Attachment 1582389 Details for Bug 1722281 – File: backtrace

File: backtrace

backtrace (text/plain), 10.51 KB, created by Ben Woodard on 2019-06-19 21:34:32 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ben Woodard

Created: 2019-06-19 21:34:32 UTC

Size: 10.51 KB

patch

obsolete

>[New LWP 20634]
>Core was generated by `xwininfo'.
>Program terminated with signal SIGSEGV, Segmentation fault.
>#0  Select_Window (dpy=0x558152d2b030, screen=<optimized out>, descend=descend@entry=1) at dsimple.c:199
>
>Thread 1 (LWP 20634):
>#0  Select_Window (dpy=0x558152d2b030, screen=<optimized out>, descend=descend@entry=1) at dsimple.c:199
>        cursor = 10485761
>        event = <optimized out>
>        target_win = 0
>        root = 273
>        buttons = 0
>        err = 0x558152d31070
>        grab_cookie = <optimized out>
>        grab_reply = 0x0
>#1  0x00005581527df3e4 in main (argc=1, argv=0x7ffc90f1e908) at xwininfo.c:581
>        i = <optimized out>
>        tree = <optimized out>
>        stats = <optimized out>
>        bits = <optimized out>
>        events = <optimized out>
>        wm = <optimized out>
>        size = <optimized out>
>        shape = <optimized out>
>        frame = <optimized out>
>        children = <optimized out>
>        use_root = <optimized out>
>        window = 0
>        display_name = <optimized out>
>        window_name = <optimized out>
>        wininfo = {window = 0, geometry_cookie = {sequence = 0}, net_wm_name_cookie = {sequence = 0}, wm_name_cookie = {sequence = 0}, wm_class_cookie = {sequence = 0}, trans_coords_cookie = {sequence = 0}, tree_cookie = {sequence = 0}, attr_cookie = {sequence = 0}, normal_hints_cookie = {sequence = 0}, hints_cookie = {sequence = 0}, wm_desktop_cookie = {sequence = 0}, wm_window_type_cookie = {sequence = 0}, wm_state_cookie = {sequence = 0}, wm_pid_cookie = {sequence = 0}, wm_client_machine_cookie = {sequence = 0}, frame_extents_cookie = {sequence = 0}, zoom_cookie = {sequence = 0}, geometry = 0x0, win_attributes = 0x0, normal_hints = 0x0}
>        w = 0x7ffc90f1e720
>From                To                  Syms Read   Shared Object Library
>0x00007f9c54ab6d90  0x00007f9c54ac9b69  Yes         /lib64/libxcb.so.1
>0x00007f9c54aa60b0  0x00007f9c54aa6d09  Yes         /lib64/libxcb-shape.so.0
>0x00007f9c54900670  0x00007f9c54a4b69f  Yes         /lib64/libc.so.6
>0x00007f9c548d93d0  0x00007f9c548da0a2  Yes         /lib64/libXau.so.6
>0x00007f9c54b01110  0x00007f9c54b20744  Yes         /lib64/ld-linux-x86-64.so.2
>0x00007f9c479195f0  0x00007f9c4791f96c  Yes         /lib64/libnss_files.so.2
>$1 = 0x0
>rax            0x0                 0
>rbx            0xa00001            10485761
>rcx            0x7                 7
>rdx            0x0                 0
>rsi            0x0                 0
>rdi            0x558152d2b048      94013928681544
>rbp            0x558152d2b030      0x558152d2b030
>rsp            0x7ffc90f1e660      0x7ffc90f1e660
>r8             0x558152d31140      94013928706368
>r9             0x0                 0
>r10            0x0                 0
>r11            0x7f9c54a9ecc0      140309412048064
>r12            0x7ffc90f1e908      140722740259080
>r13            0x1                 1
>r14            0x111               273
>r15            0x1                 1
>rip            0x5581527e114b      0x5581527e114b <Select_Window+171>
>eflags         0x10246             [ PF ZF IF RF ]
>cs             0x33                51
>ss             0x2b                43
>ds             0x0                 0
>es             0x0                 0
>fs             0x0                 0
>gs             0x0                 0
>Dump of assembler code for function Select_Window:
>Address range 0x5581527e10a0 to 0x5581527e125b:
>   0x00005581527e10a0 <+0>:	endbr64 
>   0x00005581527e10a4 <+4>:	push   %r15
>   0x00005581527e10a6 <+6>:	mov    %edx,%r15d
>   0x00005581527e10a9 <+9>:	push   %r14
>   0x00005581527e10ab <+11>:	push   %r13
>   0x00005581527e10ad <+13>:	push   %r12
>   0x00005581527e10af <+15>:	push   %rbp
>   0x00005581527e10b0 <+16>:	mov    %rdi,%rbp
>   0x00005581527e10b3 <+19>:	push   %rbx
>   0x00005581527e10b4 <+20>:	sub    $0x18,%rsp
>   0x00005581527e10b8 <+24>:	mov    (%rsi),%r14d
>   0x00005581527e10bb <+27>:	mov    %fs:0x28,%rax
>   0x00005581527e10c4 <+36>:	mov    %rax,0x8(%rsp)
>   0x00005581527e10c9 <+41>:	xor    %eax,%eax
>   0x00005581527e10cb <+43>:	mov    0x6f7f(%rip),%eax        # 0x5581527e8050 <cursor_font.9576>
>   0x00005581527e10d1 <+49>:	test   %eax,%eax
>   0x00005581527e10d3 <+51>:	je     0x5581527e1230 <Select_Window+400>
>   0x00005581527e10d9 <+57>:	mov    %rbp,%rdi
>   0x00005581527e10dc <+60>:	callq  0x5581527de680 <xcb_generate_id@plt>
>   0x00005581527e10e1 <+65>:	pushq  $0xffff
>   0x00005581527e10e6 <+70>:	mov    %rbp,%rdi
>   0x00005581527e10e9 <+73>:	mov    0x6f61(%rip),%edx        # 0x5581527e8050 <cursor_font.9576>
>   0x00005581527e10ef <+79>:	pushq  $0xffff
>   0x00005581527e10f4 <+84>:	mov    $0x23,%r9d
>   0x00005581527e10fa <+90>:	mov    %eax,%esi
>   0x00005581527e10fc <+92>:	mov    %eax,%ebx
>   0x00005581527e10fe <+94>:	pushq  $0xffff
>   0x00005581527e1103 <+99>:	mov    %edx,%ecx
>   0x00005581527e1105 <+101>:	mov    $0x22,%r8d
>   0x00005581527e110b <+107>:	pushq  $0x0
>   0x00005581527e110d <+109>:	pushq  $0x0
>   0x00005581527e110f <+111>:	pushq  $0x0
>   0x00005581527e1111 <+113>:	callq  0x5581527de970 <xcb_create_glyph_cursor@plt>
>   0x00005581527e1116 <+118>:	add    $0x28,%rsp
>   0x00005581527e111a <+122>:	xor    %r8d,%r8d
>   0x00005581527e111d <+125>:	xor    %esi,%esi
>   0x00005581527e111f <+127>:	pushq  $0x0
>   0x00005581527e1121 <+129>:	mov    $0x1,%r9d
>   0x00005581527e1127 <+135>:	mov    $0xc,%ecx
>   0x00005581527e112c <+140>:	mov    %r14d,%edx
>   0x00005581527e112f <+143>:	push   %rbx
>   0x00005581527e1130 <+144>:	mov    %rbp,%rdi
>   0x00005581527e1133 <+147>:	push   %r14
>   0x00005581527e1135 <+149>:	callq  0x5581527de750 <xcb_grab_pointer@plt>
>   0x00005581527e113a <+154>:	add    $0x20,%rsp
>   0x00005581527e113e <+158>:	mov    %rbp,%rdi
>   0x00005581527e1141 <+161>:	mov    %eax,%esi
>   0x00005581527e1143 <+163>:	mov    %rsp,%rdx
>   0x00005581527e1146 <+166>:	callq  0x5581527de860 <xcb_grab_pointer_reply@plt>
>=> 0x00005581527e114b <+171>:	cmpb   $0x0,0x1(%rax)
>   0x00005581527e114f <+175>:	jne    0x5581527deb79 <Select_Window+4294957785>
>   0x00005581527e1155 <+181>:	xor    %ebx,%ebx
>   0x00005581527e1157 <+183>:	xor    %r12d,%r12d
>   0x00005581527e115a <+186>:	nopw   0x0(%rax,%rax,1)
>   0x00005581527e1160 <+192>:	xor    %edx,%edx
>   0x00005581527e1162 <+194>:	mov    $0x1,%esi
>   0x00005581527e1167 <+199>:	mov    %rbp,%rdi
>   0x00005581527e116a <+202>:	callq  0x5581527de640 <xcb_allow_events@plt>
>   0x00005581527e116f <+207>:	mov    %rbp,%rdi
>   0x00005581527e1172 <+210>:	callq  0x5581527de670 <xcb_flush@plt>
>   0x00005581527e1177 <+215>:	mov    %rbp,%rdi
>   0x00005581527e117a <+218>:	callq  0x5581527de8e0 <xcb_wait_for_event@plt>
>   0x00005581527e117f <+223>:	mov    %rax,%rdi
>   0x00005581527e1182 <+226>:	test   %rax,%rax
>   0x00005581527e1185 <+229>:	je     0x5581527deb6b <Select_Window+4294957771>
>   0x00005581527e118b <+235>:	movzbl (%rax),%eax
>   0x00005581527e118e <+238>:	and    $0x7f,%eax
>   0x00005581527e1191 <+241>:	cmp    $0x4,%al
>   0x00005581527e1193 <+243>:	je     0x5581527e1210 <Select_Window+368>
>   0x00005581527e1195 <+245>:	cmp    $0x5,%al
>   0x00005581527e1197 <+247>:	je     0x5581527e11f8 <Select_Window+344>
>   0x00005581527e1199 <+249>:	test   %ebx,%ebx
>   0x00005581527e119b <+251>:	setne  %r13b
>   0x00005581527e119f <+255>:	callq  0x5581527de550 <free@plt>
>   0x00005581527e11a4 <+260>:	test   %r12d,%r12d
>   0x00005581527e11a7 <+263>:	je     0x5581527e1160 <Select_Window+192>
>   0x00005581527e11a9 <+265>:	test   %r13b,%r13b
>   0x00005581527e11ac <+268>:	jne    0x5581527e1160 <Select_Window+192>
>   0x00005581527e11ae <+270>:	xor    %esi,%esi
>   0x00005581527e11b0 <+272>:	mov    %rbp,%rdi
>   0x00005581527e11b3 <+275>:	callq  0x5581527de6a0 <xcb_ungrab_pointer@plt>
>   0x00005581527e11b8 <+280>:	test   %r15d,%r15d
>   0x00005581527e11bb <+283>:	je     0x5581527e11d3 <Select_Window+307>
>   0x00005581527e11bd <+285>:	cmp    %r12d,%r14d
>   0x00005581527e11c0 <+288>:	je     0x5581527e11d3 <Select_Window+307>
>   0x00005581527e11c2 <+290>:	mov    %r12d,%edx
>   0x00005581527e11c5 <+293>:	mov    %r14d,%esi
>   0x00005581527e11c8 <+296>:	mov    %rbp,%rdi
>   0x00005581527e11cb <+299>:	callq  0x5581527e0d60 <Find_Client>
