Attachment 853392 Details for Bug 1056222 – File: backtrace

File: backtrace

backtrace (text/plain), 17.90 KB, created by Stuart Rogers on 2014-01-21 17:39:49 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stuart Rogers

Created: 2014-01-21 17:39:49 UTC

Size: 17.90 KB

patch

obsolete

>[New LWP 26235]
>[Thread debugging using libthread_db enabled]
>Using host libthread_db library "/lib64/libthread_db.so.1".
>Core was generated by `bjnp://192.168.0.15 5 stuart TurboPrint Testpage 1 finishings=3 number-up=1 job'.
>Program terminated with signal SIGABRT, Aborted.
>#0  0x0000003d31835c59 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
>56	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
>
>Thread 1 (Thread 0x7f7ac113a840 (LWP 26235)):
>#0  0x0000003d31835c59 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
>        resultvar = 0
>        pid = 26235
>        selftid = 26235
>#1  0x0000003d31837368 in __GI_abort () at abort.c:89
>        save_stage = 2
>        act = {__sigaction_handler = {sa_handler = 0x303a303020303030, sa_sigaction = 0x303a303020303030}, sa_mask = {__val = {7378645556122361904, 3472387696464310886, 3545008446681591088, 8223625903103555938, 3472328295963438455, 4192904167887482928, 2314885531086893104, 2314885530818453536, 2314885530818453536, 8312272859592400928, 7365367111937646964, 3487306058386531942, 3631702738719289392, 2319406791620846385, 3472328228586663282, 669245}}, sa_flags = 65, sa_restorer = 0x7fff21b72610}
>        sigs = {__val = {32, 0 <repeats 15 times>}}
>#2  0x0000003d31875da4 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x3d3197b0a1 "*** %s ***: %s terminated\n") at ../sysdeps/posix/libc_fatal.c:175
>        ap = {{gp_offset = 32, fp_offset = 32767, overflow_arg_area = 0x7fff21b72620, reg_save_area = 0x7fff21b725b0}}
>        fd = 2
>        on_2 = <optimized out>
>        list = <optimized out>
>        nlist = <optimized out>
>        cp = <optimized out>
>        written = <optimized out>
>#3  0x0000003d31906bd7 in __GI___fortify_fail (msg=msg@entry=0x3d3197b047 "buffer overflow detected") at fortify_fail.c:31
>No locals.
>#4  0x0000003d31904dc0 in __GI___chk_fail () at chk_fail.c:28
>No locals.
>#5  0x000000000040520b in strcpy (__src=0x7fff21b70a62 "", __dest=0x7fff21b72660 "xml version=\"1.0\" encoding=\"utf-8\" ?>\r\n<cmd xmlns:ivec=\"http://www.canon.com/ns/cmd/2008/07/common/\"\r\nxmlns:cijn=\"http://www.canon.com/ns/wdp/2008/01/print/\">\r\n\t<ivec:contents>\r\n\t\t<ivec:operation>GetS"...) at /usr/include/bits/string3.h:104
>No locals.
>#6  parse_status_to_paperout (len=15423, status_str=status_str@entry=0x7fff21b72aa2 "xml version=\"1.0\" encoding=\"utf-8\" ?>\r\n<cmd xmlns:ivec=\"http://www.canon.com/ns/cmd/2008/07/common/\"\r\nxmlns:cijn=\"http://www.canon.com/ns/wdp/2008/01/print/\">\r\n\t<ivec:contents>\r\n\t\t<ivec:operation>GetS"...) at bjnp-commands.c:41
>        s = "xml version=\"1.0\" encoding=\"utf-8\" ?>\r\n<cmd xmlns:ivec=\"http://www.canon.com/ns/cmd/2008/07/common/\"\r\nxmlns:cijn=\"http://www.canon.com/ns/wdp/2008/01/print/\">\r\n\t<ivec:contents>\r\n\t\t<ivec:operation>GetS"...
>        tok = <optimized out>
>        status = 0
>#7  0x000000000040565b in bjnp_get_paper_status (addr=addr@entry=0x27a9d00) at bjnp-commands.c:273
>        cmd = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}, udp_discover = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}}, udp_job_details = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}, unknown = "\000\000\000\000\000\000\000", hostname = '\000' <repeats 63 times>, username = '\000' <repeats 63 times>, jobtitle = '\000' <repeats 255 times>}, udp_close = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}}, tcp_print = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}, data = '\000' <repeats 4095 times>}, udp_get_status = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}}, udp_get_id = {header = {BJNP_id = "BJNP", dev_type = 1 '\001', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 0}}}
>        response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}, udp_discover_response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}, unknown1 = "<?xm", mac_len = 108 'l', addr_len = 32 ' ', mac_addr = "versio", addresses = {ipv4 = {ipv4_addr = "n=\"1"}, ipv6 = {ipv6_addr = {"n=\"1.0\" encoding", "=\"utf-8\" ?>\r\n<cm", "d xmlns:ivec=\"ht", "tp://www.canon.c", "om/ns/cmd/2008/0", "7/common/\"\r\nxmln", "s:cijn=\"http://w", "ww.canon.com/ns/"}}}}, udp_print_job_details_response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}}, udp_close_response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}}, tcp_print_response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}, accepted = 1836597052}, udp_status_response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}, status_len = 16188, status = "xml version=\"1.0\" encoding=\"utf-8\" ?>\r\n<cmd xmlns:ivec=\"http://www.canon.com/ns/cmd/2008/07/common/\"\r\nxmlns:cijn=\"http://www.canon.com/ns/wdp/2008/01/print/\">\r\n\t<ivec:contents>\r\n\t\t<ivec:operation>GetS"...}, udp_identity_response = {header = {BJNP_id = "BJNP", dev_type = 129 '\201', cmd_code = 32 ' ', unknown1 = 0, seq_no = 25600, session_id = 0, payload_len = 335806464}, id_len = 16188, id = "xml version=\"1.0\" encoding=\"utf-8\" ?>\r\n<cmd xmlns:ivec=\"http://www.canon.com/ns/cmd/2008/07/common/\"\r\nxmlns:cijn=\"http://www.canon.com/ns/wdp/2008/01/print/\">\r\n\t<ivec:contents>\r\n\t\t<ivec:operation>GetS"...}, fillers = "BJNP\201 \000\000\000d\000\000\000\000\004\024<?xml version=\"1.0\" encoding=\"utf-8\" ?>\r\n<cmd xmlns:ivec=\"http://www.canon.com/ns/cmd/2008/07/common/\"\r\nxmlns:cijn=\"http://www.canon.com/ns/wdp/2008/01/print/\">\r\n\t<ivec:contents>\r\n\t\t<i"...}
>        resp_len = <optimized out>
>#8  0x0000000000402830 in bjnp_backendRunLoop (print_fd=print_fd@entry=0, device_fd=device_fd@entry=6, addr=addr@entry=0x27a9d00) at bjnp-runloop.c:344
>        send_keep_alive = 0
>        nfds = 7
>        input = {__fds_bits = {64, 0 <repeats 15 times>}}
>        output = {__fds_bits = {0 <repeats 16 times>}}
>        print_bytes = 4096
>        total_bytes = 376832
>        bytes = 0
>        result = <optimized out>
>        paperout = 0
>        ack_pending = <optimized out>
>        offline = 0
>        draining = 0
>        print_buffer = "p\r^(%vo\374p\377^&*op\034[[%op\036oop^\036][\f[[v\036]v%'ZT[\t[\n\036Z[\036\036[\t\375TS[\036[\036]U\036TT\003\036\034\003\tTR\t\003\034\n\036\t\n\003\036T\034\034\tT\034\033TR\001\000R\001\t\001\000Z\034\001\003\003\000T\000\tQR\000T\t\034\t\033\033R\000\000\t\001\000\003\t\000\001\000\t\tQ\033\000\003\t\000\000Q\000R\tQ\375\000\002\t\000\033\376\000\006\003\000\000\033\001\000Q\200\360\000;,\227\315\227\323\324\203\202\326\225\203\227\203\315\235\315\225}\225\236\227\227\205\227\225\315\203|\224\224\313Dzy\323\202\312\315\202|\312\313"...
>        print_ptr = 0x7fff21b750a0 "p\r^(%vo\374p\377^&*op\034[[%op\036oop^\036][\f[[v\036]v%'ZT[\t[\n\036Z[\036\036[\t\375TS[\036[\036]U\036TT\003\036\034\003\tTR\t\003\034\n\036\t\n\003\036T\034\034\tT\034\033TR\001"
