[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

Re: Another crash in ra_serf in 1.8.0

From: Stefan Küng <tortoisesvn_at_gmail.com>
Date: Fri, 21 Jun 2013 21:26:03 +0200

On 20.06.2013 23:05, Lieven Govaerts wrote:
> Looks like it's the authentication handling when setting up a SSL
> tunnel that's at fault here, at least I can easily reproduce it with
> an apache http proxy connetion to a https repo. The ssl tunnel is
> started by a CONNECT request created by serf. When the proxy requests
> credentials, serf will call back to the application. As the
> application doesn't know about this request, it doesn't get a valid
> baton either, so can't get baton->session ... That baton it gets is
> the ctx used by the ssltunnel code. Hm, have to think about how we can
> solve this. Not sure it can be done with the existing API.

I'm not sure, but another crash report seems related to this:
https://www.crash-server.com/Problem.aspx?ClientID=tsvn&ProblemID=26624

The stacktrace of this one:
BowPad

TortoiseProc.exe!SVN::cancel(void * baton=0x000000df49062108) Line 1782 C++
libsvn_tsvn.dll!svn_wc__conflict_invoke_resolver(svn_wc__db_t * db=0x000000df49d1eac0, const char * local_abspath=0x000000df49063598, const svn_skel_t * conflict_skel=0x000000df49063598, const apr_array_header_t * merge_options=0x0000000000000000, svn_error_t * (svn_wc_conflict_result_t * *, const svn_wc_conflict_description2_t *, void *, apr_pool_t *, apr_pool_t *) * resolver_func=0x000007fe5cf570b0, void * resolver_baton=0x000000df48e10238, svn_error_t * (void *) * cancel_func=0x000007f74b709220, void * cancel_baton=0x000000df48e10238, apr_pool_t * scratch_pool=0x000000df49062108) Line 1937 C
libsvn_tsvn.dll!close_directory(void * dir_baton=0x000000df48e4c480, apr_pool_t * pool=0x000000df48e34218) Line 2911 C
libsvn_tsvn.dll!close_directory(void * dir_baton=0x000000df48e30298, apr_pool_t * pool=0x000000df48e304c8) Line 262 C
libsvn_tsvn.dll!close_dir(report_dir_t * dir=0x000000df00000259) Line 807 C
libsvn_tsvn.dll!maybe_close_dir_chain(report_dir_t * dir=0x0000000000000000) Line 1394 C
libsvn_tsvn.dll!end_report(svn_ra_serf__xml_parser_t * parser=0x000000df00000259, svn_ra_serf__dav_props_t name, apr_pool_t * scratch_pool=0x000000df49d9c880) Line 2238 C
libsvn_tsvn.dll!end_xml(void * userData=0x000000df49dd5610, const char * raw_name=0x000000df48e42c18) Line 1314 C
libaprutil_tsvn.dll!doContent(XML_ParserStruct * parser=0x0000000000000000, int startTagLevel=0, const encoding * enc=0x0000000057663180, const char * s=0x000000df4909d39b, const char * end=0x000000df4909ddc7, const char * * nextPtr=0x000000df49dd5640) Line 2236 C
libaprutil_tsvn.dll!contentProcessor(XML_ParserStruct * parser=0x000000df48e442a8, const char * start=0x0000000000000003, const char * end=0x000000df48e42418, const char * * endPtr=0x0000000000000000) Line 1817 C
libaprutil_tsvn.dll!XML_ParseBuffer(XML_ParserStruct * parser=0x000000df49dd5610, int len=0, int isFinal=0) Line 1482 C
libaprutil_tsvn.dll!XML_Parse(XML_ParserStruct * parser=0x0000000000000000, const char * s=0x00000000000000c8, int len=1238531864, int isFinal=1238541944) Line 1472 C
libsvn_tsvn.dll!svn_ra_serf__handle_xml_parser(serf_request_t * request=0x000000df49d27f18, serf_bucket_t * response=0x000000df49d31c19, void * baton=0x0000000000000ad7, apr_pool_t * pool=0x0000000000000000) Line 1681 C
libsvn_tsvn.dll!handle_response(serf_request_t * request=0x000000df49d27f18, serf_bucket_t * response=0x000000df49d2a678, svn_ra_serf__handler_t * handler=0x000000df49d2a5d8, int * serf_status=0x0000000000000000, apr_pool_t * scratch_pool=0x000000df49d2dbb8) Line 2060 C
libsvn_tsvn.dll!handle_response_cb(serf_request_t * request=0x000000df49d27f18, serf_bucket_t * response=0x000000df49d2a5d8, void * baton=0x000007fe00000000, apr_pool_t * scratch_pool=0x0000000000000000) Line 2096 C
