otr crashes irssi when the xmpp plugin is loaded

[anarcat]

This is the oddest bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499229

I originally thought it was fixed by the new version, but actually, it's not - I even opened a new issue against the XMPP plugin today, thinking it was at fault: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=707758

However, the xmpp plugin maintainer believes the problem is in otr, as the crash happens when otr is unloaded.

The issues mentioned above have a couple of backtraces for you to help you reproduce the thing.

[anarcat]

Also note that we have reports in that bug report of segfaults without the xmpp plugin being loaded, so there may be a larger issue here:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=499229#52

[DrWhax]

This is interesting, so it happened after an upgrade, my guess is, it isn't parsing some file correctly and our irssi-otr crashes. Needs more research.

[anarcat]

here i had another segfault on /quit:

anarcat@marcos:core$ gdb /usr/bin/irssi 1000-irssi-5641-11-1397098163.core
GNU gdb (GDB) 7.6.2 (Debian 7.6.2-1)
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/irssi...(no debugging symbols found)...done.
Illegal process-id: 1000-irssi-5641-11-1397098163.core.
[New LWP 5641]
[New LWP 5643]

warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7fff2236e000
Core was generated by `irssi --config=.irssi/config.proxy'.
Program terminated with signal 11, Segmentation fault.
#0  0x00007fa2e5ec2040 in ?? ()
(gdb) bt
#0  0x00007fa2e5ec2040 in ?? ()
#1  0x00007fa2e5c10835 in ?? () from /lib/x86_64-linux-gnu/libgcrypt.so.11
#2  0x00007fa2e5c10afa in ?? () from /lib/x86_64-linux-gnu/libgcrypt.so.11
#3  0x00007fa2e5c12ef4 in ?? () from /lib/x86_64-linux-gnu/libgcrypt.so.11
#4  0x00007fa2e26f6a7c in otrl_auth_clear () from /usr/lib/libotr.so.5
#5  0x00007fa2e26ef378 in otrl_context_force_finished () from /usr/lib/libotr.so.5
#6  0x00007fa2e26ef40d in otrl_context_force_plaintext () from /usr/lib/libotr.so.5
#7  0x00007fa2e26ef6a0 in otrl_context_forget_all () from /usr/lib/libotr.so.5
#8  0x00007fa2e26f626d in otrl_userstate_free () from /usr/lib/libotr.so.5
#9  0x00007fa2e290619b in otr_free_user_state (ustate=0x11781e0) at otr.c:317
#10 0x00007fa2e29096f2 in otr_deinit () at module.c:361
#11 0x000000000047d5a4 in module_file_unload ()
#12 0x000000000047d538 in module_unload ()
#13 0x0000000000416818 in main ()
(gdb)

notice how this is still in gcrypt?

this is on a recent debian jessie, so with the latest and greatest irssi-otr plugin.

anarcat@marcos:core$ dpkg -l irssi-plugin-*
Souhait=inconnU/Installé/suppRimé/Purgé/H=à garder
| État=Non/Installé/fichier-Config/dépaqUeté/échec-conFig/H=semi-installé/W=attend-traitement-déclenchements
|/ Err?=(aucune)/besoin Réinstallation (État,Err: majuscule=mauvais)
||/ Nom                     Version          Architecture     Description
+++-=======================-================-================-====================================================
ii  irssi-plugin-otr        1.0.0-1          amd64            Off-the-Record Messaging Plugin for Irssi
ii  irssi-plugin-otr-dbg    1.0.0-1          amd64            Off-the-Record Messaging Plugin for Irssi - debuggin
ii  irssi-plugin-xmpp       0.52+git20140102 amd64            XMPP plugin for irssi
ii  irssi-plugin-xmpp-dbg   0.52+git20140102 amd64            XMPP plugin for irssi - Debugging symbols

[dgoulet]

Oh wow, this one is deep inside the libotr during user state destruction... this sounds like a serious libotr bug!

By any chance if you still have the coredump, could you provide the "bt full" so we can see the exact call site of the segfault?

[anarcat]

i am not sure why, but i still don't see proper debug symbols here even though the debug packages are installed:

(gdb) bt full
#0  0x00007fa2e5ec2040 in ?? ()
No symbol table info available.
#1  0x00007fa2e5c10835 in ?? () from /lib/x86_64-linux-gnu/libgcrypt.so.11
No symbol table info available.
#2  0x00007fa2e5c10afa in ?? () from /lib/x86_64-linux-gnu/libgcrypt.so.11
No symbol table info available.
#3  0x00007fa2e5c12ef4 in ?? () from /lib/x86_64-linux-gnu/libgcrypt.so.11
No symbol table info available.
#4  0x00007fa2e26f6a7c in otrl_auth_clear () from /usr/lib/libotr.so.5
No symbol table info available.
#5  0x00007fa2e26ef378 in otrl_context_force_finished () from /usr/lib/libotr.so.5
No symbol table info available.
#6  0x00007fa2e26ef40d in otrl_context_force_plaintext () from /usr/lib/libotr.so.5
No symbol table info available.
#7  0x00007fa2e26ef6a0 in otrl_context_forget_all () from /usr/lib/libotr.so.5
No symbol table info available.
#8  0x00007fa2e26f626d in otrl_userstate_free () from /usr/lib/libotr.so.5
No symbol table info available.
#9  0x00007fa2e290619b in otr_free_user_state (ustate=0x11781e0) at otr.c:317
No locals.
#10 0x00007fa2e29096f2 in otr_deinit () at module.c:361
No locals.
#11 0x000000000047d5a4 in module_file_unload ()
No symbol table info available.
#12 0x000000000047d538 in module_unload ()
No symbol table info available.
#13 0x0000000000416818 in main ()
No symbol table info available.