Skip to content
This repository was archived by the owner on Sep 30, 2020. It is now read-only.
This repository was archived by the owner on Sep 30, 2020. It is now read-only.

segfault when opening 3D view #440

@implr

Description

@implr

File: inject.bin from "True Detective" CTFZone quals 2018

gdb-peda$ set follow-fork-mode parent
gdb-peda$ r
Starting program: /home/bartek/dev/veles/build/veles 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffead24700 (LWP 25927)]
[New Thread 0x7fffce560700 (LWP 26498)]
[New Thread 0x7fffcdb56700 (LWP 26499)]
[New Thread 0x7fffccec0700 (LWP 26517)]
[New Thread 0x7fffbffff700 (LWP 26518)]
[New Thread 0x7fffbf7fe700 (LWP 26519)]
[New Thread 0x7fffbeffd700 (LWP 26520)]
kf5.kio.core: We got some errors while running 'net usershare info'
kf5.kio.core: "mkdir failed on directory /var/lock/samba/msg.lock: Permission denied\n"
qt.qpa.xcb: QXcbConnection: XCB error: 3 (BadWindow), sequence: 3086, resource id: 44044640, major code: 40 (TranslateCoords), minor code: 0

Thread 1 "veles" received signal SIGSEGV, Segmentation fault.
[----------------------------------registers-----------------------------------]
RAX: 0x8 
RBX: 0x55555690cf78 --> 0x55555633d490 --> 0x55555653a800 --> 0x0 
RCX: 0x0 
RDX: 0x5555562d9580 --> 0x7ffff7da6390 --> 0x7ffff76f0640 (<QBoxLayoutPrivate::~QBoxLayoutPrivate()>:   lea    rax,[rip+0x6b5d49]        # 0x7ffff7da6390 <_ZTV17QBoxLayoutPrivate+16>)
RSI: 0x0 
RDI: 0x0 
RBP: 0x7fffffffbd20 --> 0x7ffff66d6630 --> 0x7ffff62713e0 (<QEvent::~QEvent()>: mov    rax,QWORD PTR [rip+0x467981]        # 0x7ffff66d8d68)
RSP: 0x7fffffffbd20 --> 0x7ffff66d6630 --> 0x7ffff62713e0 (<QEvent::~QEvent()>: mov    rax,QWORD PTR [rip+0x467981]        # 0x7ffff66d8d68)
RIP: 0x7ffff777f96e (<updateObjects(QList<QObject const*> const&)+238>: test   BYTE PTR [rax+0x20],0x1)
R8 : 0xffffffff 
R9 : 0x0 
R10: 0xffffffff 
R11: 0x555555a23010 --> 0x101040407010504 
R12: 0x55555633d490 --> 0x55555653a800 --> 0x0 
R13: 0x55555690d298 --> 0x0 
R14: 0x555556913f10 --> 0x555556915ac0 --> 0x5555562c0de0 --> 0x7ffff7db7400 --> 0x7ffff7869ef0 (<QScrollBar::metaObject() const>:      mov    rdi,QWORD PTR [rdi+0x8])
R15: 0x7fffffffbdf8 --> 0x555556913ee0 --> 0x600000001
EFLAGS: 0x10206 (carry PARITY adjust zero sign trap INTERRUPT direction overflow)
[-------------------------------------code-------------------------------------]
   0x7ffff777f964 <updateObjects(QList<QObject const*> const&)+228>:    test   r12,r12
   0x7ffff777f967 <updateObjects(QList<QObject const*> const&)+231>:    je     0x7ffff777f958 <updateObjects(QList<QObject const*> const&)+216>
   0x7ffff777f969 <updateObjects(QList<QObject const*> const&)+233>:    mov    rax,QWORD PTR [r12+0x8]
=> 0x7ffff777f96e <updateObjects(QList<QObject const*> const&)+238>:    test   BYTE PTR [rax+0x20],0x1
   0x7ffff777f972 <updateObjects(QList<QObject const*> const&)+242>:    je     0x7ffff777f958 <updateObjects(QList<QObject const*> const&)+216>
   0x7ffff777f974 <updateObjects(QList<QObject const*> const&)+244>:    mov    rdi,r12
   0x7ffff777f977 <updateObjects(QList<QObject const*> const&)+247>:    add    rbx,0x8
   0x7ffff777f97b <updateObjects(QList<QObject const*> const&)+251>:    call   0x7ffff7702b30 <QWidget::style() const>
[------------------------------------stack-------------------------------------]
0000| 0x7fffffffbd20 --> 0x7ffff66d6630 --> 0x7ffff62713e0 (<QEvent::~QEvent()>:        mov    rax,QWORD PTR [rip+0x467981]        # 0x7ffff66d8d68)
0008| 0x7fffffffbd28 --> 0x0 
0016| 0x7fffffffbd30 --> 0x5555562c0064 --> 0xff414141ff414141 
