search

epakai / synergy-debian

Synergy packaging for Debian
Other
4 stars 2 forks source link

[449255] Synergy server crashes due to internal malloc memory corruption #63

Open epakai opened 7 years ago

epakai commented 7 years ago

BTS_msg_id: ec967c8f0711040548o381eaacfr1fd931ba2efcb3f1@mail.gmail.com BTS author: "Jan Vidar Krey" janvidar.krey@gmail.com

Package: synergy Version: 1.3.1-2 Severity: serious

--- Please enter the report below this line. ---

I am connecting my imac (ubuntu/powerPC) synergy client to my amd64 (sid/amd64) box using synergy server.

It seems like synergys is corrupting some malloc data, which causes it to abort. I get this abort everytime I leave my primary screen with my mouse which renders everything pretty much useless. Here are the relevant excerpts from the debug log on the server (-f -d DEBUG):

NOTE: CServer.cpp,277: client "imac has connected INFO: CServer.cpp,446: switch from "amd64" to "imac" at 0,501 INFO: CScreen.cpp,116: leaving screen glibc detected synergys: free(): invalid next size (fast): 0x0000000000615c80 ***

I downloaded the source package, and rebuilt it with debug symbols enabled, and got this backtrace:

0 0x00002b21235d26a5 in raise () from /lib/libc.so.6

1 0x00002b21235d4100 in abort () from /lib/libc.so.6

2 0x00002b212360b54b in ?? () from /lib/libc.so.6

3 0x00002b2123612a4a in ?? () from /lib/libc.so.6

4 0x00002b212361663c in free () from /lib/libc.so.6

5 0x000000000044d8d8 in std::_Rb_tree<unsigned int, std::pair<unsigned int

const, CKeyMap::KeyItem>, std::_Select1st<std::pair<unsigned int const, CKeyMap::KeyItem> >, std::less, std::allocator<std::pair<unsigned int const, CKeyMap::KeyItem> > >::_M_erase (this=0x6c9798, __x=0x712ee0) at /usr/include/c++/4.2/ext/new_allocator.h:97

6 0x0000000000452206 in CKeyState::updateKeyState (this=0x6c96b0) at

/usr/include/c++/4.2/bits/stl_tree.h:711

7 0x0000000000453db6 in CPlatformScreen::updateKeyState (this=0x6a6f70) at

CPlatformScreen.cpp:36

8 0x0000000000456298 in CScreen::leave (this=0x6a6f00) at CScreen.cpp:122

9 0x000000000042695d in CPrimaryClient::leave (this=)

at CPrimaryClient.cpp:149

10 0x00000000004299ec in CServer::switchScreen (this=0x6d8b10,

dst=0x71e180, x=0, y=331, forScreensaver=false) at CServer.cpp:464

11 0x000000000042bea6 in CServer::onMouseMovePrimary (this=0x6d8b10, x=0,

y=331) at CServer.cpp:1654

12 0x0000000000460bf7 in CEventQueue::dispatchEvent (this=0x7fff88b1dea0,

event=@0x7fff88b1e070) at CEventQueue.cpp:190

13 0x0000000000409693 in mainLoop () at synergys.cpp:685

14 0x0000000000409a27 in standardStartup (argc=-2001608384, argv=<value

optimized out>) at synergys.cpp:735

15 0x000000000040a2ef in main (argc=4, argv=0x7fff88b1e478) at synergys.cpp

:762

Running synergys in valgrind causes it not to crash since malloc is bypassed with valgrinds own malloc and friends, but I get a fairly verbose output when leaving the screen with my mouse:

INFO: CServer.cpp,446: switch from "imac" to "amd64" at 0,364 INFO: CScreen.cpp,116: leaving screen ==17883== ==17883== Syscall param write(buf) points to uninitialised byte(s) ==17883== at 0x5F0BE7B: (within /lib/libpthread-2.6.1.so) ==17883== by 0x55A4D7E: (within /usr/lib/libX11.so.6.2.0) ==17883== by 0x55A9A5E: (within /usr/lib/libX11.so.6.2.0) ==17883== by 0x55A9B50: _XReply (in /usr/lib/libX11.so.6.2.0) ==17883== by 0x558CBB6: XGrabKeyboard (in /usr/lib/libX11.so.6.2.0) ==17883== by 0x4347D7: CXWindowsScreen::grabMouseAndKeyboard() ( CXWindowsScreen.cpp:1822) ==17883== by 0x436144: CXWindowsScreen::leave() (CXWindowsScreen.cpp:280) ==17883== by 0x456261: CScreen::leave() (CScreen.cpp:118) ==17883== by 0x42695C: CPrimaryClient::leave() (CPrimaryClient.cpp:149) ==17883== by 0x4299EB: CServer::switchScreen(CBaseClientProxy, int, int, bool) (CServer.cpp:464) ==17883== by 0x42BEA5: CServer::onMouseMovePrimary(int, int) (CServer.cpp :1654) ==17883== by 0x460BF6: CEventQueue::dispatchEvent(CEvent const&) ( CEventQueue.cpp:190) ==17883== Address 0x6887B9E is 38 bytes inside a block of size 16,384 alloc'd ==17883== at 0x4C20F3F: calloc (vg_replace_malloc.c:279) ==17883== by 0x5595A24: XOpenDisplay (in /usr/lib/libX11.so.6.2.0) ==17883== by 0x4364BF: CXWindowsScreen::openDisplay(char const) ( CXWindowsScreen.cpp:841) ==17883== by 0x438039: CXWindowsScreen::CXWindowsScreen(char const*, bool) ( CXWindowsScreen.cpp:103) ==17883== by 0x408792: initServer() (synergys.cpp:126) ==17883== by 0x408E52: startServer() (synergys.cpp:481) ==17883== by 0x4095B2: mainLoop() (synergys.cpp:662) ==17883== by 0x409A26: standardStartup(int, char*) (synergys.cpp:735) ==17883== by 0x40A2EE: main (synergys.cpp:762) ==17883== ==17883== Invalid write of size 1 ==17883== at 0x436C0C: CXWindowsScreen::updateButtons() (CXWindowsScreen.cpp :1802) ==17883== by 0x456297: CScreen::leave() (CScreen.cpp:122) ==17883== by 0x42695C: CPrimaryClient::leave() (CPrimaryClient.cpp:149) ==17883== by 0x4299EB: CServer::switchScreen(CBaseClientProxy, int, int, bool) (CServer.cpp:464) ==17883== by 0x42BEA5: CServer::onMouseMovePrimary(int, int) (CServer.cpp :1654) ==17883== by 0x460BF6: CEventQueue::dispatchEvent(CEvent const&) ( CEventQueue.cpp:190) ==17883== by 0x409692: mainLoop() (synergys.cpp:685) ==17883== by 0x409A26: standardStartup(int, char) (synergys.cpp:735) ==17883== by 0x40A2EE: main (synergys.cpp:762) ==17883== Address 0x8922AE7 is 1 bytes before a block of size 255 alloc'd ==17883== at 0x4C22425: operator new(unsigned long) (vg_replace_malloc.c:167) ==17883== by 0x4396CE: std::vector<unsigned char, std::allocator<unsigned char> >::_M_fill_insert(__gnu_cxx::__normal_iterator<unsigned char, std::vector<unsigned char, std::allocator > >, unsigned long, unsigned char const&) (new_allocator.h:91) ==17883== by 0x436C3A: CXWindowsScreen::updateButtons() (stl_vector.h:653) ==17883== by 0x4563C3: CScreen::enable() (CScreen.cpp:58) ==17883== by 0x42D895: CServer::CServer(CConfig const&, CPrimaryClient) ( CServer.cpp:156) ==17883== by 0x408F29: startServer() (synergys.cpp:311) ==17883== by 0x4095B2: mainLoop() (synergys.cpp:662) ==17883== by 0x409A26: standardStartup(int, char) (synergys.cpp:735) ==17883== by 0x40A2EE: main (synergys.cpp:762) DEBUG: CXWindowsClipboard.cpp,313: open clipboard 0 ==17883== ==17883== Conditional jump or move depends on uninitialised value(s) ==17883== at 0x44101C: CXWindowsClipboard::checkCache() const ( CXWindowsClipboard.cpp:444) ==17883== by 0x442178: CXWindowsClipboard::fillCache() const ( CXWindowsClipboard.cpp:470) ==17883== by 0x44221D: CXWindowsClipboard::has(IClipboard::EFormat) const ( CXWindowsClipboard.cpp:371) ==17883== by 0x456D3C: IClipboard::copy(IClipboard, IClipboard const, unsigned) (IClipboard.cpp:124) ==17883== by 0x436013: CXWindowsScreen::getClipboard(unsigned char, IClipboard) const (CXWindowsScreen.cpp:425) ==17883== by 0x455BE1: CScreen::getClipboard(unsigned char, IClipboard) const (CScreen.cpp:409) ==17883== by 0x426731: CPrimaryClient::getClipboard(unsigned char, IClipboard) const (CPrimaryClient.cpp:107) ==17883== by 0x429566: CServer::onClipboardChanged(CBaseClientProxy, unsigned char, unsigned) (CServer.cpp:1429) ==17883== by 0x429BE5: CServer::switchScreen(CBaseClientProxy*, int, int, bool) (CServer.cpp:477) ==17883== by 0x42BEA5: CServer::onMouseMovePrimary(int, int) (CServer.cpp :1654) ==17883== by 0x460BF6: CEventQueue::dispatchEvent(CEvent const&) ( CEventQueue.cpp:190) ==17883== by 0x409692: mainLoop() (synergys.cpp:685)

