[Crash report & Patch obexd 1/1] map: gboolean holds int value which 0/1 crashes in DBusMessage

[Crash report & Patch obexd 1/1] map: gboolean holds int value which 0/1 crashes in DBusMessage

[Venkateswaran, Srinivasa Ragavan]

[-- Attachment #1: Type: text/plain, Size: 399 bytes --]

Hi,

I was testing MAP and I came across a crash (trace attached). I
figured out that the crash is because dbus expects gboolean to be 0/1
where as it holds the 'int' results from strcasecmp. I've attached the
patch that fixed the problem for me. This is my first message/patch to
this list, sorry if it isn't in the right/expected format, just
suggest me and I could put it right.

Thanks,
-Srini.

[-- Attachment #2: obex-crash.txt --]
[-- Type: text/plain, Size: 3052 bytes --]

Thread 1 (Thread 0x7ffff7fce700 (LWP 6124)):
#0  0x00007ffff7328d95 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff732a2ab in __GI_abort () at abort.c:93
#2  0x00007ffff78d0655 in _dbus_abort () at dbus-sysdeps.c:94
#3  0x00007ffff78c75f1 in _dbus_warn_check_failed (format=0x7ffff78d6920 "arguments to %s() were incorrect, assertion \"%s\" failed in file %s line %d.\nThis is normally a bug in some application using the D-Bus library.\n") at dbus-internals.c:289
#4  0x00007ffff78ba28b in dbus_message_iter_append_basic (iter=0x7fffffffd320, type=<optimized out>, value=0x7fffffffd43c) at dbus-message.c:2538
#5  0x00000000004201c3 in append_variant (iter=0x7fffffffd3b0, type=98, value=0x7fffffffd43c) at client/dbus.c:44
#6  0x000000000042024e in obex_dbus_dict_append (dict=0x7fffffffd480, key=0x4252bb "Read", type=98, value=0x7fffffffd43c) at client/dbus.c:65
#7  0x000000000041dcc9 in parse_read (msg=0x63c650, value=0x63be00 "yes", iter=0x7fffffffd480) at client/map.c:423
#8  0x000000000041dfa7 in msg_element (ctxt=0x63bc50, element=0x63bd70 "msg", names=0x7fffffffd5f0, values=0x7fffffffd560, user_data=0x6347b0, gerr=0x7fffffffd680) at client/map.c:518
#9  0x00007ffff7b323b9 in emit_start_element (context=0x63bc50, error=0x0) at gmarkup.c:986
#10 0x00007ffff7b33b44 in g_markup_parse_context_parse (context=0x63bc50, text=<optimized out>, text_len=<optimized out>, error=0x0) at gmarkup.c:1323
#11 0x000000000041e1ad in message_listing_cb (session=0x631450, transfer=0x633fd0, err=0x0, user_data=0x638b60) at client/map.c:586
#12 0x000000000041744c in session_terminate_transfer (session=0x631450, transfer=0x633fd0, gerr=0x0) at client/session.c:743
#13 0x00000000004174d7 in session_notify_complete (session=0x631450, transfer=0x633fd0) at client/session.c:758
#14 0x000000000041755a in transfer_complete (transfer=0x633fd0, err=0x0, user_data=0x631450) at client/session.c:778
#15 0x000000000041f57b in xfer_complete (obex=0x634660, err=0x0, user_data=0x633fd0) at client/transfer.c:521
#16 0x000000000040efdf in transfer_complete (transfer=0x63b260, err=0x0) at gobex/gobex-transfer.c:102
#17 0x000000000040f418 in transfer_response (obex=0x634660, err=0x0, rsp=0x633d00, user_data=0x63b260) at gobex/gobex-transfer.c:221
#18 0x000000000040b320 in handle_response (obex=0x634660, err=0x0, rsp=0x633d00) at gobex/gobex.c:948
#19 0x000000000040bbc1 in incoming_data (io=0x638da0, cond=G_IO_IN, user_data=0x634660) at gobex/gobex.c:1191
#20 0x00007ffff7b2f94a in g_main_dispatch (context=0x62f130) at gmain.c:2515
#21 g_main_context_dispatch (context=0x62f130) at gmain.c:3052
#22 0x00007ffff7b2fd10 in g_main_context_iterate (dispatch=1, block=<optimized out>, context=0x62f130, self=<optimized out>) at gmain.c:3123
#23 g_main_context_iterate (context=0x62f130, block=<optimized out>, dispatch=1, self=<optimized out>) at gmain.c:3060
#24 0x00007ffff7b3010a in g_main_loop_run (loop=0x62e1b0) at gmain.c:3317
#25 0x000000000041527d in main (argc=1, argv=0x7fffffffdca8) at client/main.c:175
(gdb) 