libsvn_tsvn.dll!handle_response(serf_request_t * request=0x0000000000000000, apr_pool_t * pool=0x0000000000000000) Line 872 C
libsvn_tsvn.dll!read_from_connection(serf_connection_t * conn=0x000000df49d2dbb8) Line 995 C
libsvn_tsvn.dll!serf__process_connection(serf_connection_t * conn=0x000000df4668a318, short events=-22920) Line 1108 C
libsvn_tsvn.dll!serf_event_trigger(serf_context_t * s=0x000000df4668a318, void * serf_baton=0x000000df49d2fc40, const apr_pollfd_t * desc=0x000000df48e16128) Line 240 C
libsvn_tsvn.dll!serf_context_run(serf_context_t * ctx=0x0000000000000000, int duration=1238563904, apr_pool_t * pool=0x000000df49d2fc40) Line 308 C
libsvn_tsvn.dll!finish_report(void * report_baton=0x000000df48e16128, apr_pool_t * pool=0x0000000000000000) Line 2854 C
libsvn_tsvn.dll!svn_wc_crawl_revisions5(svn_wc_context_t * wc_ctx=0x000000df49d1eaa8, const char * local_abspath=0x000000df48e10208, const svn_ra_reporter3_t * reporter=0x000007fe5d239ca8, void * report_baton=0x000000df48e3a248, int restore_files=1, svn_depth_t depth=svn_depth_unknown, int honor_depth_exclude=1, int depth_compatibility_trick=1, int use_commit_times=0, svn_error_t * (void *) * cancel_func=0x000007f74b709220, void * cancel_baton=0x000000df4641e030, void (void *, const svn_wc_notify_t *, apr_pool_t *) * notify_func=0x000007f74b708bf0, void * notify_baton=0x000000df4641e030, apr_pool_t * scratch_pool=0x000000df48e100f8) Line 845 C
libsvn_tsvn.dll!update_internal(long * result_rev=0x000000df4b20f280, apr_hash_t * conflicted_paths=0x000000df48e10238, const char * local_abspath=0x000000df48e10208, const char * anchor_abspath=0x000000df48e103b0, const svn_opt_revision_t * revision=0x000000df4b20f1b8, svn_depth_t depth=svn_depth_unknown, int depth_is_sticky=0, int ignore_externals=0, int allow_unver_obstructions=1, int adds_as_modification=1, int * timestamp_sleep=0x000000df4b20f284, int notify_summary=1, svn_client_ctx_t * ctx=0x0000000000000000, apr_pool_t * pool=0x000000df48e100f8) Line 466 C
libsvn_tsvn.dll!svn_client__update_internal(long * result_rev=0x000000df49d7aab8, const char * local_abspath=0x000000df48e10208, const svn_opt_revision_t * revision=0x000000df48e10238, svn_depth_t depth=svn_depth_unknown, int depth_is_sticky=0, int ignore_externals=0, int allow_unver_obstructions=1, int adds_as_modification=1, int make_parents=1, int innerupdate=0, int * timestamp_sleep=0x000000df4b20f284, svn_client_ctx_t * ctx=0x000000df48e103b0, apr_pool_t * pool=0x000000df48e100f8) Line 600 C
libsvn_tsvn.dll!svn_client_update4(apr_array_header_t * * result_revs=0x0000000000000000, const apr_array_header_t * paths=0x000000df49d21bf8, const svn_opt_revision_t * revision=0x000000df4641e750, svn_depth_t depth=svn_depth_unknown, int depth_is_sticky=0, int ignore_externals=0, int allow_unver_obstructions=1, int adds_as_modification=1, int make_parents=1, svn_client_ctx_t * ctx=0x000000df49d1e9f0, apr_pool_t * pool=0x000000df49d37c08) Line 675 C

The problem here is that in Snippet svn_wc__conflict_invoke_resolver(),
the call
           if (cancel_func)
             SVN_ERR(cancel_func(cancel_baton));

calls into invalid memory. The exception is actually "Access violation
*executing *code" so it seems that here too a wrong/invalid ctx is used.

(sorry for the html mail, but with text the long lines of the stack
trace just get mangled to an unreadable state)

Stefan

-- 
        ___
   oo  // \\      "De Chelonian Mobile"
  (_,\/ \_/ \     TortoiseSVN
    \ \_/_\_/>    The coolest interface to (Sub)version control
    /_/   \_\     http://tortoisesvn.net
Received on 2013-06-21 21:26:38 CEST

This is an archived mail posted to the Subversion Dev mailing list.

This site is subject to the Apache Privacy Policy and the Apache Public Forum Archive Policy.