Hope this helps.

Cheers

Jan Vidar Krey

--- System information. --- Architecture: amd64 Kernel: Linux 2.6.22-2-amd64

Debian Release: lenny/sid 500 unstable ftp.no.debian.org

--- Package information. --- Depends (Version) | Installed =============================-+-============= libc6 (>= 2.3.5-1) | 2.6.1-6 libgcc1 (>= 1:4.1.0) | 1:4.2.2-3 libice6 | 2:1.0.4-1 libsm6 | 2:1.0.3-1+b1 libstdc++6 (>= 4.1.0) | 4.2.2-3 libx11-6 | 2:1.0.3-7 libxext6 | 1:1.0.3-2 libxinerama1 | 1:1.0.2-1 libxtst6 | 2:1.0.3-1

epakai commented 7 years ago

BTS_msg_id: 200801111604.44825.bencer@cauterized.net BTS author: Jorge Salamero Sanz bencer@cauterized.net

i can confirm this bug which makes synergy completely unusable.

epakai commented 7 years ago

BTS_msg_id: 478de4c4.06e9300a.4bb0.ffffffcf@mx.google.com BTS author: "Javier Ortega Conde (Malkavian)" malkavian666@gmail.com

Same here, whit Debian lenny/sid as server and windows XP as client in a laptop.

epakai commented 7 years ago

BTS_msg_id: 1205183539-2003-bts-cord@debian.org BTS author: Cord Beermann cord@debian.org

Automatically generated email from bts, devscripts version 2.10.18.1

tags 449255 help

epakai commented 7 years ago

BTS_msg_id: 20080521065926.23494.93434.reportbug@rms BTS author: Olivier Berger oberger@ouvaton.org

Package: synergy Followup-For: Bug #449255

Dunno what's different in my setup, but it is not crashing here, with both systems being 32 bit Debian testing PCs.

I suggest lowering severity to important as it seems it's not completely unusable (at least for me).

Best regards,

-- System Information: Debian Release: lenny/sid APT prefers testing APT policy: (500, 'testing') Architecture: i386 (i686)

Kernel: Linux 2.6.24-1-686 (SMP w/1 CPU core) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash

Versions of packages synergy depends on: ii libc6 2.7-10 GNU C Library: Shared libraries ii libgcc1 1:4.3.0-3 GCC support library ii libice6 2:1.0.4-1 X11 Inter-Client Exchange library ii libsm6 2:1.0.3-1+b1 X11 Session Management library ii libstdc++6 4.3.0-3 The GNU Standard C++ Library v3 ii libx11-6 2:1.0.3-7 X11 client-side library ii libxext6 2:1.0.4-1 X11 miscellaneous extension librar ii libxinerama1 2:1.0.3-1 X11 Xinerama extension library ii libxtst6 2:1.0.3-1 X11 Testing -- Resource extension

synergy recommends no packages.

-- no debconf information

epakai commented 7 years ago

BTS_msg_id: 20080523163630.GW2622@mx0.halon.org.uk BTS author: Neil McGovern neilm@debian.org

--XRI2XbIfl/05pQwm Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable

I'm wondering if this is a 64bit problem. Anyway, lowering to important as it obviously works for some people.

Neil --=20

bah.... Germans. You just put 100 DDs in one country and then they = all become friends of each other. --XRI2XbIfl/05pQwm Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (GNU/Linux) iD8DBQFINvKO97LBwbNFvdMRAqzwAJ41r4g1SsaNU1ZN5WYG4iTLxiFjFgCePRJa TFQx4dtgY4q/idW+47GMr5M= =a7bg -----END PGP SIGNATURE----- --XRI2XbIfl/05pQwm--
epakai commented 7 years ago

BTS_msg_id: E1JzaEr-000656-1c@mx0.halon.org.uk BTS author: Neil McGovern neilm@debian.org

Automatically generated email from bts, devscripts version 2.9.26

severity 449255 important

epakai commented 7 years ago

BTS_msg_id: 20080923065919.13666.94295.reportbug@ws042498-linux.oce.nl BTS author: Manuel Bilderbeek bilm@oce.nl

Package: synergy Version: 1.3.1-5 Followup-For: Bug #449255

On my 32bit installation of testing on a Core2Duo system, I regularly get a crashing synergy as well. It can work for days and suddenly crash. I can't find a trigger yet to easily reproduce it. I get this in my dmesg: [28463.755155] synergys[3689]: segfault at 820da44 ip b7deb9a2 sp bffd5544 error 4 in libstdc++.so.6.0.10[b7d8e000+e3000]

I guess it's the same (or similar) problem.

Doesn't render it unusable, but it's definately very annoying.

HTH...

-- System Information: Debian Release: lenny/sid APT prefers testing APT policy: (990, 'testing'), (500, 'stable') Architecture: i386 (i686)

Kernel: Linux 2.6.26-1-686-bigmem (SMP w/2 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash

Versions of packages synergy depends on: ii libc6 2.7-13 GNU C Library: Shared libraries ii libgcc1 1:4.3.1-9 GCC support library ii libice6 2:1.0.4-1 X11 Inter-Client Exchange library ii libsm6 2:1.0.3-2 X11 Session Management library ii libstdc++6 4.3.1-9 The GNU Standard C++ Library v3 ii libx11-6 2:1.1.4-2 X11 client-side library ii libxext6 2:1.0.4-1 X11 miscellaneous extension librar ii libxinerama1 2:1.0.3-2 X11 Xinerama extension library ii libxtst6 2:1.0.3-1 X11 Testing -- Resource extension

synergy recommends no packages.

synergy suggests no packages.

-- no debconf information

This message and attachment(s) are intended solely for use by the addressee and may contain information that is privileged, confidential or otherwise exempt from disclosure under applicable law.

If you are not the intended recipient or agent thereof responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.

If you have received this communication in error, please notify the sender immediately by telephone and with a 'reply' message.

Thank you for your co-operation.

epakai commented 7 years ago

BTS_msg_id: alpine.DEB.1.10.0902041527200.15659@qirst.com BTS author: Christoph Lameter cl@linux-foundation.org

Segfaults make the software unusable on 64 bit platforms.

epakai commented 7 years ago

BTS_msg_id: 49E3867C.5040407@debian.org BTS author: Jeff Licquia licquia@debian.org

This is a multi-part message in MIME format. --------------060404020107000605080007 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit

--------------060404020107000605080007 Content-Type: message/rfc822; name="Synergy SegFault Patch.eml" Content-Transfer-Encoding: 7bit Content-Disposition: inline; filename="Synergy SegFault Patch.eml"

Return-Path: slifox@gmail.com X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on server1.internal.licquia.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=RCVD_IN_DNSWL_LOW autolearn=disabled version=3.2.5 X-Original-To: jeff@licquia.org Delivered-To: jeff@licquia.org Received: from server1.internal.licquia.org (localhost.localdomain [127.0.0.1]) by server1.internal.licquia.org (Postfix) with ESMTP id 11BA6981FE for jeff@licquia.org; Sun, 12 Apr 2009 22:40:45 -0400 (EDT) Received: from rimu.licquia.org (unknown [192.168.53.3]) by server1.internal.licquia.org (Postfix) with ESMTP id E1BC5981FD for jeff@licquia.org; Sun, 12 Apr 2009 22:40:44 -0400 (EDT) Received: from master.debian.org (master.debian.org [70.103.162.29]) by rimu.licquia.org (Postfix) with ESMTP id A53E54001C for jeff@licquia.org; Sun, 12 Apr 2009 21:40:44 -0500 (CDT) Received: from mail-qy0-f115.google.com ([209.85.221.115]) by master.debian.org with esmtp (Exim 4.69) (envelope-from slifox@gmail.com) id 1LtC6G-00071z-7E for jeff@licquia.org; Mon, 13 Apr 2009 02:40:44 +0000 Received: by qyk13 with SMTP id 13so1097843qyk.5 for licquia@debian.org; Sun, 12 Apr 2009 19:40:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:from:date:message-id :subject:to:content-type; bh=nsQjZTHchke5zEskVNAST8aP048rqivsj4TilicPh+Q=; b=dd3Q8ONPv2cjPPmScwOq6URWYZlKcdsR6I4XcSP5ulodL1E96UIpuN4P0sa9gNzAaE TnexLtl0OvOh9UZa1zp/HCTHtGe5VHEELlYaUu3upbIa9kwTE1bjy0kfA2WObC/8locl 3jEUq0T+Kl/adLb1eYXwFNBDMdc+UzVz/VwNU= DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:from:date:message-id:subject:to:content-type; b=WuGlfy6cOemQfXqhH+woIoZr5lqEX/ed0yTgL62Gsgz01uopuCxQ67meFfOwV+fJj6 GyBq89TFZl+jGQaUp/rx0//X5sK8e+Oulg0RxRctBK1vC5cwOqnZWGvg/f417XIEjm3R 8Uff0EC6CHLpJE8fOojNDtcL70/fbyWtF+y9E= MIME-Version: 1.0 Received: by 10.229.79.17 with SMTP id n17mr1517361qck.82.1239590438246; Sun, 12 Apr 2009 19:40:38 -0700 (PDT) From: Alex slifox@gmail.com Date: Sun, 12 Apr 2009 21:40:23 -0500 Message-ID: c3b4f4d00904121940t3e8e90e4sf2ee0910dafb122b@mail.gmail.com Subject: Synergy SegFault Patch To: Jeff Licquia licquia@debian.org Content-Type: multipart/mixed; boundary=0016364ee4a8bd19b0046766a338 X-Virus-Scanned: ClamAV using ClamSMTP X-SPF-Status: pass X-SPF-Comment: server1.internal.licquia.org: localhost is always allowed. X-Bogosity: Ham, tests=bogofilter, spamicity=0.003320, version=1.1.7

--0016364ee4a8bd19b0046766a338 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit

Hello,

I saw your name posted as the maintainer for synergy in debian. I'm not sure if synergy is actively maintained (latest release is 2006), so I figured you might be the best person to send this to:

I made a patch that will fix a bug that causes a segmentation fault in synergys. The problem occurs when a hotkey is used to switch. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449255

The patch is below, and also included in an attachment.