>        timeout = {tv_sec = 2, tv_usec = 995035}
>        side_channel_open = 1
>        command = CUPS_SC_CMD_NONE
>        status = CUPS_SC_STATUS_NONE
>        data = '\000' <repeats 4232 times>...
>        datalen = 0
>        model = '\000' <repeats 63 times>
>        dev_id = '\000' <repeats 1023 times>
>#9  0x0000000000401ffa in main (argc=<optimized out>, argv=<optimized out>) at bjnp.c:398
>        method = "bjnp\000\000\000\000\004\000\000\000\004\000\000\000\310\001\000\000\000\000\000\000\310\001\300\062=\000\000\000\310\001\300\062=\000\000\000$\000\000\000\000\000\000\000$\000\000\000\000\000\000\000\004\000\000\000\000\000\000\000P\345td\004\000\000\000 \367\001\000\000\000\000\000 \367\301\062=\000\000\000 \367\301\062=\000\000\000\364\b\000\000\000\000\000\000\364\b\000\000\000\000\000\000\004\000\000\000\000\000\000\000Q\345td\006", '\000' <repeats 43 times>, "\b\000\000\000\000\000\000\000R\345td\004\000\000\000\340\071\002\000\000\000\000\000\340\071\342\062=\000\000\000"...
>        hostname = "192.168.0.15\000\000\000\000\001\000\000\000\377\177\000\000\000\373\023\301z\177\000\000\260\335\270!\377\177\000\000poa6=\000\000\000\370l$8=\000\000\000b\320@1=\000\000\000\001\000\000\000\377\177\000\000\060\365\023\301z\177\000\000\340\335\270!\377\177\000\000\230O\241\062=\000\000\000\060\315\240\071=\000\000\000b\320@1=\000\000\000\001\000\000\000\377\177\000\000\000\360\023\301z\177\000\000\020\336\270!\377\177\000\000\230^p2=\000\000\000\230}@M=\000\000\000b\320@1=\000\000\000\001\000\000\000\377\177\000\000\230\a\024\301z\177\000\000@\336\270!\377\177\000\000\250\277\200\062\065\000\000\000\270\375\000\063\065\000\000\000"...
>        username = "\000Q\204\255c3qp\a\"X\177\000\000\000\000a\000\000\000 \000\000\000\020\000\000\000\n\000\000\000\000\001\242\002 @ \301\230 (\204@\000\001\000(\004\b\200\000\202\005\000\006\000\000\202\000\000 \000\000\"\000R@\002\004\201\021Ph\241H\205B \000\b\300\200P\000\210\204\000\200T\n\022\210\000\004A\004\000\000\000@\200\000`8T\000\300\000@\000\200\240\020`\214\020\a\243@\000\031\020E\002P\003 \000 \006\002 \000 l\024P\000\303 \340\000\310\b\000\024\004@\020\004\t\000 \002\300\000C0 \000\000\000\"", '\000' <repeats 11 times>, "#\000\000\000\000\000\000\000$\000\000\000\000\000\000\000&", '\000' <repeats 11 times>...
>        resource = "/\000\024\301z\177\000\000(\253\026\301z\177\000\000\000\000\000\000\000\000\000\000(\253\026\301z\177\000\000\230\tb1=\000\000\000\244\223@1=\000\000\000\240)\024\301z\177\000\000`\341\277!\377\177\000\000\000\000\000\000\000\000\000\000\001\000\000\000\000\000\000\000\000\312\033\260\000\000\000\000\210\233@1=\000\000\000(\253\026\301z\177\000\000p\342\270!\377\177\000\000(o\300\002\000\000\000\000\300\341\277!\377\177\000\000\200\343\270!\377\177\000\000\000\000\000\000\377\177\000\000\250\017b1=", '\000' <repeats 19 times>, "p\344\270!\377\177\000\000\000\027b1=\000\000\000\245\240\227\061=\000\000\000h\342\277!\377\177\000\000"...
>        options = <optimized out>
>        value = <optimized out>
>        sep = <optimized out>
>        print_fd = 0
>        copies = 0
>        start_time = <optimized out>
>        recoverable = <optimized out>
>        contimeout = 604800
>        port = 8611
