linuxdcpp-team team mailing list archive

[Steven Sheehy <steven.sheehy@xxxxxxxxx>]

I was able to reproduce it. This is a remote crashing bug that is a
side-effect of the fix for bug #351393. In that bug, we changed
ShareManager::Directory::File to not store an intrusive_ptr since it was
leaking memory. This is fine for normal directories since its ptr will
be kept around elsewhere, but when a directory is merged into another
virtual directory that intrusive_ptr reference gets lost and the object
is garbage collected. Later when a user tries to download a file from
this merged directory, it tries to get the real path using the
previously gc'd object and crashes.

1) Add path /A/ to virtual share C
2) Add path /B/ to virtual share C. B is merged into share C
3) User downloads C/a (real path /A/a) and is successful
4) User downloads C/b (real path /B/b) and remotely crashes client

** Changed in: linuxdcpp
   Importance: Undecided => Critical

** Changed in: linuxdcpp
       Status: Incomplete => Confirmed

** Changed in: linuxdcpp
    Milestone: None => 1.1.0

** Also affects: dcplusplus
   Importance: Undecided
       Status: New

** Changed in: dcplusplus
   Importance: Undecided => Critical

** Changed in: dcplusplus
       Status: New => Confirmed

** Summary changed:

- revno: 337 crash.  terminate called after throwing an instance of 'std::length_error'
+ Remote crash when user downloads from merged share

-- 
Remote crash when user downloads from merged share
https://bugs.launchpad.net/bugs/480065
You received this bug notification because you are a member of LinuxDC++
Team, which is subscribed to LinuxDC++.

Status in DC++: Confirmed
Status in Linux DC++: Confirmed

Bug description:
revno: 337

$ linuxdcpp 
Loading: Hash database
Loading: Shared Files
Loading: Download Queue
terminate called after throwing an instance of 'std::length_error'
  what():  basic_string::_S_create
Аварийный останов (core dumped)

core+linuxdcpp

ftp://ftp.san.ru/temp/crash-linuxdcpp/2009111001/