[svn.haxx.se] · SVN Dev · SVN Users · SVN Org · TSVN Dev · TSVN Users · Subclipse Dev · Subclipse Users · this month's index

[PATCH] Crash in TSVN with directory property conflict during update (was Re: Another crash in ra_serf in 1.8.0)

From: Lieven Govaerts <svnlgo_at_mobsol.be>
Date: Sun, 23 Jun 2013 15:07:40 +0200

Stefan,

this issue is unrelated to ssl tunnelling or authentication, or more
in general unrelated to ra_serf.

The particular scenario here is a user updating a directory with both
local property changes and incoming property changes. Svn then calls
TSVN code to check if the user cancelled the action.

Looking at the code, I noticed that the wrong baton is passed in the
call to TSVN. The attached patch (to a 1.8.x wc) will fix that.

I also noticed that svn command-line apparently does not use the
cancel_baton, so this code path is never executed in our tests.

Can you let us know if this patch fixes the issue for TSVN users?

thanks,

Lieven

On Fri, Jun 21, 2013 at 9:26 PM, Stefan Küng <tortoisesvn_at_gmail.com> wrote:
> On 20.06.2013 23:05, Lieven Govaerts wrote:
>
> Looks like it's the authentication handling when setting up a SSL tunnel
> that's at fault here, at least I can easily reproduce it with an apache http
> proxy connetion to a https repo. The ssl tunnel is started by a CONNECT
> request created by serf. When the proxy requests credentials, serf will call
> back to the application. As the application doesn't know about this request,
> it doesn't get a valid baton either, so can't get baton->session ... That
> baton it gets is the ctx used by the ssltunnel code. Hm, have to think about
> how we can solve this. Not sure it can be done with the existing API.
>
>
> I'm not sure, but another crash report seems related to this:
> https://www.crash-server.com/Problem.aspx?ClientID=tsvn&ProblemID=26624
>
> The stacktrace of this one:
>
> TortoiseProc.exe!SVN::cancel(void * baton=0x000000df49062108) Line 1782 C++
> libsvn_tsvn.dll!svn_wc__conflict_invoke_resolver(svn_wc__db_t *
> db=0x000000df49d1eac0, const char * local_abspath=0x000000df49063598, const
> svn_skel_t * conflict_skel=0x000000df49063598, const apr_array_header_t *
> merge_options=0x0000000000000000, svn_error_t * (svn_wc_conflict_result_t *
> *, const svn_wc_conflict_description2_t *, void *, apr_pool_t *, apr_pool_t
> *) * resolver_func=0x000007fe5cf570b0, void *
> resolver_baton=0x000000df48e10238, svn_error_t * (void *) *
> cancel_func=0x000007f74b709220, void * cancel_baton=0x000000df48e10238,
> apr_pool_t * scratch_pool=0x000000df49062108) Line 1937 C
> libsvn_tsvn.dll!close_directory(void * dir_baton=0x000000df48e4c480,
> apr_pool_t * pool=0x000000df48e34218) Line 2911 C
> libsvn_tsvn.dll!close_directory(void * dir_baton=0x000000df48e30298,
> apr_pool_t * pool=0x000000df48e304c8) Line 262 C
> libsvn_tsvn.dll!close_dir(report_dir_t * dir=0x000000df00000259) Line 807 C
> libsvn_tsvn.dll!maybe_close_dir_chain(report_dir_t * dir=0x0000000000000000)
> Line 1394 C
> libsvn_tsvn.dll!end_report(svn_ra_serf__xml_parser_t *
> parser=0x000000df00000259, svn_ra_serf__dav_props_t name, apr_pool_t *
> scratch_pool=0x000000df49d9c880) Line 2238 C
> libsvn_tsvn.dll!end_xml(void * userData=0x000000df49dd5610, const char *
> raw_name=0x000000df48e42c18) Line 1314 C
> libaprutil_tsvn.dll!doContent(XML_ParserStruct * parser=0x0000000000000000,
> int startTagLevel=0, const encoding * enc=0x0000000057663180, const char *
> s=0x000000df4909d39b, const char * end=0x000000df4909ddc7, const char * *
> nextPtr=0x000000df49dd5640) Line 2236 C
> libaprutil_tsvn.dll!contentProcessor(XML_ParserStruct *
> parser=0x000000df48e442a8, const char * start=0x0000000000000003, const char
> * end=0x000000df48e42418, const char * * endPtr=0x0000000000000000) Line
> 1817 C
> libaprutil_tsvn.dll!XML_ParseBuffer(XML_ParserStruct *
> parser=0x000000df49dd5610, int len=0, int isFinal=0) Line 1482 C
> libaprutil_tsvn.dll!XML_Parse(XML_ParserStruct * parser=0x0000000000000000,
> const char * s=0x00000000000000c8, int len=1238531864, int
> isFinal=1238541944) Line 1472 C
> libsvn_tsvn.dll!svn_ra_serf__handle_xml_parser(serf_request_t *
> request=0x000000df49d27f18, serf_bucket_t * response=0x000000df49d31c19,
> void * baton=0x0000000000000ad7, apr_pool_t * pool=0x0000000000000000) Line
> 1681 C
> libsvn_tsvn.dll!handle_response(serf_request_t * request=0x000000df49d27f18,
> serf_bucket_t * response=0x000000df49d2a678, svn_ra_serf__handler_t *
> handler=0x000000df49d2a5d8, int * serf_status=0x0000000000000000, apr_pool_t
> * scratch_pool=0x000000df49d2dbb8) Line 2060 C
> libsvn_tsvn.dll!handle_response_cb(serf_request_t *
> request=0x000000df49d27f18, serf_bucket_t * response=0x000000df49d2a5d8,
> void * baton=0x000007fe00000000, apr_pool_t *
> scratch_pool=0x0000000000000000) Line 2096 C
> libsvn_tsvn.dll!handle_response(serf_request_t * request=0x0000000000000000,
> apr_pool_t * pool=0x0000000000000000) Line 872 C
> libsvn_tsvn.dll!read_from_connection(serf_connection_t *
> conn=0x000000df49d2dbb8) Line 995 C
> libsvn_tsvn.dll!serf__process_connection(serf_connection_t *
> conn=0x000000df4668a318, short events=-22920) Line 1108 C
> libsvn_tsvn.dll!serf_event_trigger(serf_context_t * s=0x000000df4668a318,
> void * serf_baton=0x000000df49d2fc40, const apr_pollfd_t *
> desc=0x000000df48e16128) Line 240 C
> libsvn_tsvn.dll!serf_context_run(serf_context_t * ctx=0x0000000000000000,
> int duration=1238563904, apr_pool_t * pool=0x000000df49d2fc40) Line 308 C
> libsvn_tsvn.dll!finish_report(void * report_baton=0x000000df48e16128,
> apr_pool_t * pool=0x0000000000000000) Line 2854 C
> libsvn_tsvn.dll!svn_wc_crawl_revisions5(svn_wc_context_t *
> wc_ctx=0x000000df49d1eaa8, const char * local_abspath=0x000000df48e10208,
> const svn_ra_reporter3_t * reporter=0x000007fe5d239ca8, void *
> report_baton=0x000000df48e3a248, int restore_files=1, svn_depth_t
> depth=svn_depth_unknown, int honor_depth_exclude=1, int
> depth_compatibility_trick=1, int use_commit_times=0, svn_error_t * (void *)
> * cancel_func=0x000007f74b709220, void * cancel_baton=0x000000df4641e030,
> void (void *, const svn_wc_notify_t *, apr_pool_t *) *
> notify_func=0x000007f74b708bf0, void * notify_baton=0x000000df4641e030,
> apr_pool_t * scratch_pool=0x000000df48e100f8) Line 845 C
> libsvn_tsvn.dll!update_internal(long * result_rev=0x000000df4b20f280,
> apr_hash_t * conflicted_paths=0x000000df48e10238, const char *
> local_abspath=0x000000df48e10208, const char *
> anchor_abspath=0x000000df48e103b0, const svn_opt_revision_t *
> revision=0x000000df4b20f1b8, svn_depth_t depth=svn_depth_unknown, int
> depth_is_sticky=0, int ignore_externals=0, int allow_unver_obstructions=1,
> int adds_as_modification=1, int * timestamp_sleep=0x000000df4b20f284, int
> notify_summary=1, svn_client_ctx_t * ctx=0x0000000000000000, apr_pool_t *
> pool=0x000000df48e100f8) Line 466 C
> libsvn_tsvn.dll!svn_client__update_internal(long *
> result_rev=0x000000df49d7aab8, const char *
> local_abspath=0x000000df48e10208, const svn_opt_revision_t *
> revision=0x000000df48e10238, svn_depth_t depth=svn_depth_unknown, int
> depth_is_sticky=0, int ignore_externals=0, int allow_unver_obstructions=1,
> int adds_as_modification=1, int make_parents=1, int innerupdate=0, int *
> timestamp_sleep=0x000000df4b20f284, svn_client_ctx_t *
> ctx=0x000000df48e103b0, apr_pool_t * pool=0x000000df48e100f8) Line 600 C
> libsvn_tsvn.dll!svn_client_update4(apr_array_header_t * *
> result_revs=0x0000000000000000, const apr_array_header_t *
> paths=0x000000df49d21bf8, const svn_opt_revision_t *
> revision=0x000000df4641e750, svn_depth_t depth=svn_depth_unknown, int
> depth_is_sticky=0, int ignore_externals=0, int allow_unver_obstructions=1,
> int adds_as_modification=1, int make_parents=1, svn_client_ctx_t *
> ctx=0x000000df49d1e9f0, apr_pool_t * pool=0x000000df49d37c08) Line 675 C
>
> The problem here is that in svn_wc__conflict_invoke_resolver(), the call
> if (cancel_func)
> SVN_ERR(cancel_func(cancel_baton));
>
> calls into invalid memory. The exception is actually "Access violation
> executing code" so it seems that here too a wrong/invalid ctx is used.
>
> (sorry for the html mail, but with text the long lines of the stack trace
> just get mangled to an unreadable state)
>
>
> Stefan
>
> --
> ___
> oo // \\ "De Chelonian Mobile"
> (_,\/ \_/ \ TortoiseSVN
> \ \_/_\_/> The coolest interface to (Sub)version control
> /_/ \_\ http://tortoisesvn.net

Received on 2013-06-23 15:08:37 CEST

This is an archived mail posted to the Subversion Dev mailing list.