp
0xb454c981 <put+1>:     mov    %esp,%ebp
0xb454c983 <put+3>:     push   %edi
0xb454c984 <put+4>:     push   %esi
0xb454c985 <put+5>:     push   %ebx
0xb454c986 <put+6>:     sub    $0x2cc,%esp
0xb454c98c <put+12>:    mov    0xc(%ebp),%eax
0xb454c98f <put+15>:    call   0xb4548465 <__i686.get_pc_thunk.bx>
0xb454c994 <put+20>:    add    $0x2ba8,%ebx
0xb454c99a <put+26>:    mov    (%eax),%edx
0xb454c99c <put+28>:    bswap  %edx
...


David
-- 
GnuPG public key: http://user.cs.tu-berlin.de/~dvdkhlng/dk.gpg
Fingerprint: B17A DC95 D293 657B 4205  D016 7DEF 5323 C174 7D40