Bug 184751

Summary: Solid::Predicate::isValid causes double free if invalid
Product: [Unmaintained] solid Reporter: Ben Cooksley <bcooksley>
Component: libsolid-frontendAssignee: Kevin Ottens <ervin>
Status: RESOLVED FIXED    
Severity: crash CC: ambrop7
Priority: NOR    
Version First Reported In: unspecified   
Target Milestone: ---   
Platform: Compiled Sources   
OS: Linux   
Latest Commit: Version Fixed In:
Sentry Crash Report:
Bug Depends on:    
Bug Blocks: 184749    

Description Ben Cooksley 2009-02-18 05:33:11 UTC
Version:            (using Devel)
Compiler:          g++ (SUSE Linux) 4.3.2 [gcc-4_3-branch revision 141291] 
OS:                Linux
Installed from:    Compiled sources

If a Solid Predicate is invalid, then isValid() is called on it, it causes a double free error as it tries to quit. This was caused in the Solid Actions KControl Module ( in kdereview currently ). I have attached the glibc backtrace and standard backtraces below, along with invalid predicate:

Predicate = [StorageVolume.ignored == false AND OpticalDisc.isBlank == true AND OpticalDisc.discType & 'CdRecordable|CdRewritable']

=== Glibc Backtrace ===

*** glibc detected *** kcmshell4: double free or corruption (out): 0x082b01d0 ***
======= Backtrace: =========                                                     
/lib/libc.so.6[0xb6ae8654]                                                       
/lib/libc.so.6(cfree+0x9c)[0xb6ae9f3c]                                           
/usr/lib/libstdc++.so.6(_ZdlPv+0x21)[0xb6cc9ec1]                                 
/opt/trunk-kde/kde/lib/libsolid.so.4(_ZN5Solid9PredicateD1Ev+0x53)[0xb61b5b93]   
/opt/trunk-kde/kde/lib/libsolid.so.4[0xb61b75d9]                                 
/opt/trunk-kde/kde/lib/libsolid.so.4[0xb61b94ac]                                 
/opt/trunk-kde/kde/lib/libsolid.so.4[0xb61b992d]                                 
/opt/trunk-kde/kde/lib/libsolid.so.4(_ZN5Solid9Predicate10fromStringERK7QString+0x3d)[0xb61b76ed]                                                                                       
/opt/trunk-kde/kde/lib/kde4/kcm_solid_actions.so[0xb4664f47]                                
/opt/trunk-kde/kde/lib/kde4/kcm_solid_actions.so[0xb4667528]                                
/opt/trunk-kde/qt/lib/libQtCore.so.4(_ZN11QMetaObject8activateEP7QObjectiiPPv+0x228)[0xb78b5d18]                                                                                        
/opt/trunk-kde/qt/lib/libQtCore.so.4(_ZN11QMetaObject8activateEP7QObjectPKS_iiPPv+0x60)[0xb78b6140]                                                                                     
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN15QAbstractButton7clickedEb+0x51)[0xb74d82e1]        
/opt/trunk-kde/qt/lib/libQtGui.so.4[0xb7204be9]                                             
/opt/trunk-kde/qt/lib/libQtGui.so.4[0xb72067e4]                                             
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN15QAbstractButton17mouseReleaseEventEP11QMouseEvent+0x96)[0xb7206a76]                                                                            
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN7QWidget5eventEP6QEvent+0x753)[0xb6e9b773]           
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN15QAbstractButton5eventEP6QEvent+0x3e)[0xb7204a8e]   
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN11QPushButton5eventEP6QEvent+0x40)[0xb72af830]       
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN19QApplicationPrivate13notify_helperEP7QObjectP6QEvent+0xbc)[0xb6e44c3c]                                                                         
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN12QApplication6notifyEP7QObjectP6QEvent+0xa41)[0xb6e4d881]                                                                                       
/opt/trunk-kde/kde/lib/libkdeui.so.5(_ZN12KApplication6notifyEP7QObjectP6QEvent+0x3d)[0xb7e0609d]                                                                                       
/opt/trunk-kde/qt/lib/libQtCore.so.4(_ZN16QCoreApplication14notifyInternalEP7QObjectP6QEvent+0x7b)[0xb789fc0b]                                                                          
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN19QApplicationPrivate14sendMouseEventEP7QWidgetP11QMouseEventS1_S1_PS1_R8QPointerIS0_E+0xde)[0xb6e4c8de]                                         