[-- Attachment #3: 1849-Boolean-is-expected-to-be-1-0-where-as-strcasecmp-re.patch --]
[-- Type: application/octet-stream, Size: 1853 bytes --]

From 21f52e59bf567a321c07a94d46d1ee2a12330abf Mon Sep 17 00:00:00 2001
From: Srinivasa Ragavan <sragavan@gnome.org>
Date: Tue, 28 Aug 2012 16:44:05 +0530
Subject: [PATCH 1849/1849] Boolean is expected to be 1/0 where as strcasecmp
 returns gint. Crashes in DBusMessage at

	_dbus_return_val_if_fail (*bool_p == 0 || *bool_p == 1, FALSE);
---
 client/map.c |    8 ++++----
 1 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/client/map.c b/client/map.c
index e606cb2..4f07fcb 100644
--- a/client/map.c
+++ b/client/map.c
@@ -400,7 +400,7 @@ static void parse_size(struct map_msg *msg, const char *value,
 static void parse_priority(struct map_msg *msg, const char *value,
 							DBusMessageIter *iter)
 {
-	gboolean flag = strcasecmp(value, "no");
+	gboolean flag = strcasecmp(value, "no") != 0;
 
 	if (flag)
 		msg->flags |= MAP_MSG_FLAG_PRIORITY;
@@ -413,7 +413,7 @@ static void parse_priority(struct map_msg *msg, const char *value,
 static void parse_read(struct map_msg *msg, const char *value,
 							DBusMessageIter *iter)
 {
-	gboolean flag = strcasecmp(value, "no");
+	gboolean flag = strcasecmp(value, "no") != 0;
 
 	if (flag)
 		msg->flags |= MAP_MSG_FLAG_READ;
@@ -426,7 +426,7 @@ static void parse_read(struct map_msg *msg, const char *value,
 static void parse_sent(struct map_msg *msg, const char *value,
 							DBusMessageIter *iter)
 {
-	gboolean flag = strcasecmp(value, "no");
+	gboolean flag = strcasecmp(value, "no") != 0;
 
 	if (flag)
 		msg->flags |= MAP_MSG_FLAG_SENT;
@@ -439,7 +439,7 @@ static void parse_sent(struct map_msg *msg, const char *value,
 static void parse_protected(struct map_msg *msg, const char *value,
 							DBusMessageIter *iter)
 {
-	gboolean flag = strcasecmp(value, "no");
+	gboolean flag = strcasecmp(value, "no") != 0;
 
 	if (flag)
 		msg->flags |= MAP_MSG_FLAG_PROTECTED;
-- 
1.7.7

Re: [Crash report & Patch obexd 1/1] map: gboolean holds int value which 0/1 crashes in DBusMessage

[Vinicius Costa Gomes]

Hi Srini,

On 17:07 Tue 28 Aug, Venkateswaran, Srinivasa Ragavan wrote:
> Hi,
> 
> I was testing MAP and I came across a crash (trace attached). I
> figured out that the crash is because dbus expects gboolean to be 0/1
> where as it holds the 'int' results from strcasecmp. I've attached the
> patch that fixed the problem for me. This is my first message/patch to
> this list, sorry if it isn't in the right/expected format, just
> suggest me and I could put it right.

The patch in itself looks good.

Some changes: please use git send-email to send the patch (it is much
easier to look at inlined patches); please use a shorter subject line,
e.g. "map: Fix sending a D-Bus message with invalid parameters", and you
could attach the backtrace in the commit message.

> 
> Thanks,
> -Srini.

> Thread 1 (Thread 0x7ffff7fce700 (LWP 6124)):
> #0  0x00007ffff7328d95 in __GI_raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
> #1  0x00007ffff732a2ab in __GI_abort () at abort.c:93
> #2  0x00007ffff78d0655 in _dbus_abort () at dbus-sysdeps.c:94
> #3  0x00007ffff78c75f1 in _dbus_warn_check_failed (format=0x7ffff78d6920 "arguments to %s() were incorrect, assertion \"%s\" failed in file %s line %d.\nThis is normally a bug in some application using the D-Bus library.\n") at dbus-internals.c:289
> #4  0x00007ffff78ba28b in dbus_message_iter_append_basic (iter=0x7fffffffd320, type=<optimized out>, value=0x7fffffffd43c) at dbus-message.c:2538
> #5  0x00000000004201c3 in append_variant (iter=0x7fffffffd3b0, type=98, value=0x7fffffffd43c) at client/dbus.c:44
> #6  0x000000000042024e in obex_dbus_dict_append (dict=0x7fffffffd480, key=0x4252bb "Read", type=98, value=0x7fffffffd43c) at client/dbus.c:65
> #7  0x000000000041dcc9 in parse_read (msg=0x63c650, value=0x63be00 "yes", iter=0x7fffffffd480) at client/map.c:423
> #8  0x000000000041dfa7 in msg_element (ctxt=0x63bc50, element=0x63bd70 "msg", names=0x7fffffffd5f0, values=0x7fffffffd560, user_data=0x6347b0, gerr=0x7fffffffd680) at client/map.c:518
> #9  0x00007ffff7b323b9 in emit_start_element (context=0x63bc50, error=0x0) at gmarkup.c:986
> #10 0x00007ffff7b33b44 in g_markup_parse_context_parse (context=0x63bc50, text=<optimized out>, text_len=<optimized out>, error=0x0) at gmarkup.c:1323
> #11 0x000000000041e1ad in message_listing_cb (session=0x631450, transfer=0x633fd0, err=0x0, user_data=0x638b60) at client/map.c:586
> #12 0x000000000041744c in session_terminate_transfer (session=0x631450, transfer=0x633fd0, gerr=0x0) at client/session.c:743
> #13 0x00000000004174d7 in session_notify_complete (session=0x631450, transfer=0x633fd0) at client/session.c:758
> #14 0x000000000041755a in transfer_complete (transfer=0x633fd0, err=0x0, user_data=0x631450) at client/session.c:778
> #15 0x000000000041f57b in xfer_complete (obex=0x634660, err=0x0, user_data=0x633fd0) at client/transfer.c:521
> #16 0x000000000040efdf in transfer_complete (transfer=0x63b260, err=0x0) at gobex/gobex-transfer.c:102
> #17 0x000000000040f418 in transfer_response (obex=0x634660, err=0x0, rsp=0x633d00, user_data=0x63b260) at gobex/gobex-transfer.c:221
> #18 0x000000000040b320 in handle_response (obex=0x634660, err=0x0, rsp=0x633d00) at gobex/gobex.c:948
> #19 0x000000000040bbc1 in incoming_data (io=0x638da0, cond=G_IO_IN, user_data=0x634660) at gobex/gobex.c:1191
> #20 0x00007ffff7b2f94a in g_main_dispatch (context=0x62f130) at gmain.c:2515
> #21 g_main_context_dispatch (context=0x62f130) at gmain.c:3052
> #22 0x00007ffff7b2fd10 in g_main_context_iterate (dispatch=1, block=<optimized out>, context=0x62f130, self=<optimized out>) at gmain.c:3123
> #23 g_main_context_iterate (context=0x62f130, block=<optimized out>, dispatch=1, self=<optimized out>) at gmain.c:3060
> #24 0x00007ffff7b3010a in g_main_loop_run (loop=0x62e1b0) at gmain.c:3317
> #25 0x000000000041527d in main (argc=1, argv=0x7fffffffdca8) at client/main.c:175
> (gdb) 


Cheers,
--  
Vinicius

Re: [Crash report & Patch obexd 1/1] map: gboolean holds int value which 0/1 crashes in DBusMessage

[Luiz Augusto von Dentz]

Hi,

On Tue, Aug 28, 2012 at 2:37 PM, Venkateswaran, Srinivasa Ragavan
<srinivasa.ragavan.venkateswaran@intel.com> wrote:
> Hi,
>
> I was testing MAP and I came across a crash (trace attached). I
> figured out that the crash is because dbus expects gboolean to be 0/1
> where as it holds the 'int' results from strcasecmp. I've attached the
> patch that fixed the problem for me. This is my first message/patch to
> this list, sorry if it isn't in the right/expected format, just
> suggest me and I could put it right.

Interesting that I did not run into this bug before, can you do a some
changes to the commit message:

1. Add a prefix to the first line of the commit e.g: client: Fix crash
on map module
2. Add a description what you are fixing e.g. you can use the
backtrace and state this is caused by line _dbus_return_val_if_fail
(*bool_p == 0 || *bool_p == 1, FALSE);
3. How about using your intel email?

After you are done with that you can send us the patch with git
format-email + git send-email


-- 
Luiz Augusto von Dentz