Thank you,

Alex

+++ CServer.cpp 2009-04-12 21:37:01.000000000 -0500 @@ -439,6 +439,14 @@ { SInt32 dx, dy, dw, dh; dst->getShape(dx, dy, dw, dh); +

--0016364ee4a8bd19b0046766a338 Content-Type: text/x-patch; charset=US-ASCII; name="synergy-fix.patch" Content-Disposition: attachment; filename="synergy-fix.patch" Content-Transfer-Encoding: base64 X-Attachment-Id: f_ftgk37go0

KysrIENTZXJ2ZXIuY3BwIDIwMDktMDQtMTIgMjE6Mzc6MDEuMDAwMDAwMDAwIC0wNTAwCkBAIC00 MzksNiArNDM5LDE0IEBACiAgICAgICAgewogICAgICAgICAgICAgICAgU0ludDMyIGR4LCBkeSwg ZHcsIGRoOwogICAgICAgICAgICAgICAgZHN0LT5nZXRTaGFwZShkeCwgZHksIGR3LCBkaCk7CisK KyAgICAgICAgICAgICAgIC8vIElmIGdpdmVuIG1vdXNlIHBvc2l0aW9uIGlzIGludmFsaWQgKGUu Zy4gZHVyaW5nIGEgaG90a2V5IHNjcmVlbiBzd2l0Y2gpCisgICAgICAgICAgICAgICAvLyB0aGVu IHNldCB0aGUgbmV3IG1vdXNlIHBvc2l0aW9uIGFzIHRoZSBjZW50ZXIgb2YgdGhlIHNjcmVlbiB0 byBiZSBzd2l0Y2hlZCB0bworICAgICAgICAgICAgICAgaWYgKHggPCBkeCB8fCB5IDwgZHkgfHwg eCA+IChkeCArIGR3KSB8fCB5ID4gKGR5ICsgZGgpKSB7CisgICAgICAgICAgICAgICAgICAgICAg IHggPSAoZHcgLyAyKTsKKyAgICAgICAgICAgICAgICAgICAgICAgeSA9IChkaCAvIDIpOworICAg ICAgICAgICAgICAgfQorCiAgICAgICAgICAgICAgICBhc3NlcnQoeCA+PSBkeCAmJiB5ID49IGR5 ICYmIHggPCBkeCArIGR3ICYmIHkgPCBkeSArIGRoKTsKICAgICAgICB9CiAjZW5kaWYKCg== --0016364ee4a8bd19b0046766a338--

--------------060404020107000605080007--

epakai commented 7 years ago

BTS_msg_id: 49E387AF.4020206@debian.org BTS author: Jeff Licquia licquia@debian.org

tags 449255 + patch thanks

Alex wrote:

I made a patch that will fix a bug that causes a segmentation fault in synergys. The problem occurs when a hotkey is used to switch. http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=449255

Thanks. I've forwarded the patch to the bug, so I can keep track of it better.

You can always send your patches to particular bugs in Debian's BTS. Any comments sent to @bugs.debian.org becomes part of the bug, and the package's maintainer gets sent a copy as well.

I'll give it a look-see, and may include it in a future version of the package. Right now, I'm dealing with an autobuild failure on MIPS, so the patch may get a chance sooner rather than later.

epakai commented 7 years ago

BTS_msg_id: 4E7FF558.8050704@debian.org BTS author: Jeff Licquia licquia@debian.org

If anyone is still having this problem, can they test with a more recent version? We're up to 1.3.6 as of this moment, with 1.3.7 on the way. Quite a few fixes have been made since the squeeze version.

If anyone has trouble getting this running on stable, please let me know.