>        portname = "8611\000\000\000\000\066\000\000\000\070\000\000\000:\000\000\000>\000\000\000?\000\000\000@", '\000' <repeats 11 times>, "B", '\000' <repeats 11 times>, "C\000\000\000x\344\270!\377\177\000\000\320\344\270!\377\177\000\000\001\000\000\000\000\000\000\000\320\341\270!\377\177\000\000h\345\023\301z\177\000\000\205\033\300\062=\000\000\000b\311@1=\000\000\000\250\017b1=\000\000\000\244\361@1=\000\000\000\250\017b1=\000\000\000p\344\270!\377\177\000\000h\344\270!\377\177\000\000`\344\270!\377\177\000\000\060\311@1=\000\000\000x\344\270!\377\177\000\000\250\017b1=", '\000' <repeats 11 times>, "h\344\270!\377\177\000\000\000\000\000\000\000\000\000\000"...
>        delay = <optimized out>
>        device_fd = <optimized out>
>        error = <optimized out>
>        i = <optimized out>
>        addrlist = 0x27a9bf0
>        addr = 0x27a9d00
>        addrname = "192.168.0.15\000C\376\377\000\000\020\343\201bz\000\001\000\000\000\000\000\000\000\320\341\270!\377\177\000\000`\335\270!\377\177\000\000b\335\270!\377\177\000\000e\221A1=\000\000\000\000\000\020\343\201bz\000\240\353\023\301z\177\000\000\001\000\000\000\000\000\000\000\320\344\270!\377\177\000\000\023\000\000\000\000\000\000\000\363\324@1=\000\000\000\000\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000\001\000z\177\000\000G\335@1=\000\000\000\001\000\000\000\377\177\000\000h\345\023\301z\177", '\000' <repeats 12 times>...
>        tbytes = 0
>        bjnp_debugstr = <optimized out>
>From                To                  Syms Read   Shared Object Library
>0x000000390ac1a140  0x000000390ac5cf48  Yes         /lib64/libcups.so.2
>0x0000003d3181f560  0x0000003d31960cc4  Yes         /lib64/libc.so.6
>0x0000003d3900bd10  0x0000003d3903bd44  Yes         /lib64/libgssapi_krb5.so.2
>0x0000003d3a4251a0  0x0000003d3a48757c  Yes         /lib64/libkrb5.so.3
>0x0000003d38c048b0  0x0000003d38c247d8  Yes         /lib64/libk5crypto.so.3
>0x0000003d38801570  0x0000003d38802154  Yes         /lib64/libcom_err.so.2
>0x00000039070183c0  0x0000003907052250  Yes         /lib64/libssl.so.10
>0x0000003906c69c40  0x0000003906d5a4f8  Yes         /lib64/libcrypto.so.10
>0x0000003532603530  0x000000353260869c  Yes         /lib64/libavahi-common.so.3
>0x0000003532e039d0  0x0000003532e0bc38  Yes         /lib64/libavahi-client.so.3
>0x0000003d320059f0  0x0000003d32011614  Yes         /lib64/libpthread.so.0
>0x0000003d32405890  0x0000003d32474bb8  Yes         /lib64/libm.so.6
>0x0000003d4d200ed0  0x0000003d4d20598c  Yes         /lib64/libcrypt.so.1
>0x0000003d32802210  0x0000003d3280e930  Yes         /lib64/libz.so.1
>0x0000003d31400b10  0x0000003d31419cb0  Yes         /lib64/ld-linux-x86-64.so.2
>0x0000003d39803620  0x0000003d39809f8c  Yes         /lib64/libkrb5support.so.0
>0x0000003d31c00ed0  0x0000003d31c019d0  Yes         /lib64/libdl.so.2
>0x0000003d3a0015b0  0x0000003d3a0021cc  Yes         /lib64/libkeyutils.so.1
>0x0000003d36403a40  0x0000003d3641281c  Yes         /lib64/libresolv.so.2
>0x0000003d38007ab0  0x0000003d38031a54  Yes         /lib64/libdbus-1.so.3
>0x0000003d4de03d00  0x0000003d4de582f0  Yes         /lib64/libfreebl3.so
>0x0000003d334064a0  0x0000003d33418fe4  Yes         /lib64/libselinux.so.1
>0x0000003d33c022d0  0x0000003d33c050cc  Yes         /lib64/librt.so.1
>0x0000003d33801770  0x0000003d3384b8d8  Yes         /lib64/libpcre.so.1
>0x0000003d32c030e0  0x0000003d32c19060  Yes         /lib64/liblzma.so.5
>0x0000003d33002af0  0x0000003d33012218  Yes         /lib64/libgcc_s.so.1
>$1 = 0x7f7ac1169000 ""
>No symbol "__glib_assert_msg" in current context.
>rax            0x0	0
>rbx            0x41	65
>rcx            0xffffffffffffffff	-1
>rdx            0x6	6
>rsi            0x667b	26235
>rdi            0x667b	26235
>rbp            0x7fff21b72610	0x7fff21b72610