/opt/trunk-kde/qt/lib/libQtGui.so.4[0xb6ebbe4d]                                             
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN12QApplication15x11ProcessEventEP7_XEvent+0xf5d)[0xb6ebab9d]                                                                                     
/opt/trunk-kde/qt/lib/libQtGui.so.4[0xb6ee43d2]                                             
/usr/lib/libglib-2.0.so.0(g_main_context_dispatch+0x1e8)[0xb63cd9a8]                        
/usr/lib/libglib-2.0.so.0[0xb63d1063]                                                       
/usr/lib/libglib-2.0.so.0(g_main_context_iteration+0x71)[0xb63d1221]                        
/opt/trunk-kde/qt/lib/libQtCore.so.4(_ZN20QEventDispatcherGlib13processEventsE6QFlagsIN10QEventLoop17ProcessEventsFlagEE+0x58)[0xb78cb498]                                              
/opt/trunk-kde/qt/lib/libQtGui.so.4[0xb6ee3b15]                                             
/opt/trunk-kde/qt/lib/libQtCore.so.4(_ZN10QEventLoop13processEventsE6QFlagsINS_17ProcessEventsFlagEE+0x4a)[0xb789e22a]                                                                  
/opt/trunk-kde/qt/lib/libQtCore.so.4(_ZN10QEventLoop4execE6QFlagsINS_17ProcessEventsFlagEE+0xea)[0xb789e66a]                                                                            
/opt/trunk-kde/qt/lib/libQtGui.so.4(_ZN7QDialog4execEv+0x103)[0xb733de63]                   
/opt/trunk-kde/kde/lib/libkdeinit4_kcmshell4.so(kdemain+0x13cd)[0xb8006aad]                 
kcmshell4[0x80486f2]                                                                        
/lib/libc.so.6(__libc_start_main+0xe5)[0xb6a92705]                                          
kcmshell4[0x8048631]                                                                        
======= Memory map: ========                                                                
08048000-08049000 r-xp 00000000 08:02 600619     /opt/trunk-kde/kde/bin/kcmshell4           
08049000-0804a000 r--p 00000000 08:02 600619     /opt/trunk-kde/kde/bin/kcmshell4           
0804a000-0804b000 rw-p 00001000 08:02 600619     /opt/trunk-kde/kde/bin/kcmshell4           
0804b000-082fd000 rw-p 0804b000 00:00 0          [heap]                                     
b4400000-b4421000 rw-p b4400000 00:00 0                                                     
b4421000-b4500000 ---p b4421000 00:00 0                                                     
b45ef000-b45f9000 r-xp 00000000 08:02 1124520    /lib/libnss_files-2.9.so                   
b45f9000-b45fa000 r--p 00009000 08:02 1124520    /lib/libnss_files-2.9.so                   
b45fa000-b45fb000 rw-p 0000a000 08:02 1124520    /lib/libnss_files-2.9.so                   
b461a000-b461b000 rw-p b461a000 00:00 0                                                     
b461b000-b4650000 r--s 00000000 08:02 1084320    /var/run/nscd/passwd                       
b4650000-b4652000 r--p 00000000 08:02 878746     /opt/trunk-kde/kde/share/locale/en_GB/LC_MESSAGES/kdeqt.mo                                                                             
b4652000-b466a000 r-xp 00000000 08:02 861847     /opt/trunk-kde/kde/lib/kde4/kcm_solid_actions.so                                                                                       
b466a000-b466b000 ---p 00018000 08:02 861847     /opt/trunk-kde/kde/lib/kde4/kcm_solid_actions.so                                                                                       
b466b000-b466c000 r--p 00018000 08:02 861847     /opt/trunk-kde/kde/lib/kde4/kcm_solid_actions.so                                                                                       
b466c000-b466d000 rw-p 00019000 08:02 861847     /opt/trunk-kde/kde/lib/kde4/kcm_solid_actions.so                                                                                       
b466d000-b46c3000 r--p 00000000 08:02 1235313    /usr/share/fonts/truetype/arialbd.ttf      
b46c3000-b471d000 r--p 00000000 08:02 1235312    /usr/share/fonts/truetype/arial.ttf        
b471d000-b476a000 r--p 00000000 08:02 1067077    /var/cache/libx11/compose/l4_024_313cb605_00280cc0
b476a000-b48d7000 r--s 00000000 08:02 1067468    /var/tmp/kdecacheKCrash: Application 'kcmshell4' crashing...
sock_file=/home/trunk/.kde4-trunk/socket-grace/kdeinit4__0

=== Standard Backtrace ===

[Thread debugging using libthread_db enabled]                                        
[Current thread is 1 (Thread 0xb5fa1920 (LWP 10807))]                                

Thread 1 (Thread 0xb5fa1920 (LWP 10807)):
[KCrash Handler]                         
#6  0xffffe430 in __kernel_vsyscall ()   
#7  0xb6aa6990 in raise () from /lib/libc.so.6
#8  0xb6aa82c8 in abort () from /lib/libc.so.6
#9  0xb6ae26c5 in ?? () from /lib/libc.so.6   
#10 0xb6ae8654 in ?? () from /lib/libc.so.6   
#11 0xb6ae9f3c in free () from /lib/libc.so.6 
#12 0xb6cc9ec1 in operator delete(void*) () from /usr/lib/libstdc++.so.6
#13 0xb61b5b93 in ~Predicate (this=0x821c908) at /home/trunk/kdesvn/kdelibs/solid/solid/predicate.cpp:120                                                                               
#14 0xb61b75d9 in PredicateParse_errorDetected () at /home/trunk/kdesvn/kdelibs/solid/solid/predicateparse.cpp:62                                                                       
#15 0xb61b94ac in Soliderror (s=0xb61f4e9d "syntax error") at predicate_parser.y:74         
#16 0xb61b992d in Solidparse () at predicate_parser.tab.c:1487                              
#17 0xb61b76ed in Solid::Predicate::fromString (predicate=@0xbff27964) at /home/trunk/kdesvn/kdelibs/solid/solid/predicateparse.cpp:37                                                  
#18 0xb4664f47 in SolidActions::editAction (this=0x81df2b8) at /home/trunk/solid-actions-kcontrol/solid-actions.cpp:133                                                                 
#19 0xb4667528 in SolidActions::qt_metacall (this=0x81df2b8, _c=QMetaObject::InvokeMetaMethod, _id=1, _a=0xbff27a8c) at /home/trunk/manual-source/solid-actions-kcontrol-build/solid-actions.moc:80                                                                                 
#20 0xb78b5d18 in QMetaObject::activate (sender=0x81979b0, from_signal_index=29, to_signal_index=30, argv=0xbff27a8c) at /home/trunk/kdesvn/qt-copy/src/corelib/kernel/qobject.cpp:3064 
#21 0xb78b6140 in QMetaObject::activate (sender=0x81979b0, m=0xb76ba2a4, from_local_signal_index=2, to_local_signal_index=3, argv=0xbff27a8c)                                           
    at /home/trunk/kdesvn/qt-copy/src/corelib/kernel/qobject.cpp:3156                       
#22 0xb74d82e1 in QAbstractButton::clicked (this=0x81979b0, _t1=false) at .moc/release-shared/moc_qabstractbutton.cpp:200                                                               
#23 0xb7204be9 in QAbstractButtonPrivate::emitClicked (this=0x81fbd88) at /home/trunk/kdesvn/qt-copy/src/gui/widgets/qabstractbutton.cpp:538                                            
#24 0xb72067e4 in QAbstractButtonPrivate::click (this=0x81fbd88) at /home/trunk/kdesvn/qt-copy/src/gui/widgets/qabstractbutton.cpp:531                                                  
#25 0xb7206a76 in QAbstractButton::mouseReleaseEvent (this=0x81979b0, e=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/gui/widgets/qabstractbutton.cpp:1110                              
#26 0xb6e9b773 in QWidget::event (this=0x81979b0, event=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qwidget.cpp:7511                                                       
#27 0xb7204a8e in QAbstractButton::event (this=0x81979b0, e=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/gui/widgets/qabstractbutton.cpp:1072                                          
#28 0xb72af830 in QPushButton::event (this=0x81979b0, e=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/gui/widgets/qpushbutton.cpp:657                                                   
#29 0xb6e44c3c in QApplicationPrivate::notify_helper (this=0x80649f8, receiver=0x81979b0, e=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qapplication.cpp:4051              
#30 0xb6e4d881 in QApplication::notify (this=0xbff28b60, receiver=0x81979b0, e=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qapplication.cpp:3753                           
#31 0xb7e0609d in KApplication::notify (this=0xbff28b60, receiver=0x81979b0, event=0xbff2812c) at /home/trunk/kdesvn/kdelibs/kdeui/kernel/kapplication.cpp:307                          
#32 0xb789fc0b in QCoreApplication::notifyInternal (this=0xbff28b60, receiver=0x81979b0, event=0xbff2812c) at /home/trunk/kdesvn/qt-copy/src/corelib/kernel/qcoreapplication.cpp:594    
#33 0xb6e4c8de in QApplicationPrivate::sendMouseEvent (receiver=0x81979b0, event=0xbff2812c, alienWidget=0x81979b0, nativeWidget=0x81df2b8, buttonDown=0xb76c7100, lastMouseReceiver=@0xb76c7104)                                                                                   
    at ../../include/QtCore/../../../../qt-copy/src/corelib/kernel/qcoreapplication.h:211   
#34 0xb6ebbe4d in QETWidget::translateMouseEvent (this=0x81df2b8, event=0xbff2868c) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qapplication_x11.cpp:4414                              
#35 0xb6ebab9d in QApplication::x11ProcessEvent (this=0xbff28b60, event=0xbff2868c) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qapplication_x11.cpp:3532
#36 0xb6ee43d2 in x11EventSourceDispatch (s=0x80678c8, callback=0, user_data=0x0) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qguieventdispatcher_glib.cpp:141
#37 0xb63cd9a8 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#38 0xb63d1063 in ?? () from /usr/lib/libglib-2.0.so.0
#39 0xb63d1221 in g_main_context_iteration () from /usr/lib/libglib-2.0.so.0
#40 0xb78cb498 in QEventDispatcherGlib::processEvents (this=0x80522e0, flags={i = -1074624440}) at /home/trunk/kdesvn/qt-copy/src/corelib/kernel/qeventdispatcher_glib.cpp:318
#41 0xb6ee3b15 in QGuiEventDispatcherGlib::processEvents (this=0x80522e0, flags={i = -1074624392}) at /home/trunk/kdesvn/qt-copy/src/gui/kernel/qguieventdispatcher_glib.cpp:197
#42 0xb789e22a in QEventLoop::processEvents (this=0xbff288ec, flags={i = -1074624328}) at /home/trunk/kdesvn/qt-copy/src/corelib/kernel/qeventloop.cpp:144
#43 0xb789e66a in QEventLoop::exec (this=0xbff288ec, flags={i = -1074624268}) at /home/trunk/kdesvn/qt-copy/src/corelib/kernel/qeventloop.cpp:195
#44 0xb733de63 in QDialog::exec (this=0x815cbf0) at /home/trunk/kdesvn/qt-copy/src/gui/dialogs/qdialog.cpp:493
#45 0xb8006aad in kdemain (_argc=2, _argv=0xbff28db4) at /home/trunk/kdesvn/kdebase/runtime/kcmshell/main.cpp:275
#46 0x080486f2 in main (argc=) at /home/trunk/kdesvn/build/kdebase/runtime/kcmshell/kcmshell4_dummy.cpp:3

=== End Backtrace ===
Comment 1 Kevin Ottens 2009-02-27 16:03:21 UTC
SVN commit 932881 by ervin:

Slightly rework the parser to be more careful about what we consider as
the result predicate (if the former result is used in a compound
predicate it's not the result anymore). It avoid the double freeing.

And since we're at it also plug some memory leaks in there by forcing
the lexer to cleanup its memory when the parsing is over and by
providing %destructor sections to the bison parser to clean memory
correctly on parse errors.

BUGS: 184751



 M  +72 -16    solid/predicate_lexer.c  
 M  +46 -24    solid/predicate_parser.c  
 M  +1 -1      solid/predicate_parser.h  
 M  +7 -0      solid/predicate_parser.y  
 M  +17 -1     solid/predicateparse.cpp  
 M  +1 -0      solid/predicateparse.h  
 M  +3 -0      tests/solidhwtest.cpp  


WebSVN link: http://websvn.kde.org/?view=rev&revision=932881
Comment 2 Kevin Ottens 2009-02-28 11:30:46 UTC
*** Bug 184710 has been marked as a duplicate of this bug. ***