>   0x00005581527e11d0 <+304>:	mov    %eax,%r12d
>   0x00005581527e11d3 <+307>:	mov    0x8(%rsp),%rcx
>   0x00005581527e11d8 <+312>:	xor    %fs:0x28,%rcx
>   0x00005581527e11e1 <+321>:	mov    %r12d,%eax
>   0x00005581527e11e4 <+324>:	jne    0x5581527e1256 <Select_Window+438>
>   0x00005581527e11e6 <+326>:	add    $0x18,%rsp
>   0x00005581527e11ea <+330>:	pop    %rbx
>   0x00005581527e11eb <+331>:	pop    %rbp
>   0x00005581527e11ec <+332>:	pop    %r12
>   0x00005581527e11ee <+334>:	pop    %r13
>   0x00005581527e11f0 <+336>:	pop    %r14
>   0x00005581527e11f2 <+338>:	pop    %r15
>   0x00005581527e11f4 <+340>:	retq   
>   0x00005581527e11f5 <+341>:	nopl   (%rax)
>   0x00005581527e11f8 <+344>:	xor    %r13d,%r13d
>   0x00005581527e11fb <+347>:	test   %ebx,%ebx
>   0x00005581527e11fd <+349>:	je     0x5581527e119f <Select_Window+255>
>   0x00005581527e11ff <+351>:	sub    $0x1,%ebx
>   0x00005581527e1202 <+354>:	setne  %r13b
>   0x00005581527e1206 <+358>:	jmp    0x5581527e119f <Select_Window+255>
>   0x00005581527e1208 <+360>:	nopl   0x0(%rax,%rax,1)
>   0x00005581527e1210 <+368>:	test   %r12d,%r12d
>   0x00005581527e1213 <+371>:	jne    0x5581527e1220 <Select_Window+384>
>   0x00005581527e1215 <+373>:	mov    0x10(%rdi),%r12d
>   0x00005581527e1219 <+377>:	test   %r12d,%r12d
>   0x00005581527e121c <+380>:	cmove  %r14d,%r12d
>   0x00005581527e1220 <+384>:	add    $0x1,%ebx
>   0x00005581527e1223 <+387>:	callq  0x5581527de550 <free@plt>
>   0x00005581527e1228 <+392>:	jmpq   0x5581527e1160 <Select_Window+192>
>   0x00005581527e122d <+397>:	nopl   (%rax)
>   0x00005581527e1230 <+400>:	callq  0x5581527de680 <xcb_generate_id@plt>
>   0x00005581527e1235 <+405>:	lea    0x2e0b(%rip),%rcx        # 0x5581527e4047
>   0x00005581527e123c <+412>:	mov    $0x6,%edx
>   0x00005581527e1241 <+417>:	mov    %rbp,%rdi
>   0x00005581527e1244 <+420>:	mov    %eax,%esi
>   0x00005581527e1246 <+422>:	mov    %eax,0x6e04(%rip)        # 0x5581527e8050 <cursor_font.9576>
>   0x00005581527e124c <+428>:	callq  0x5581527de940 <xcb_open_font@plt>
>   0x00005581527e1251 <+433>:	jmpq   0x5581527e10d9 <Select_Window+57>
>   0x00005581527e1256 <+438>:	callq  0x5581527de660 <__stack_chk_fail@plt>
>Address range 0x5581527deb6b to 0x5581527deb87:
>   0x00005581527deb6b <+-9525>:	lea    0x54f2(%rip),%rdi        # 0x5581527e4064
>   0x00005581527deb72 <+-9518>:	xor    %eax,%eax
>   0x00005581527deb74 <+-9516>:	callq  0x5581527dea10 <Fatal_Error>
>   0x00005581527deb79 <+-9511>:	lea    0x54ce(%rip),%rdi        # 0x5581527e404e
>   0x00005581527deb80 <+-9504>:	xor    %eax,%eax
>   0x00005581527deb82 <+-9502>:	callq  0x5581527dea10 <Fatal_Error>
>End of assembler dump.
>== EXPLOITABLE ==

Actions: View

Attachments on bug 1722281: 1582389 | 1582390 | 1582391 | 1582392 | 1582393 | 1582394 | 1582395 | 1582396 | 1582397 | 1582398 | 1582399 | 1582400