Bug 505967

Summary:	vino crashes repeatedly
Product:	[Fedora] Fedora	Reporter:	Jonathan Kamens <jik>
Component:	vino	Assignee:	Søren Sandmann Pedersen <sandmann>
Status:	CLOSED RAWHIDE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	low
Version:	rawhide	CC:	kem, mmilgram, sandmann
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2009-07-29 02:21:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jonathan Kamens 2009-06-15 01:02:17 UTC

With current rawhide (vino-2.26.1-2.fc12.i586), /usr/libexec/vino-server crashes over and over again.  I get bug buddy reports over and over and over again.

I debugged it and found that it's crashing with a fortify error at line 349 of server/libvncserver/main.c, inside a call to gethostname, but as far as I can tell there's nothing wrong with the arguments to gethostname.  However, when I dig down deeper in the stack inside the call to gethostname, it looks like the values that the fortify checking code are getting are different from what's actually being past.

I downloaded the srpm and rebuilt and encountered the same issue.  Then I rebuilt again, this time removing -O2 from the compiler flags, and the problem went away.  So I have to suspect a compiler bug of some sort.

Comment 1 Marc Milgram 2009-06-17 15:48:54 UTC

I ran into the same problem.  I have a bunch of the debug-info files loaded.  Here is the important part of the bug-buddy report:

#7  0x0000003f9d27005d in __libc_message (do_abort=2,
    fmt=0x7fff57eff1d0 "a025b7e000-7fa025b8a000 r-xp 00000000 fd:03 27555", ' ' <repeats 22 times>, "/lib64/libnss_files-2.10.1.so\n7fa025b8a000-7fa025d89000 ---p 0000c000 fd:03 27555", ' ' <repeats 22 times>, "/lib64/libnss_files-2.10.1"...) at ../sysdeps/unix/sysv/linux/libc_fatal.c:170
#8  0x0000003f9d2f7537 in *__GI___fortify_fail (
    msg=0x3f9d33436f "buffer overflow detected") at fortify_fail.c:32
#9  0x0000003f9d2f5590 in *__GI___chk_fail () at chk_fail.c:29
#10 0x0000003f9d2f6d77 in __gethostname_chk (
    buf=0x8ee <Address 0x8ee out of bounds>, buflen=2286, nreal=6)
    at gethostname_chk.c:26
#11 0x0000000000415d5e in gethostname (__buflen=<value optimized out>,
    __buf=<value optimized out>) at /usr/include/bits/unistd.h:353
#12 rfbGetScreen (__buflen=<value optimized out>, __buf=<value optimized out>)
    at main.c:349
#13 0x000000000040f7ad in vino_server_init_from_screen (
    screen=<value optimized out>, server=<value optimized out>)
    at vino-server.c:947
#14 vino_server_set_property (screen=<value optimized out>,
    server=<value optimized out>) at vino-server.c:1120
#15 0x00007fffffffffff in ?? ()
#16 0x0000003507c18804 in param_object_validate (pspec=<value optimized out>,
    value=0x751fc0) at gparamspecs.c:985
#17 0x00000000006e2150 in ?? ()
#18 0x00000000006de4e0 in ?? ()
#19 0x0000000000751f80 in ?? ()
#20 0x00007fff57effaa0 in ?? ()
#21 0x0000000000000003 in ?? ()
#22 0x0000000000751880 in ?? ()
#23 0x0000000000747000 in ?? ()
#24 0x000000000074dd20 in ?? ()
#25 0x0000003507c1134d in object_set_property (nqueue=<value optimized out>,
    value=<value optimized out>, pspec=<value optimized out>,
    object=<value optimized out>) at gobject.c:942
#26 g_object_constructor (nqueue=<value optimized out>,
    value=<value optimized out>, pspec=<value optimized out>,
    object=<value optimized out>) at gobject.c:1352
#27 0x0000003507c11cb6 in IA__g_object_newv (
    object_type=<value optimized out>, n_parameters=13,
    parameters=<value optimized out>) at gobject.c:1215
#28 0x0000003507c12721 in IA__g_object_new_valist (object_type=7657456,
    first_property_name=0x0, var_args=0x7fff57effd10) at gobject.c:1319
#29 0x0000003507c1298c in IA__g_object_new (object_type=7657456,
    first_property_name=0x42a215 "prompt-enabled") at gobject.c:1060
#30 0x000000000040cebe in vino_prefs_create_server (screen=0x6e2150)
    at vino-prefs.c:477
#31 0x000000000040b8a5 in main (argc=<value optimized out>,
    argv=<value optimized out>) at vino-main.c:108