Segfault when running seafile_get_repo_list inside nautilus extension

[benruijl]

After the update from openssl-1.0 to openssl-1.1, calling seafile_get_repo_list crashes when called from nautilus. Valgrind gives the following ouput:

==12676== Conditional jump or move depends on uninitialised value(s)
==12676==    at 0xE531CE1: json_node_get_node_type (in /usr/lib/libjson-glib-1.0.so.0.200.8)
==12676==    by 0xE52F707: json_gobject_deserialize (in /usr/lib/libjson-glib-1.0.so.0.200.8)
==12676==    by 0x21D7ABA9: ??? (in /usr/lib/libsearpc.so.1.0.2)
==12676==    by 0x21D7BBB3: searpc_client_call__objlist (in /usr/lib/libsearpc.so.1.0.2)
==12676==    by 0x223F6398: seafile_get_repo_list (in /usr/lib/libseafile.so.0.0.0)
==12676==    by 0x21957ECA: nautilus_module_initialize (test.c:108)
==12676==    by 0x48403D: ??? (in /usr/bin/nautilus)
==12676==    by 0x7104610: g_type_module_use (in /usr/lib/libgobject-2.0.so.0.5200.1)
==12676==    by 0x4842E3: nautilus_module_setup (in /usr/bin/nautilus)
==12676==    by 0x444962: nautilus_application_startup_common (in /usr/bin/nautilus)
==12676==    by 0x70DDF74: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.5200.1)
==12676==    by 0x70EF95B: ??? (in /usr/lib/libgobject-2.0.so.0.5200.1)
==12676== 

(nautilus:12676): Json-CRITICAL **: json_node_get_node_type: assertion 'JSON_NODE_IS_VALID (node)' failed

(nautilus:12676): Json-CRITICAL **: json_gobject_deserialize: assertion 'JSON_NODE_TYPE (node) == JSON_NODE_OBJECT' failed

and gdb gives:

Thread 1 "nautilus" received signal SIGSEGV, Segmentation fault.
0x00007fffee4dc475 in json_object_get_size () from /usr/lib/libjson-glib-1.0.so.0
(gdb) bt
#0  0x00007fffee4dc475 in json_object_get_size () at /usr/lib/libjson-glib-1.0.so.0
#1  0x00007fffee4d6cbb in  () at /usr/lib/libjson-glib-1.0.so.0
#2  0x00007fffcd22bbaa in  () at /usr/lib/libsearpc.so.1
#3  0x00007fffcd22cbb4 in searpc_client_call.objlist () at /usr/lib/libsearpc.so.1
#4  0x00007fffccbc1399 in seafile_get_repo_list () at /usr/lib/libseafile.so.0
#5  0x00007fffcd64fecb in nautilus_module_initialize (module=0xd5f4c0) at test.c:108
#6  0x000000000048403e in  ()
#7  0x00007ffff5927611 in g_type_module_use () at /usr/lib/libgobject-2.0.so.0
#8  0x00000000004842e4 in nautilus_module_setup ()
#9  0x0000000000444963 in nautilus_application_startup_common ()
#10 0x00007ffff5900f75 in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#11 0x00007ffff591295c in  () at /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff591bbdc in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#13 0x00007ffff591bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#14 0x00007ffff5be23e2 in g_application_register () at /usr/lib/libgio-2.0.so.0
#15 0x00007ffff5be2c0f in  () at /usr/lib/libgio-2.0.so.0
#16 0x00007ffff5be2f72 in g_application_run () at /usr/lib/libgio-2.0.so.0
#17 0x000000000044092b in main ()

Because of this bug, the nautilus extension for the client cannot be used anymore.

Here is a minimal example that demonstrates the crash:
https://gist.github.com/benruijl/6e68d7e905c8f2a17e8462f74efc9b2a

[killing]

Which version of seaf-daemon do you use?

[benruijl]

I am using the latest stable release for all seafile components:

seafile: 6.0.4
seafile-client: 6.0.4
ccnet: 6.0.4
ccnet-server: 6.0.10
libsearpc: 1:3.0.8

[benruijl]

Does this give you enough information? It would be really nice if I can get the nautilus plugin working again.

Perhaps you can see if you can reproduce the crash using the minimal example?

[benruijl]

Could you have a look at this? The nautilus extension is very convenient, but cannot be used now.

[shoeper]

@killing

[benruijl]

Maybe the issue is in libsearpc:

==3536== Invalid read of size 8
==3536==    at 0x24BD98B3: searpc_client_transport_send (in /usr/lib/libsearpc.so.1.0.2)
==3536==    by 0x24BDA3A5: searpc_client_call__objlist (in /usr/lib/libsearpc.so.1.0.2)
==3536==    by 0x249CD85A: seafile_get_repo_list (in /usr/lib/libseafile.so.0.0.0)
==3536==    by 0x2434AE99: nautilus_module_initialize (test.c:108)
==3536==    by 0x1B1922: ??? (in /usr/bin/nautilus)
==3536==    by 0x75CAF04: g_type_module_use (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x1BA3B9: nautilus_module_setup (in /usr/bin/nautilus)
==3536==    by 0x153067: nautilus_application_startup_common (in /usr/bin/nautilus)
==3536==    by 0x75A2A4C: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x75B5F17: ??? (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x75BE6F5: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x75BF12F: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==  Address 0x8 is not stack'd, malloc'd or (recently) free'd
==3536== 
==3536== 
==3536== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==3536==  Access not within mapped region at address 0x8
==3536==    at 0x24BD98B3: searpc_client_transport_send (in /usr/lib/libsearpc.so.1.0.2)
==3536==    by 0x24BDA3A5: searpc_client_call__objlist (in /usr/lib/libsearpc.so.1.0.2)
==3536==    by 0x249CD85A: seafile_get_repo_list (in /usr/lib/libseafile.so.0.0.0)
==3536==    by 0x2434AE99: nautilus_module_initialize (test.c:108)
==3536==    by 0x1B1922: ??? (in /usr/bin/nautilus)
==3536==    by 0x75CAF04: g_type_module_use (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x1BA3B9: nautilus_module_setup (in /usr/bin/nautilus)
==3536==    by 0x153067: nautilus_application_startup_common (in /usr/bin/nautilus)
==3536==    by 0x75A2A4C: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x75B5F17: ??? (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x75BE6F5: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==    by 0x75BF12F: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.5600.1)
==3536==  If you believe this happened as a result of a stack
==3536==  overflow in your program's main thread (unlikely but
==3536==  possible), you can try to increase the size of the
==3536==  main thread stack using the --main-stacksize= flag.
==3536==  The main thread stack size used in this run was 8388608.
==3536==