Bug 1092688 - alpine-2.11-1.fc20 SEGV on specific message
Summary: alpine-2.11-1.fc20 SEGV on specific message
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: alpine
Version: 21
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Joshua Daniel Franklin
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2014-04-29 18:11 UTC by Paul DeStefano
Modified: 2015-07-29 01:56 UTC (History)
6 users (show)

Fixed In Version: alpine-2.20-1.fc21
Clone Of:
Environment:
Last Closed: 2015-07-19 01:57:53 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
specific message (7.89 KB, text/plain)
2014-04-29 18:11 UTC, Paul DeStefano
no flags Details
Another mesg that causes a crash (8.98 KB, text/plain)
2014-06-03 17:00 UTC, Paul DeStefano
no flags Details
make log (82.82 KB, text/plain)
2014-07-11 07:34 UTC, Paul DeStefano
no flags Details
make log from "patch" version of v2.11 (83.49 KB, text/plain)
2014-07-11 17:19 UTC, Paul DeStefano
no flags Details
core file from "patch" version of v2.11 (5.92 MB, application/octet-stream)
2014-07-11 17:22 UTC, Paul DeStefano
no flags Details
second core file from "patch" version of v2.11, (556.65 KB, application/x-xz)
2014-07-11 17:27 UTC, Paul DeStefano
no flags Details

Description Paul DeStefano 2014-04-29 18:11:10 UTC
Created attachment 890878 [details]
specific message

Description of problem:

The following SEGV occurs always when opening a particular file.

Program received signal SIGSEGV, Segmentation fault.
                                 
decode_text (att=att@entry=0x10ba730, msgno=msgno@entry=23, pc=pc@entry=0x48f7e0 <view_writec>, handlesp=handlesp@entry=0x7fffffffbd58, style=style@entry=InLine, flags=<optimized out>, flags@entry=3) at text.c:461 461         if(att->body->subtype

(gdb) bt
#0  decode_text (att=att@entry=0x10ba730, msgno=msgno@entry=23, 
    pc=pc@entry=0x48f7e0 <view_writec>, handlesp=handlesp@entry=0x7fffffffbd58, 
    style=style@entry=InLine, flags=<optimized out>, flags@entry=3) at text.c:461
#1  0x000000000057a1ba in format_body (msgno=msgno@entry=23, 
    body=body@entry=0xe51da0, handlesp=handlesp@entry=0x7fffffffbd58, 
    hp=hp@entry=0x7fffffffbc80, flgs=flgs@entry=3, width=width@entry=85, 
    pc=pc@entry=0x48f7e0 <view_writec>) at mailview.c:455
#2  0x000000000057c512 in format_message (msgno=msgno@entry=23, 
    env=env@entry=0xe66900, body=0xe51da0, handlesp=handlesp@entry=0x7fffffffbd58, 
    flgs=flgs@entry=3, pc=pc@entry=0x48f7e0 <view_writec>) at mailview.c:204
#3  0x000000000049830d in mail_view_screen (ps=0xcef030) at mailview.c:358
#4  0x0000000000409505 in main (argc=<optimized out>, argv=<optimized out>)
    at alpine.c:1362


Version-Release number of selected component (if applicable):
alpine-2.11-1.fc20.x86_64

How reproducible:
Always on particular messasge

Steps to Reproduce:
1. start alpine
2. go to index
3. select mesg
4. ViewMsg

Actual results:
Crash

Expected results:
No crash

Additional info:

Comment 1 Eduardo Chappa 2014-05-04 15:53:25 UTC
Paul,

  This is a very interesting crash. I am running a 32 bit machine and do not see this crash with this message. The crash does not occur on modified code, and the worst thing is that it seems to be happening on a corrupt pointer to body->subtype.

  I will encourage you to compile your own version of Alpine and see if the problem repeats. If it does, please post the backtrace, as usual, but I would also like to see the log of running the "make" command. I'd like to see the warnings that are given during compilation by the compiler.

  Just to give you some encouragement into building your own Alpine, I have seen some bugs, where the same code has crashed in one version (the distributed version) and not in the other (the one built in the local machine), so please try this.

  Thank you.

-- 
Eduardo

Comment 2 Paul DeStefano 2014-05-04 21:14:13 UTC
Hi Eduardo,

Okay, I will do it.  Thanks for the encouragement.  I'm chasing some other Fedora issues right now, so give me a week or two.

-- 
Paul

Comment 3 Paul DeStefano 2014-06-03 17:00:42 UTC
Created attachment 901862 [details]
Another mesg that causes a crash

I haven't had a chance to roll Alpine myself.  But, I will; I haven't forgot.

Comment 4 Eduardo Chappa 2014-06-03 17:39:12 UTC
Paul,

  I understand you can reproduce the problem. I have no doubt about that, but the crash is happening on a pointer that is allocated to static memory, it should not be happening, and what I am asking you to do is to check if the rpm is defective, or if it is Alpine the defective. In order to check that, I am asking you to build your own Alpine. When you do so, please try again, and if the problem happens again, please send me the backtrace, as well as the output of the make command when you build Alpine.

  Thank you.

-- 
Eduardo

Comment 5 Paul DeStefano 2014-07-11 07:34:01 UTC
Hi Eduardo,

  Okay, I finally got around to testing this.  I followed some generic instructions for RPM tools and rebuilt the alpine RPM package from the source RPM.  This version of alpine behaves the same as the one I installed from the Fedora repositories for fc20, which means it crashes on these same messages I've been saving to test.
  I also downloaded your tarball for alpine v2.11.  I just ran configure and make, then ran the binary without installing it.  It did not crash on any of the three files I save for testing.  I will attach the make log you requested after this update.

Comment 6 Paul DeStefano 2014-07-11 07:34:47 UTC
Created attachment 917261 [details]
make log

Comment 7 Eduardo Chappa 2014-07-11 16:37:03 UTC
Hi Paul,

  May I ask for one more favor. Could you try

http://patches.freeiz.com/alpine/patches/alpine-2.11/alpine-2.11.tar.lzma

and let me know if the problem repeats with that specific version of Alpine? I think this is the one RedHat distributes, and would like to see if you can repeat the problem using the "./configure && make" method.

  Thanks!

-- 
Eduardo

Comment 8 Paul DeStefano 2014-07-11 17:18:18 UTC
Sure.

Yes!  It does crash.  And, fortunately, I got a corefile from it.  I still don't understand why corefiles are so hard to come by these days.  I'll attached the make log and core.

Comment 9 Paul DeStefano 2014-07-11 17:19:47 UTC
Created attachment 917393 [details]
make log from "patch" version of v2.11

Comment 10 Paul DeStefano 2014-07-11 17:22:32 UTC
Created attachment 917394 [details]
core file from "patch" version of v2.11

Comment 11 Paul DeStefano 2014-07-11 17:27:01 UTC
Created attachment 917395 [details]
second core file from "patch" version of v2.11,

This corefile is different that the previous one.  It is from trying to open an eariler "bad" message and the crash behavior was slightly different than the one I uploaded first.  The third test mesg I tried caused a crash like this one, too.

Comment 12 Paul DeStefano 2014-10-15 04:08:50 UTC
After working with Edwardo, further, we have determined that this problem appears to be specific to the x86_64 bit target and may not/is not observed on 32-bit systems.

Comment 13 Eduardo Chappa 2015-01-17 02:30:41 UTC
Paul,

  Thank you for sharing your .pinerc with me. It helped me reproduce the problem, which only occurs with the patched version of Alpine. The problem was in code that tried to detect if a long url has been atificially folded across several lines. I believe that the problem has been solved, but not in version 2.11, but for the *patched* version 2.20 (I just solved it two days ago when I was getting ready to release version 2.20, so I tested everything with the new version, not the old one.)

  Thank you so much for helping me debug this issue. I hope the new version will solve all the issues you have reported, otherwise, please let me know how may I help you.

  Thank you.

Comment 14 Paul DeStefano 2015-01-19 05:03:14 UTC
Hi Eduardo,

That's great news!  Thank you very much for your (continued) hard work and for your patience with me.  I'm glad my config was helpful.

And I'm excited this patch made it into a brand new release of Alpine.  I've downloaded it and I aim to compile it myself as you suggest.

Comment 15 Paul DeStefano 2015-01-19 08:59:09 UTC
This problem still occurs with alpine-2.11-3.fc21.x86_64.  So, I'm bumping this bug.

Also, I can also report that the problem is not present in Alpine 2.20 just released.

Comment 16 Fedora Update System 2015-07-07 01:36:21 UTC
alpine-2.20-1.fc22 has been submitted as an update for Fedora 22.
https://admin.fedoraproject.org/updates/alpine-2.20-1.fc22

Comment 17 Joshua Daniel Franklin 2015-07-07 01:42:00 UTC
Hi, 

Please try the alpine-2.20-1 package and vote if it works for you, to give karma.

Comment 18 Fedora Update System 2015-07-07 22:25:54 UTC
alpine-2.20-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/alpine-2.20-1.fc21

Comment 19 Fedora Update System 2015-07-07 22:42:00 UTC
alpine-2.20-1.el6 has been submitted as an update for Fedora EPEL 6.
https://admin.fedoraproject.org/updates/alpine-2.20-1.el6

Comment 20 Fedora Update System 2015-07-08 17:07:42 UTC
Package alpine-2.20-1.el6:
* should fix your issue,
* was pushed to the Fedora EPEL 6 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=epel-testing alpine-2.20-1.el6'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-EPEL-2015-7050/alpine-2.20-1.el6
then log in and leave karma (feedback).

Comment 21 Fedora Update System 2015-07-19 01:57:53 UTC
alpine-2.20-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 22 Fedora Update System 2015-07-23 19:11:26 UTC
alpine-2.20-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 23 Fedora Update System 2015-07-29 01:56:01 UTC
alpine-2.20-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.