0024| 0x7fffffffbd38 --> 0x117712dd376c7e00 
0032| 0x7fffffffbd40 --> 0x7fffffffbd80 --> 0x5555562ccce0 --> 0x555555a15050 --> 0x555555658420 (<veles::ui::DockWidget::metaObject() const>:  mov    rdi,QWORD PTR [rdi+0x8])
0040| 0x7fffffffbd48 --> 0x7fffffffbd78 --> 0x55555690c7b0 --> 0x1fe00000001 
0048| 0x7fffffffbd50 --> 0x7fffffffbd80 --> 0x5555562ccce0 --> 0x555555a15050 --> 0x555555658420 (<veles::ui::DockWidget::metaObject() const>:  mov    rdi,QWORD PTR [rdi+0x8])
0056| 0x7fffffffbd58 --> 0x5555562ccce0 --> 0x555555a15050 --> 0x555555658420 (<veles::ui::DockWidget::metaObject() const>:     mov    rdi,QWORD PTR [rdi+0x8])
[------------------------------------------------------------------------------]
Legend: code, data, rodata, value
Stopped reason: SIGSEGV
qobject_cast<QWidget*> (o=0x55555633d490) at ../../src/widgets/kernel/qwidget.h:741
741         if (!o || !o->isWidgetType()) return nullptr;
gdb-peda$ bt
#0  qobject_cast<QWidget*> (o=0x55555633d490) at ../../src/widgets/kernel/qwidget.h:741
#1  updateObjects (objects=...) at styles/qstylesheetstyle.cpp:2706
#2  0x00007ffff777fa98 in QStyleSheetStyle::repolish (this=<optimized out>, w=w@entry=0x5555562ccce0) at styles/qstylesheetstyle.cpp:2882
#3  0x00007ffff770c7d0 in QWidget::setStyleSheet (this=this@entry=0x5555562ccce0, styleSheet=...) at kernel/qwidget.cpp:2674
#4  0x00005555556c3d0b in veles::ui::MainWindowWithDetachableDockWidgets::updateActiveDockWidget (this=this@entry=0x555555be2800) at /home/bartek/dev/veles/src/ui/mainwindowwithdetachabledockwidgets.cc:607
#5  0x00005555556c3f39 in veles::ui::MainWindowWithDetachableDockWidgets::updateDocksAndTabs (this=0x555555be2800) at /home/bartek/dev/veles/src/ui/mainwindowwithdetachabledockwidgets.cc:623
#6  0x00007ffff6292e9a in QObject::event (this=this@entry=0x555556592900, e=e@entry=0x5555565e79a0) at kernel/qobject.cpp:1251
#7  0x00007ffff771c253 in QWidget::event (this=this@entry=0x555556592900, event=event@entry=0x5555565e79a0) at kernel/qwidget.cpp:9347
#8  0x00007ffff77f3763 in QDockWidget::event (this=0x555556592900, event=0x5555565e79a0) at widgets/qdockwidget.cpp:1604
#9  0x00007ffff76dce0c in QApplicationPrivate::notify_helper (this=this@entry=0x555555a3d020, receiver=receiver@entry=0x555556592900, e=e@entry=0x5555565e79a0) at kernel/qapplication.cpp:3727
#10 0x00007ffff76e43cf in QApplication::notify (this=0x7fffffffd3d0, receiver=0x555556592900, e=0x5555565e79a0) at kernel/qapplication.cpp:3486
#11 0x00007ffff6268c57 in QCoreApplication::notifyInternal2 (receiver=0x555556592900, event=event@entry=0x5555565e79a0) at kernel/qcoreapplication.cpp:1048
#12 0x00007ffff626bab1 in QCoreApplication::sendEvent (event=0x5555565e79a0, receiver=<optimized out>) at kernel/qcoreapplication.h:234
#13 QCoreApplicationPrivate::sendPostedEvents (receiver=receiver@entry=0x0, event_type=event_type@entry=0x0, data=0x555555a3d1a0) at kernel/qcoreapplication.cpp:1745
#14 0x00007ffff626c028 in QCoreApplication::sendPostedEvents (receiver=receiver@entry=0x0, event_type=event_type@entry=0x0) at kernel/qcoreapplication.cpp:1599
#15 0x00007ffff62bbce3 in postEventSourceDispatch (s=s@entry=0x555555abe160) at kernel/qeventdispatcher_glib.cpp:276
#16 0x00007ffff3320ab7 in g_main_dispatch (context=0x7fffe4004ff0) at /usr/src/debug/dev-libs/glib-2.54.3-r6/glib-2.54.3/glib/gmain.c:3142
#17 g_main_context_dispatch (context=context@entry=0x7fffe4004ff0) at /usr/src/debug/dev-libs/glib-2.54.3-r6/glib-2.54.3/glib/gmain.c:3795
