Bug 1053931

Summary: [abrt] claws-mail: malloc crash from within _cairo_xlib_surface_create_internal(): claws-mail killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Jon Richter <almereyda+bugzillaredhat>
Component: claws-mailAssignee: Andreas Bierfert <andreas.bierfert>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 20CC: almereyda+bugzillaredhat, andreas.bierfert, bugs.michael
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/12d6311c94e04716d7a3163a0fd161a5d3fa40c2
Whiteboard: abrt_hash:51ecafa26c885ccc0a7a956fecb44cc538177f8b
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-06-11 19:25:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Jon Richter 2014-01-16 02:07:29 UTC 
Version-Release number of selected component:
claws-mail-3.9.3-1.fc20

Additional info:
reporter:       libreport-2.1.11
backtrace_rating: 4
cmdline:        claws-mail
crash_function: _cairo_xlib_surface_create_internal
executable:     /usr/bin/claws-mail
kernel:         3.12.6-300.fc20.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #2 _cairo_xlib_surface_create_internal at cairo-xlib-surface.c:1771
 #3 _cairo_xlib_surface_create_similar at cairo-xlib-surface.c:321
 #4 _cairo_surface_create_scratch at cairo-surface.c:877
 #5 surface_source at cairo-xlib-source.c:1006
 #6 _cairo_xlib_source_create_for_pattern at cairo-xlib-source.c:1141
 #7 composite_aligned_boxes at cairo-traps-compositor.c:1292
 #8 clip_and_composite_boxes at cairo-traps-compositor.c:1786
 #9 _cairo_traps_compositor_fill at cairo-traps-compositor.c:2231
 #10 _cairo_compositor_fill at cairo-compositor.c:203
 #11 _cairo_xlib_surface_fill at cairo-xlib-surface.c:1646
Comment 1 Jon Richter 2014-01-16 02:07:40 UTC 
Created attachment 850783 [details]
File: backtrace
Comment 2 Jon Richter 2014-01-16 02:07:43 UTC 
Created attachment 850784 [details]
File: cgroup
Comment 3 Jon Richter 2014-01-16 02:08:04 UTC 
Created attachment 850785 [details]
File: core_backtrace
Comment 4 Jon Richter 2014-01-16 02:08:10 UTC 
Created attachment 850786 [details]
File: dso_list
Comment 5 Jon Richter 2014-01-16 02:08:16 UTC 
Created attachment 850787 [details]
File: environ
Comment 6 Jon Richter 2014-01-16 02:08:20 UTC 
Created attachment 850788 [details]
File: exploitable
Comment 7 Jon Richter 2014-01-16 02:08:27 UTC 
Created attachment 850789 [details]
File: limits
Comment 8 Jon Richter 2014-01-16 02:08:35 UTC 
Created attachment 850790 [details]
File: maps
Comment 9 Jon Richter 2014-01-16 02:08:39 UTC 
Created attachment 850791 [details]
File: open_fds
Comment 10 Jon Richter 2014-01-16 02:08:55 UTC 
Created attachment 850792 [details]
File: proc_pid_status
Comment 11 Jon Richter 2014-01-16 02:09:01 UTC 
Created attachment 850793 [details]
File: var_log_messages
Comment 12 Michael Schwendt 2014-01-16 08:48:25 UTC 
#1  0x00007f83c1b6a00c in __GI___libc_malloc (bytes=816) at malloc.c:2859

Memory corruption somewhere [earlier], with the crash in Cairo likely only being a side-effect.

If you don't have any ideas about reproducibility, not much can be done about it.
Comment 13 Michael Schwendt 2014-05-01 14:43:39 UTC 
> Architecture 	Count
> x86_64 	1


Since you've not entered any details about reproducibility, there is nothing that can be done about this crash.

Please note that a few key details are needed almost always (unless the backtrace points at exactly the place where it can be concluded what has gone wrong). Is the crash reproducible? And how? If it isn't, how often has it crashed?

A couple of crashes of Claws Mail are just side-effects (caused by memory corruption and/or race conditions letting the code work with pointers to freed data), i.e. it can crash in arbitrary places. Recently, there have been several bug-fixes upstream that will stop some of those side-effects.
Comment 14 Michael Schwendt 2014-05-27 06:49:58 UTC 
A new release of Claws Mail (and its dependency libetpan) is available for testing with Fedora 20 and Fedora 19:

  https://admin.fedoraproject.org/updates/search/claws

Please allow for the time it takes for the packages to show up in the "updates-testing" repository and then to be picked up by the world-wide download mirror servers.