>rsp            0x7fff21b722f8	0x7fff21b722f8
>r8             0x3d319733e0	262824997856
>r9             0x405924	4217124
>r10            0x8	8
>r11            0x206	518
>r12            0x7fff21b72480	140733759038592
>r13            0x5	5
>r14            0x41	65
>r15            0x5	5
>rip            0x3d31835c59	0x3d31835c59 <__GI_raise+57>
>eflags         0x206	[ PF IF ]
>cs             0x33	51
>ss             0x2b	43
>ds             0x0	0
>es             0x0	0
>fs             0x0	0
>gs             0x0	0
>st0            *value not available*
>st1            *value not available*
>st2            *value not available*
>st3            *value not available*
>st4            *value not available*
>st5            *value not available*
>st6            *value not available*
>st7            *value not available*
>fctrl          *value not available*
>fstat          *value not available*
>ftag           *value not available*
>fiseg          *value not available*
>fioff          *value not available*
>foseg          *value not available*
>fooff          *value not available*
>fop            *value not available*
>xmm0           *value not available*
>xmm1           *value not available*
>xmm2           *value not available*
>xmm3           *value not available*
>xmm4           *value not available*
>xmm5           *value not available*
>xmm6           *value not available*
>xmm7           *value not available*
>xmm8           *value not available*
>xmm9           *value not available*
>xmm10          *value not available*
>xmm11          *value not available*
>xmm12          *value not available*
>xmm13          *value not available*
>xmm14          *value not available*
>xmm15          *value not available*
>mxcsr          *value not available*
>Dump of assembler code for function __GI_raise:
>   0x0000003d31835c20 <+0>:	mov    %fs:0x2d4,%eax
>   0x0000003d31835c28 <+8>:	mov    %eax,%ecx
>   0x0000003d31835c2a <+10>:	mov    %fs:0x2d0,%esi
>   0x0000003d31835c32 <+18>:	test   %esi,%esi
>   0x0000003d31835c34 <+20>:	jne    0x3d31835c68 <__GI_raise+72>
>   0x0000003d31835c36 <+22>:	mov    $0xba,%eax
>   0x0000003d31835c3b <+27>:	syscall 
>   0x0000003d31835c3d <+29>:	mov    %eax,%ecx
>   0x0000003d31835c3f <+31>:	mov    %eax,%fs:0x2d0
>   0x0000003d31835c47 <+39>:	mov    %eax,%esi
>   0x0000003d31835c49 <+41>:	movslq %edi,%rdx
>   0x0000003d31835c4c <+44>:	movslq %esi,%rsi
>   0x0000003d31835c4f <+47>:	movslq %ecx,%rdi
>   0x0000003d31835c52 <+50>:	mov    $0xea,%eax
>   0x0000003d31835c57 <+55>:	syscall 
>=> 0x0000003d31835c59 <+57>:	cmp    $0xfffffffffffff000,%rax
>   0x0000003d31835c5f <+63>:	ja     0x3d31835c7a <__GI_raise+90>
>   0x0000003d31835c61 <+65>:	repz retq 
>   0x0000003d31835c63 <+67>:	nopl   0x0(%rax,%rax,1)
>   0x0000003d31835c68 <+72>:	test   %eax,%eax
>   0x0000003d31835c6a <+74>:	jg     0x3d31835c49 <__GI_raise+41>
>   0x0000003d31835c6c <+76>:	mov    %eax,%ecx
>   0x0000003d31835c6e <+78>:	neg    %ecx
>   0x0000003d31835c70 <+80>:	test   $0x7fffffff,%eax
>   0x0000003d31835c75 <+85>:	cmove  %esi,%ecx
>   0x0000003d31835c78 <+88>:	jmp    0x3d31835c49 <__GI_raise+41>
>   0x0000003d31835c7a <+90>:	mov    0x3821b7(%rip),%rdx        # 0x3d31bb7e38
>   0x0000003d31835c81 <+97>:	neg    %eax
>   0x0000003d31835c83 <+99>:	mov    %eax,%fs:(%rdx)
>   0x0000003d31835c86 <+102>:	or     $0xffffffffffffffff,%rax
>   0x0000003d31835c8a <+106>:	retq   
>End of assembler dump.

Actions: View

Attachments on bug 1056222: 853392 | 853393 | 853394 | 853395 | 853396 | 853397 | 853398 | 853399 | 853400 | 853401 | 853746