#18 0x00007ffff3320cf0 in g_main_context_iterate (context=context@entry=0x7fffe4004ff0, block=block@entry=0x0, dispatch=dispatch@entry=0x1, self=<optimized out>) at /usr/src/debug/dev-libs/glib-2.54.3-r6/glib-2.54.3/glib/gmain.c:3868
#19 0x00007ffff3320d7c in g_main_context_iteration (context=0x7fffe4004ff0, may_block=may_block@entry=0x0) at /usr/src/debug/dev-libs/glib-2.54.3-r6/glib-2.54.3/glib/gmain.c:3929
#20 0x00007ffff62bbacf in QEventDispatcherGlib::processEvents (this=0x555555abe9d0, flags=...) at kernel/qeventdispatcher_glib.cpp:423
#21 0x00007fffed9f8fc1 in QPAEventDispatcherGlib::processEvents (this=0x555555abe9d0, flags=...) at qeventdispatcher_glib.cpp:69
#22 0x00005555556c3788 in veles::ui::MainWindowWithDetachableDockWidgets::updateActiveDockWidget (this=this@entry=0x555555be2800) at /home/bartek/dev/veles/src/ui/mainwindowwithdetachabledockwidgets.cc:563
#23 0x00005555556c3f39 in veles::ui::MainWindowWithDetachableDockWidgets::updateDocksAndTabs (this=0x555555be2800) at /home/bartek/dev/veles/src/ui/mainwindowwithdetachabledockwidgets.cc:623
#24 0x00007ffff6292277 in QtPrivate::QSlotObjectBase::call (a=0x7fffffffc5d0, r=0x555555be2800, this=0x5555565e6f00) at ../../src/corelib/kernel/qobjectdefs_impl.h:376
#25 QMetaObject::activate (sender=sender@entry=0x555556592900, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=0x4, argv=argv@entry=0x7fffffffc5d0) at kernel/qobject.cpp:3754
#26 0x00007ffff62927c7 in QMetaObject::activate (sender=sender@entry=0x555556592900, m=m@entry=0x7ffff7db1ac0 <QDockWidget::staticMetaObject>, local_signal_index=local_signal_index@entry=0x4, argv=argv@entry=0x7fffffffc5d0) at kernel/qobject.cpp:3633
#27 0x00007ffff77ef111 in QDockWidget::dockLocationChanged (this=this@entry=0x555556592900, _t1=<optimized out>) at .moc/moc_qdockwidget.cpp:308
#28 0x00007ffff782789c in QMainWindowLayout::tabifyDockWidget (this=0x555555c7d1f0, first=0x555556131540, second=0x555556592900) at widgets/qmainwindowlayout.cpp:1503
#29 0x00007ffff7823110 in QMainWindow::tabifyDockWidget (this=<optimized out>, first=<optimized out>, second=<optimized out>) at widgets/qmainwindow.cpp:1159
#30 0x00005555556c44c0 in veles::ui::MainWindowWithDetachableDockWidgets::addTab (this=this@entry=0x555555be2800, widget=widget@entry=0x555556561b70, title=..., sibling=sibling@entry=0x0) at /home/bartek/dev/veles/src/ui/mainwindowwithdetachabledockwidgets.cc:120
#31 0x00005555556c4aea in veles::ui::MainWindowWithDetachableDockWidgets::createVisualization (this=0x555555be2800, data_model=...) at /home/bartek/dev/veles/src/ui/mainwindowwithdetachabledockwidgets.cc:729
#32 0x00007ffff6292277 in QtPrivate::QSlotObjectBase::call (a=0x7fffffffc7e0, r=0x55555627dbf0, this=0x5555562cd780) at ../../src/corelib/kernel/qobjectdefs_impl.h:376
#33 QMetaObject::activate (sender=sender@entry=0x555556352820, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=0x1, argv=argv@entry=0x7fffffffc7e0) at kernel/qobject.cpp:3754
#34 0x00007ffff62927c7 in QMetaObject::activate (sender=sender@entry=0x555556352820, m=m@entry=0x7ffff7da8840 <QAction::staticMetaObject>, local_signal_index=local_signal_index@entry=0x1, argv=argv@entry=0x7fffffffc7e0) at kernel/qobject.cpp:3633
#35 0x00007ffff76d6702 in QAction::triggered (this=this@entry=0x555556352820, _t1=<optimized out>) at .moc/moc_qaction.cpp:376
#36 0x00007ffff76d8d3c in QAction::activate (this=0x555556352820, event=<optimized out>) at kernel/qaction.cpp:1167
#37 0x00007ffff77c3b9b in QAbstractButtonPrivate::click (this=0x5555563bade0) at widgets/qabstractbutton.cpp:397
#38 0x00007ffff77c3dfd in QAbstractButton::mouseReleaseEvent (this=0x55555633c1a0, e=0x7fffffffccb0) at widgets/qabstractbutton.cpp:1011
#39 0x00007ffff78b26ca in QToolButton::mouseReleaseEvent (this=<optimized out>, e=<optimized out>) at widgets/qtoolbutton.cpp:622
#40 0x00007ffff771bb48 in QWidget::event (this=0x55555633c1a0, event=0x7fffffffccb0) at kernel/qwidget.cpp:9281
#41 0x00007ffff77c4fbb in QAbstractButton::event (this=this@entry=0x55555633c1a0, e=e@entry=0x7fffffffccb0) at widgets/qabstractbutton.cpp:968
#42 0x00007ffff78b2764 in QToolButton::event (this=0x55555633c1a0, event=0x7fffffffccb0) at widgets/qtoolbutton.cpp:985
#43 0x00007ffff76dce0c in QApplicationPrivate::notify_helper (this=this@entry=0x555555a3d020, receiver=receiver@entry=0x55555633c1a0, e=e@entry=0x7fffffffccb0) at kernel/qapplication.cpp:3727
#44 0x00007ffff76e4f67 in QApplication::notify (this=<optimized out>, receiver=0x55555633c1a0, e=0x7fffffffccb0) at kernel/qapplication.cpp:3203
#45 0x00007ffff6268c57 in QCoreApplication::notifyInternal2 (receiver=receiver@entry=0x55555633c1a0, event=event@entry=0x7fffffffccb0) at kernel/qcoreapplication.cpp:1048
#46 0x00007ffff76e38b2 in QCoreApplication::sendEvent (event=<optimized out>, receiver=<optimized out>) at ../../src/corelib/kernel/qcoreapplication.h:234
#47 QApplicationPrivate::sendMouseEvent (receiver=receiver@entry=0x55555633c1a0, event=event@entry=0x7fffffffccb0, alienWidget=alienWidget@entry=0x55555633c1a0, nativeWidget=0x555555be2800, buttonDown=buttonDown@entry=0x7ffff7dd7870 <qt_button_down>, lastMouseReceiver=..., spontaneous=0x1)
    at kernel/qapplication.cpp:2695
#48 0x00007ffff7736b43 in QWidgetWindow::handleMouseEvent (this=this@entry=0x5555561d0a10, event=event@entry=0x7fffffffd090) at kernel/qwidgetwindow.cpp:659
#49 0x00007ffff7739109 in QWidgetWindow::event (this=0x5555561d0a10, event=0x7fffffffd090) at kernel/qwidgetwindow.cpp:281
#50 0x00007ffff76dce0c in QApplicationPrivate::notify_helper (this=this@entry=0x555555a3d020, receiver=receiver@entry=0x5555561d0a10, e=e@entry=0x7fffffffd090) at kernel/qapplication.cpp:3727
#51 0x00007ffff76e43cf in QApplication::notify (this=0x7fffffffd3d0, receiver=0x5555561d0a10, e=0x7fffffffd090) at kernel/qapplication.cpp:3486
#52 0x00007ffff6268c57 in QCoreApplication::notifyInternal2 (receiver=receiver@entry=0x5555561d0a10, event=event@entry=0x7fffffffd090) at kernel/qcoreapplication.cpp:1048
#53 0x00007ffff6b67c23 in QCoreApplication::sendSpontaneousEvent (event=0x7fffffffd090, receiver=0x5555561d0a10) at ../../src/corelib/kernel/qcoreapplication.h:237
#54 QGuiApplicationPrivate::processMouseEvent (e=0x55555655ec30) at kernel/qguiapplication.cpp:2081
#55 0x00007ffff6b69975 in QGuiApplicationPrivate::processWindowSystemEvent (e=e@entry=0x55555655ec30) at kernel/qguiapplication.cpp:1816
#56 0x00007ffff6b44d6b in QWindowSystemInterface::sendWindowSystemEvents (flags=...) at kernel/qwindowsysteminterface.cpp:1032
#57 0x00007fffed9f8fcb in QPAEventDispatcherGlib::processEvents (this=0x555555abe9d0, flags=...) at qeventdispatcher_glib.cpp:70
#58 0x00007ffff6267a4a in QEventLoop::exec (this=this@entry=0x7fffffffd300, flags=..., flags@entry=...) at kernel/qeventloop.cpp:214
#59 0x00007ffff6270430 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1336
#60 0x0000555555642b99 in main (argc=<optimized out>, argc@entry=0x1, argv=argv@entry=0x7fffffffd538) at /home/bartek/dev/veles/src/ui/main.cc:82
#61 0x00007ffff52e19f7 in __libc_start_main (main=0x555555642800 <main(int, char**)>, argc=0x1, argv=0x7fffffffd538, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffd528) at ../csu/libc-start.c:308
#62 0x00005555556441ea in _start () at /home/bartek/dev/veles/src/ui/main.cc:58

Linux IHM 4.14.16-gentoo #2 SMP Sat Feb 3 03:38:21 CET 2018 x86_64 Intel(R) Core(TM) i7-4790 CPU @ 3.60GHz GenuineIntel GNU/Linux

# eix -I --format '<installedversions:NAMEVERSION>'  'dev-qt/qt*'  
dev-qt/qt3support-4.8.7
dev-qt/qtchooser-0_p20170803
dev-qt/qtconcurrent-5.11.1
dev-qt/qtcore-4.8.7-r4
dev-qt/qtcore-5.11.1
dev-qt/qtdbus-5.11.1
dev-qt/qtdeclarative-5.11.1
dev-qt/qtgraphicaleffects-5.11.1
dev-qt/qtgui-4.8.7
dev-qt/qtgui-5.11.1
dev-qt/qtimageformats-5.11.1
dev-qt/qtmultimedia-5.11.1
dev-qt/qtnetwork-5.11.1
dev-qt/qtopengl-5.11.1
dev-qt/qtpaths-5.11.1
dev-qt/qtprintsupport-5.11.1
dev-qt/qtquickcontrols-5.11.1
dev-qt/qtquickcontrols2-5.11.1
dev-qt/qtscript-4.8.7
dev-qt/qtscript-5.11.1
dev-qt/qtsensors-5.11.1
dev-qt/qtsql-4.8.7-r1
dev-qt/qtsql-5.11.1-r1
dev-qt/qtsvg-5.11.1
dev-qt/qttest-5.11.1
dev-qt/qttranslations-4.8.7
dev-qt/qtvirtualkeyboard-5.11.1
dev-qt/qtwayland-5.11.1
dev-qt/qtwebchannel-5.11.1
dev-qt/qtwebengine-5.11.1
dev-qt/qtwebkit-5.212.0_pre20180120
dev-qt/qtwidgets-5.11.1
dev-qt/qtx11extras-5.11.1
dev-qt/qtxml-5.11.1
dev-qt/qtxmlpatterns-4.8.7
dev-qt/qtxmlpatterns-5.11.1
$ glxinfo | grep string
server glx vendor string: SGI
server glx version string: 1.4
client glx vendor string: Mesa Project and SGI
client glx version string: 1.4
OpenGL vendor string: X.Org
OpenGL renderer string: AMD CYPRESS (DRM 2.50.0 / 4.14.16-gentoo, LLVM 6.0.1)
OpenGL core profile version string: 4.3 (Core Profile) Mesa 18.1.4
OpenGL core profile shading language version string: 4.30
OpenGL version string: 3.1 Mesa 18.1.4
OpenGL shading language version string: 1.40
OpenGL ES profile version string: OpenGL ES 3.1 Mesa 18.1.4
OpenGL ES profile shading language version string: OpenGL ES GLSL ES 3.10

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions