Bug 1807751

Summary: [abrt] sane-backends: std::__replacement_assert(): scanimage killed by SIGABRT
Product: [Fedora] Fedora Reporter: Matthias Runge <mrunge>
Component: sane-backendsAssignee: Nils Philippsen <nphilipp>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 31CC: ajhajj, nphilipp, thibault.north, zdohnal
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/1f70c590886aa7107339d31b389c230c0ac7f917
Whiteboard: abrt_hash:45ce67114288ac199727bd0e6db5659b4b230cb5;VARIANT_ID=workstation;
Fixed In Version: sane-backends-1.0.29-6.fc31 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-04-03 19:15:44 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: core_backtrace
none
File: cpuinfo
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: mountinfo
none
File: open_fds
none
File: proc_pid_status none

Description Matthias Runge 2020-02-27 06:50:29 UTC 
Description of problem:
scanimage -L

->

 device `genesys:libusb:001:008' is a Canon LiDE 60 flatbed scanner


scanimage -d genesys:libusb:001:008 --format=png -o scan.png

->

/usr/include/c++/9/bits/stl_vector.h:1060: std::vector<_Tp, _Alloc>::const_reference std::vector<_Tp, _Alloc>::operator[](std::vector<_Tp, _Alloc>::size_type) const [with _Tp = short unsigned int; _Alloc = std::allocator<short unsigned int>; std::vector<_Tp, _Alloc>::const_reference = const short unsigned int&; std::vector<_Tp, _Alloc>::size_type = long unsigned int]: Assertion '__builtin_expect(__n < this->size(), true)' failed.
Aborted (core dumped)

Version-Release number of selected component:
sane-backends-1.0.29-4.fc31

Additional info:
reporter:       libreport-2.12.0
backtrace_rating: 4
cgroup:         0::/user.slice/user-1000.slice/user/gnome-terminal-server.service
cmdline:        scanimage -d genesys:libusb:001:008 --format=png -o scan.png
crash_function: std::__replacement_assert
executable:     /usr/bin/scanimage
journald_cursor: s=0edfd33be8cd4c33b94d55e7d7b3a96b;i=2ddbe;b=f44a087dc04e43d78c900ec7d3aa2987;m=3c550163f3;t=59f88f7d70c18;x=1ce8b2b4499732cf
kernel:         5.5.5-200.fc31.x86_64
rootdir:        /
runlevel:       N 5
type:           CCpp
uid:            1000
Comment 1 Matthias Runge 2020-02-27 06:50:33 UTC 
Created attachment 1666125 [details]
File: backtrace
Comment 2 Matthias Runge 2020-02-27 06:50:35 UTC 
Created attachment 1666126 [details]
File: core_backtrace
Comment 3 Matthias Runge 2020-02-27 06:50:36 UTC 
Created attachment 1666127 [details]
File: cpuinfo
Comment 4 Matthias Runge 2020-02-27 06:50:37 UTC 
Created attachment 1666128 [details]
File: dso_list
Comment 5 Matthias Runge 2020-02-27 06:50:39 UTC 
Created attachment 1666129 [details]
File: environ
Comment 6 Matthias Runge 2020-02-27 06:50:40 UTC 
Created attachment 1666130 [details]
File: limits
Comment 7 Matthias Runge 2020-02-27 06:50:42 UTC 
Created attachment 1666131 [details]
File: maps
Comment 8 Matthias Runge 2020-02-27 06:50:43 UTC 
Created attachment 1666132 [details]
File: mountinfo
Comment 9 Matthias Runge 2020-02-27 06:50:45 UTC 
Created attachment 1666133 [details]
File: open_fds
Comment 10 Matthias Runge 2020-02-27 06:50:46 UTC 
Created attachment 1666134 [details]
File: proc_pid_status
Comment 11 Matthias Runge 2020-02-27 07:00:20 UTC 
*** Bug 1807749 has been marked as a duplicate of this bug. ***
Comment 12 Zdenek Dohnal 2020-03-02 16:14:59 UTC 
Unfortunately, I'm not able to reproduce with my scanner which uses Genesys backend.

But the reason why it aborts seems to be clear - genesys backend wants to access vector slope_table at member 255 (because of looping over 'steps' var, which is 256), but its size is only 255 (0-255).

I'll investigate more if creating an bigger vector will not break things.
Comment 13 Matthias Runge 2020-03-03 06:57:06 UTC 
Thank you for looking into this. As mentioned before, sane-backends-1.0.28 does not have this issue.
Comment 14 Zdenek Dohnal 2020-03-03 17:12:47 UTC 
(In reply to Zdenek Dohnal from comment #12)
> its size is only 255 (0-254).
> 
254 is max of course...

Matthias found the asic type of scanner - it is GL841.
Comment 15 Zdenek Dohnal 2020-03-03 17:19:10 UTC 
Matthias,

I created testing patch and created testing rpms - would you mind installing them and see if it helps? The link https://koji.fedoraproject.org/koji/taskinfo?taskID=42151429
Comment 16 Matthias Runge 2020-03-03 18:38:18 UTC 
Zdenek,

thank you, I can confirm, the test packages are fixing my issue
Comment 17 Zdenek Dohnal 2020-03-04 14:38:39 UTC 
Sent upstream https://gitlab.com/sane-project/backends/-/merge_requests/346
Comment 18 Zdenek Dohnal 2020-03-20 05:07:19 UTC 
*** Bug 1815210 has been marked as a duplicate of this bug. ***
Comment 19 Fedora Update System 2020-03-23 09:05:18 UTC 
FEDORA-2020-0efa3a9983 has been submitted as an update to Fedora 31. https://bodhi.fedoraproject.org/updates/FEDORA-2020-0efa3a9983
Comment 20 Fedora Update System 2020-03-24 09:40:24 UTC 
FEDORA-2020-0efa3a9983 has been pushed to the Fedora 31 testing repository.
In short time you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2020-0efa3a9983`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2020-0efa3a9983

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
Comment 21 Fedora Update System 2020-04-03 19:15:44 UTC 
FEDORA-2020-0efa3a9983 has been pushed to the Fedora 31 stable repository.
If problem still persists, please make note of it in this bug report.