When using poll and many printers cupsd sigsegvs

[michaelrsweet]

Version: 1.2.1
CUPS.org User: SmallOne

When using poll to fetch 500 printers from two servers cupsd dies with a segfault. The two servers has an identical setup with printers to that the client should build implicit classes.

When we reload cupsd on the client it dies with a segfault.

We use rhel 4 on client and servers. And we have compiled the rpms ourselves from source.

See the backtrace from the client.
#0 0x0069a498 in strcasecmp () from /lib/tls/libc.so.6
#1 0x080811aa in compare_printers ()
#2 0x009a3940 in cups_array_find (a=0x9ae4a98, e=0x9af19a8, prev=499,

rdiff=0xbff81618) at array.c:859

#3 0x009a3e09 in cups_array_add (a=0x9ae4a98, e=0x9af19a8, insert=0)

at array.c:739

#4 0x0806068c in process_implicit_classes ()
#5 0x08062475 in cupsdLoadRemoteCache ()
#6 0x0805ee96 in cupsdReadConfiguration ()
#7 0x08065752 in main ()

(gdb) bt full
#0 0x0069a498 in strcasecmp () from /lib/tls/libc.so.6

No symbol table info available.
#1 0x080811aa in compare_printers ()

No symbol table info available.
#2 0x004dc940 in cups_array_find (a=0x9042a98, e=0x904f9a8, prev=499,

rdiff=0xbff8b218) at array.c:859
    left = Variable "left" is not available.

[michaelrsweet]

CUPS.org User: mike

Please attach your /var/cache/cups/remote.cache file so that we can duplicate the problem here.

[michaelrsweet]

CUPS.org User: mike

Hmm, I just tested this against trunk on a RH9 system and was not able to reproduce this problem.

Can you re-test against the current 1.3.x snapshot or the current 1.2.x SVN code?

[michaelrsweet]

CUPS.org User: SmallOne

Still the same problem.

killall -HUP cupsd should reload

It reloads all and right after it dies.

gdb first says SIGHUP wich is right
But when i continue i get SIGSEGV with the same backtrace as before.

/Johan

[michaelrsweet]

CUPS.org User: SmallOne

Forgot. Its the 1.2.x branch im testing atm.

[michaelrsweet]

CUPS.org User: mike

OK, after some more testing with a fresh test build I was able to reproduce the reload crashing. Please try the attached patch to see if it corrects the bug on your end (it does for me...)

[michaelrsweet]

CUPS.org User: SmallOne

It works. Great job. Ive tested it on several machines.

/Johan

[michaelrsweet]

"str1828.patch":

Index: dirsvc.c

--- dirsvc.c (revision 5721)
+++ dirsvc.c (working copy)
@@ -212,10 +212,11 @@
else
p = cupsdAddPrinter(value);

• p->accepting = 1;
• p->state = IPP_PRINTER_IDLE;
• p->type |= CUPS_PRINTER_REMOTE;
• p->browse_time = now + BrowseTimeout;
• p->accepting = 1;
• p->state = IPP_PRINTER_IDLE;
• p->type |= CUPS_PRINTER_REMOTE;
• p->browse_time = now;
• p->browse_expire = now + BrowseTimeout;

/*
 * Set the default printer as needed...

@@ -252,10 +253,11 @@
else
p = cupsdAddClass(value);

• p->accepting = 1;
• p->state = IPP_PRINTER_IDLE;
• p->type |= CUPS_PRINTER_REMOTE;
• p->browse_time = now + BrowseTimeout;
• p->accepting = 1;
• p->state = IPP_PRINTER_IDLE;
• p->type |= CUPS_PRINTER_REMOTE;
• p->browse_time = now;
• p->browse_expire = now + BrowseTimeout;

/*
 * Set the default printer as needed...

@@ -416,8 +418,8 @@
{
time_t t = atoi(value);

• if (t > (now + BrowseInterval))

•      p->browse_time = t;
  

• if (t > p->browse_expire)

•      p->browse_expire = t;
  

  }
  else
  {
  @@ -591,7 +593,7 @@

  cupsFilePrintf(fp, "Type %d\n", printer->type);

• cupsFilePrintf(fp, "BrowseTime %d\n", (int)printer->browse_time);

• cupsFilePrintf(fp, "BrowseTime %d\n", (int)printer->browse_expire);

if (printer->info)
cupsFilePrintf(fp, "Info %s\n", printer->info);

Index: printers.c

--- printers.c (revision 5721)
+++ printers.c (working copy)
@@ -642,6 +642,9 @@

cupsArrayRemove(Printers, p);

• if (p->type & CUPS_PRINTER_IMPLICIT)
• cupsArrayRemove(ImplicitPrinters, p);

/*

• Remove the dummy interface/icon/option files under IRIX...
  */
  @@ -1257,6 +1260,7 @@
  */

cupsArrayAdd(Printers, p);
+
if (p->type & CUPS_PRINTER_IMPLICIT)
cupsArrayAdd(ImplicitPrinters, p);
}