JuergenKosel
commented
6 years ago Hello,
in another run of my test the segmentation fault occurred some lines earlier: https://github.com/eclipse/paho.mqtt.c/blob/c85e4a2fd6e96ebc35caef99a024d94c9b664ba0/src/MQTTAsync.c#L1094
Program terminated with signal 11, Segmentation fault.
#0 0x6a2f6560 in ?? ()
(gdb) bt
#0 0x6a2f6560 in ?? ()
#1 0x0fed5f40 in MQTTAsync_writeComplete (socket=26) at /home/klj/echo-sources-git-svn-full/paho.mqtt.c/src/MQTTAsync.c:1100
#2 0x0feed370 in Socket_continueWrites (pwset=0x53884bcc) at /home/klj/echo-sources-git-svn-full/paho.mqtt.c/src/Socket.c:822
#3 0x0feeba0c in Socket_getReadySocket (more_work=0, tp=0x53884c8c) at /home/klj/echo-sources-git-svn-full/paho.mqtt.c/src/Socket.c:264
#4 0x0fedb7e8 in MQTTAsync_cycle (sock=0x53884d28, timeout=1000, rc=0x53884d24) at /home/klj/echo-sources-git-svn-full/paho.mqtt.c/src/MQTTAsync.c:2917
#5 0x0fed7cbc in MQTTAsync_receiveThread (n=0x102f29b4) at /home/klj/echo-sources-git-svn-full/paho.mqtt.c/src/MQTTAsync.c:1741
#6 0x0e842a6c in ?? ()
#7 0x0e4ec8a0 in ?? ()
(gdb) up
#1 0x0fed5f40 in MQTTAsync_writeComplete (socket=26) at /home/klj/echo-sources-git-svn-full/paho.mqtt.c/src/MQTTAsync.c:1100
1100 (*(command->onSuccess))(command->context, &data);
(gdb) print command
$1 = (MQTTAsync_command *) 0x5c6a474c
(gdb) print *command
Cannot access memory at address 0x5c6a474c
(gdb) print data
$2 = {token = 1869967971, alt = {qos = 0, qosList = 0x0, pub = {message = {struct_id = "\000\000\000", struct_version = 267256228, payloadlen = 1885431919, payload = 0x2e6d7174, qos = 1949197103, retained = 1936876335, dup = 267437916, msgid = 1401441120}, destinationName = 0x756c6c2f <Address 0x756c6c2f out of bounds>}, connect = {serverURI = 0x0, MQTTVersion = 267256228, sessionPresent = 1885431919}}}
(gdb) print m
$3 = (MQTTAsyncs *) 0x102f29b4
(gdb) print *m
$4 = {serverURI = 0x102f2b1c "SLGB-VM-MQTTSRV.inat.internal:1883", ssl = 0, c = 0x102f2d2c, cl = 0x100bc6ac <MqttBroker::MQTTAsync_connectionLost(void*, char*)>, ma = 0x100bc634 <MqttBroker::MQTTAsync_messageArrived(void*, char*, int, MQTTAsync_message*)>, dc = 0x100bc668 <MqttBroker::MQTTAsync_deliveryComplete(void*, int)>, context = 0x102c7e38, connected = 0x0, connected_context = 0x0, connect = {type = 1, onSuccess = 0x100bc7f4 <MqttBroker::MQTTAsync_onConnectSuccess(void*, MQTTAsync_successData*)>, onFailure = 0x100bca08 <MqttBroker::MQTTAsync_onConnectFailure(void*, MQTTAsync_failureData*)>, token = 0, context = 0x102c7e38, start_time = {tv_sec = 1512079421, tv_usec = 821600}, details = {sub = {count = 0, topics = 0x3, qoss = 0x0}, unsub = {count = 0, topics = 0x3}, pub = {destinationName = 0x0, payloadlen = 3, payload = 0x0, qos = 0, retained = 0}, dis = {internal = 0, timeout = 3}, conn = {currentURI = 0, MQTTVersion = 3}}}, disconnect = {type = 14, onSuccess = 0x0, onFailure = 0x0, token = 0, context = 0x0, start_time = {tv_sec = 1512079385, tv_usec = 37981}, details = {sub = {count = 1, topics = 0x0, qoss = 0x0}, unsub = {count = 1, topics = 0x0}, pub = {destinationName = 0x1 <Address 0x1 out of bounds>, payloadlen = 0, payload = 0x0, qos = 0, retained = 0}, dis = {internal = 1, timeout = 0}, conn = {currentURI = 1, MQTTVersion = 0}}}, pending_write = 0x5c6a474c, responses = 0x102f2bdc, command_seqno = 0, pack = 0x0, createOptions = 0x0, shouldBeConnected = 1, automaticReconnect = 0, minRetryInterval = 1, maxRetryInterval = 60, serverURIcount = 0, serverURIs = 0x0, connectTimeout = 2, currentInterval = 0, lastConnectionFailedTime = {tv_sec = 0, tv_usec = 0}, retrying = 0, reconnectNow = 0}
(gdb) print m->pending_write
$5 = (MQTTAsync_command *) 0x5c6a474cThis time the crash happened, because an invalid function pointer was called. And this could be the same thing what appeared to me as a stack corruption some days ago.
icraggs
Hello,
while continuing testing for issue #373 a segmentation fault was caused in the following line: https://github.com/eclipse/paho.mqtt.c/blob/c85e4a2fd6e96ebc35caef99a024d94c9b664ba0/src/MQTTAsync.c#L1099
Output from gdb: