[Vortex] invalid write in __vortex_channel_common_rpy

DEXTER mydexterid at gmail.com
Thu Jul 15 14:41:22 CEST 2010


Hi Francis,

We're investigating an issue with our program, and running it with
valgrind we got this relative often:
==2743== Invalid write of size 4
==2743==    at 0x5B0C78F: __vortex_channel_common_rpy (in
/usr/lib/libvortex.so.0.0.0)
==2743==    by 0x564B3B5:
MessageTransportServer::response(Glib::RefPtr<Message const>,
DBTransactionMsg::ResponseType, MessageId) (transport.cc:471)
==2743==    by 0x564F896:
sigc::internal::slot_call2<sigc::bind_functor<-1,
sigc::bound_mem_functor3<void, MessageTransportServer,
Glib::RefPtr<Message const>, DBTransactionMsg::ResponseType,
MessageId>, MessageId, sigc::nil, MessageId, MessageId, MessageId,
MessageId, MessageId>, void, Glib::RefPtr<Message const>,
DBTransactionMsg::ResponseType>::call_it(sigc::internal::slot_rep*,
Glib::RefPtr<Message const> const&, DBTransactionMsg::ResponseType
const&) (mem_fun.h:1985)
==2743==    by 0x564FCBC:
MessageCondAsyncTransportImpl::signal(Glib::RefPtr<MessageHandler>)
(slot.h:593)
==2743==    by 0x563A9CD:
MessageHandler::push_response(Glib::RefPtr<Message const>,
DBTransactionMsg::ResponseType) (transport.cc:233)
==2743==    by 0x564F93A:
sigc::internal::slot_call2<sigc::bound_mem_functor2<void,
MessageHandler, Glib::RefPtr<Message const>,
DBTransactionMsg::ResponseType>, void, Glib::RefPtr<Message const>,
DBTransactionMsg::ResponseType>::call_it(sigc::internal::slot_rep*,
Glib::RefPtr<Message const> const&, DBTransactionMsg::ResponseType
const&) (mem_fun.h:1917)
==2743==    by 0x4E9BF38:
MessageProcEngineDatabase::process_messages_impl(DBTransactionMsg
const*) (slot.h:593)
==2743==    by 0x563A05B: MessageProcThread::process_messages()
(transport.cc:308)
==2743==    by 0x6F0AD31: (within /usr/lib/libglibmm-2.4.so.1.2.0)
==2743==    by 0x75D4D23: (within /usr/lib/libglib-2.0.so.0.2000.0)
==2743==    by 0x652D3F6: start_thread (in /lib/libpthread-2.7.so)
==2743==    by 0x8E23B4C: clone (in /lib/libc-2.7.so)
==2743==  Address 0x1031a010 is 456 bytes inside a block of size 744 free'd
==2743==    at 0x4C21B2E: free (vg_replace_malloc.c:323)
==2743==    by 0x5B0D95A: __vortex_channel_0_frame_received_close_msg
(in /usr/lib/libvortex.so.0.0.0)
==2743==    by 0x5B0A603: __vortex_channel_invoke_received_handler (in
/usr/lib/libvortex.so.0.0.0)
==2743==    by 0x5B155FF: __vortex_thread_pool_dispatcher (in
/usr/lib/libvortex.so.0.0.0)
==2743==    by 0x652D3F6: start_thread (in /lib/libpthread-2.7.so)
==2743==    by 0x8E23B4C: clone (in /lib/libc-2.7.so)

The attached patch seems to fix this problem. (but maybe it was
intended to set the being_sending variable after unlocking the mutex?)
We're still using the old 1.0.17.b3739.g3739 version.

cheers.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: vortex_channel_common_rpy.patch
Type: text/x-patch
Size: 497 bytes
Desc: not available
URL: <http://lists.aspl.es/pipermail/vortex/attachments/20100715/d4dd1bdc/attachment.bin>


More information about the Vortex mailing list