Bug 1248944 - Curl_add_buffer_free(): free(): invalid pointer
Summary: Curl_add_buffer_free(): free(): invalid pointer
Keywords:
Status: CLOSED DUPLICATE of bug 1248389
Alias: None
Product: Fedora
Classification: Fedora
Component: curl
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Kamil Dudka
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-07-31 07:55 UTC by Harald Hoyer
Modified: 2015-07-31 08:30 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-07-31 08:30:18 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Harald Hoyer 2015-07-31 07:55:25 UTC
$ rpm -q PackageKit
PackageKit-1.0.7-1.fc23.x86_64
$ rpm -qf /lib64/libcurl.so.4
libcurl-7.43.0-2.fc24.x86_64


$ pkcon install rolekit
Resolving                     [=========================]         
Loading cache                 [=========================]         
Testing changes               [=========================]         
Finished                      [                         ] (0%)  
The following packages have to be downgraded:
 firewalld-filesystem-0.3.13-1.fc22.noarch	Firewalld directory layout and rpm macros
The following packages have to be installed:
 firewalld-0.3.13-1.fc22.noarch	A firewall daemon with D-Bus interface providing a dynamic firewall
 python-futures-2.1.6-3.fc21.noarch	Backport of the concurrent.futures package from Python 3.2
 firewalld-config-standard-0.3.13-1.fc22.noarch	Firewalld standard configuration settings
Proceed with changes? [N/y] y

                              [=========================]         
Installing                    [=========================]         
Waiting for authentication    [=========================]         
Querying                      [=========================]         
Downloading packages          [====                     ] (18%)  The daemon crashed mid-transaction!


packagekitd[17125]: *** Error in `/usr/libexec/packagekitd': free(): invalid pointer: 0x00007f5a7c27b240 ***


$ sudo coredumpctl gdb
(gdb) bt
#0  0x00007f5a9156cbb8 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55
#1  0x00007f5a9156e7ba in __GI_abort () at abort.c:89
#2  0x00007f5a915b12ba in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f5a916c8e20 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
#3  0x00007f5a915b997a in _int_free (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7f5a916c52b5 "free(): invalid pointer", action=3) at malloc.c:5000
#4  0x00007f5a915b997a in _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3861
#5  0x00007f5a915bd4ec in __GI___libc_free (mem=<optimized out>) at malloc.c:2962
#6  0x00007f5a86963a0e in http_disconnect (buff=0x7f5a75b955c0) at http.c:1056
#7  0x00007f5a86963a0e in http_disconnect (conn=<optimized out>, dead_connection=<optimized out>) at http.c:176
#8  0x00007f5a869750c1 in Curl_disconnect (conn=conn@entry=0x7f5a75cc1700, dead_connection=dead_connection@entry=true) at url.c:2761
#9  0x00007f5a869751d4 in disconnect_if_dead (conn=0x7f5a75cc1700, data=0x7f5a75cb7fe0) at url.c:3044
#10 0x00007f5a86975209 in call_disconnect_if_dead (conn=<optimized out>, param=<optimized out>) at url.c:3060
#11 0x00007f5a869a5962 in Curl_conncache_foreach (connc=<optimized out>, param=param@entry=0x7f5a75cb7fe0, func=func@entry=
    0x7f5a86975200 <call_disconnect_if_dead>) at conncache.c:295
#12 0x00007f5a86977741 in Curl_connect (data=0x7f5a75cb7fe0) at url.c:3075
#13 0x00007f5a86977741 in Curl_connect (async=0x7f5a7d4de618, in_connect=0x7f5a75cb7ff0, data=<optimized out>) at url.c:5686
#14 0x00007f5a86977741 in Curl_connect (data=data@entry=0x7f5a75cb7fe0, in_connect=in_connect@entry=0x7f5a75cb7ff0, asyncp=asyncp@entry=0x7f5a7d4de6b8, protocol_done=protocol_done@entry=0x7f5a7d4de6b9) at url.c:5961
#15 0x00007f5a86989323 in multi_runsingle (multi=multi@entry=0x7f5a75b90290, now=..., data=data@entry=0x7f5a75cb7fe0) at multi.c:1089
#16 0x00007f5a86989d36 in curl_multi_perform (multi_handle=0x7f5a75b90290, running_handles=running_handles@entry=0x7f5a7d4de7a8) at multi.c:1793
#17 0x00007f5a8c0af7f6 in lr_download (err=0x7f5a7d4de7b0, dd=0x7f5a7d4de7d0) at /usr/src/debug/librepo/py3/librepo/downloader.c:1832
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator': 
#18 0x00007f5a8c0af7f6 in lr_download (targets=targets@entry=0x7f5a75b8fb60, failfast=failfast@entry=1, err=err@entry=0x7f5a7d4dec30)
    at /usr/src/debug/librepo/py3/librepo/downloader.c:1949
Python Exception <class 'TypeError'> iter() returned non-iterator of type '_iterator': 
#19 0x00007f5a8c0b657e in lr_download_packages (targets=targets@entry=0x7f5a7400ca40, flags=flags@entry=LR_PACKAGEDOWNLOAD_FAILFAST, err=err@entry=0x7f5a7d4dec30) at /usr/src/debug/librepo/py3/librepo/package_downloader.c:413
#20 0x00007f5a8c0b6857 in lr_download_package (handle=<optimized out>, relative_url=<optimized out>, dest=<optimized out>, checksum_type=<optimized out>, checksum=<optimized out>, expectedsize=<optimized out>, base_url=0x0, resume=1, err=0x7f5a7d4dec30)
    at /usr/src/debug/librepo/py3/librepo/package_downloader.c:476
#21 0x00007f5a8c9ab976 in hif_source_download_package () at /lib64/libhif.so.1
#22 0x00007f5a8c9a6f80 in hif_package_array_download () at /lib64/libhif.so.1
#23 0x00007f5a8d02410c in pk_backend_transaction_run () at /usr/lib64/packagekit-backend/libpk_backend_hif.so
#24 0x00007f5a8d0256fc in pk_backend_install_packages_thread () at /usr/lib64/packagekit-backend/libpk_backend_hif.so
#25 0x000055d0ba0e804a in pk_backend_job_thread_setup ()
#26 0x00007f5a91da97f5 in g_thread_proxy (data=0x55d0bbc45720) at gthread.c:764
#27 0x00007f5a9190a6ea in start_thread (arg=0x7f5a7d4df700) at pthread_create.c:334
#28 0x00007f5a9163ee9d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

(gdb) up
#1  0x00007f5a9156e7ba in __GI_abort () at abort.c:89
89	      raise (SIGABRT);
(gdb) up
#2  0x00007f5a915b12ba in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f5a916c8e20 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/posix/libc_fatal.c:175
175	      abort ();
(gdb) up
#3  0x00007f5a915b997a in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7f5a916c52b5 "free(): invalid pointer", action=3)
    at malloc.c:5000
5000	      __libc_message (action & 2, "*** Error in `%s': %s: 0x%s ***\n",
(gdb) up
#4  _int_free (av=<optimized out>, p=<optimized out>, have_lock=0) at malloc.c:3861
3861	      malloc_printerr (check_action, errstr, chunk2mem (p), av);
(gdb) up
#5  0x00007f5a915bd4ec in __GI___libc_free (mem=<optimized out>) at malloc.c:2962
2962	  _int_free (ar_ptr, p, 0);
(gdb) up
#6  0x00007f5a86963a0e in Curl_add_buffer_free (buff=0x7f5a75b955c0) at http.c:1056
1056	    free(buff->buffer);

Comment 1 Kamil Dudka 2015-07-31 08:30:18 UTC
Thank you for reporting the bug!  I believe this is fixed in curl-7.43.0-3.fc24.  Please update and verify that curl works as expected.

*** This bug has been marked as a duplicate of bug 1248389 ***


Note You need to log in before you can comment on or make changes to this bug.