Variety 0.7.1 free(): invalid pointer crash on GExiv2.Metadata

[jazz-it]

$ inxi -S
System: Host: madjoe Kernel: 4.19.32-1-MANJARO x86_64 bits: 64 Desktop: KDE Plasma 5.15.3 Distro: Manjaro Linux

$ pkg-config --modversion gtk+-3.0
3.24.7

$ variety

(variety:7093): Gtk-WARNING **: 10:38:12.389: Theme parsing error: gtk.css:68:35: The style property GtkButton:child-displacement-x is deprecated and shouldn't be used anymore. It will be removed in a future version

(variety:7093): Gtk-WARNING **: 10:38:12.389: Theme parsing error: gtk.css:69:35: The style property GtkButton:child-displacement-y is deprecated and shouldn't be used anymore. It will be removed in a future version

(variety:7093): Gtk-WARNING **: 10:38:12.389: Theme parsing error: gtk.css:73:46: The style property GtkScrolledWindow:scrollbars-within-bevel is deprecated and shouldn't be used anymore. It will be removed in a future version
free(): invalid pointer
Aborted (core dumped)

[jlu5]

I don't think this is an "incompatibility issue" with GTK - the warnings being thrown are caused by your GTK theme being slightly out of date.

Can you reproduce this crash consistently? What if you run variety in gdb?

[jazz-it]

Yes, the crash is consistent. Reg. gdb, how do you want me to test it? I tried with the following:

$ gdb
GNU gdb (GDB) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later http://gnu.org/licenses/gpl.html
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
http://www.gnu.org/software/gdb/bugs/.
Find the GDB manual and other documentation resources online at:
http://www.gnu.org/software/gdb/documentation/.

For help, type "help".
Type "apropos word" to search for commands related to "word".
(gdb) source /usr/bin/variety
/usr/bin/variety:18: Error in sourced command file:
Undefined command: "import". Try "help".
(gdb)

[jazz-it]

BTW, this theme is default for Manjaro.

[origin2007]

I have the same problem. Ubuntu 18.04. It works fine until this evening.

[jazz-it]

I will remove this app. It seems unstable and the community is not very cooperative.

[jlu5]

@madjoe Please don't be rude.

Neither of us (the maintainers) have been able to reproduce these crashes. The problem with pure Python code is that it shouldn't ever segfault, meaning the cause of these crashes are in underlying libraries that are out of our control.

[trackrx]

Hi @jlu5

I can reproduce this crash consistently and is ready to help by providing any required information and can help to debug this issue.

System specs (tell me if you need more info):
Linux Mint 19 Tara on laptop.
uname -a reports:
4.15.0-47-generic # 50-Ubuntu SMP Wed Mar 13 10:44:52 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
It is running MATE desktop environment.

variety was installed through this PPA:

Origin: Peter Levi's PPA:18.04/bionic [all
http://ppa.launchpad.net/peterlevi/ppa/ubuntu/pool/main/v/variety/variety_0.7.1~git201810231556.944aa6d~ppa772~ubuntu1

Running variety executable on console yields this:

$ variety
double free or corruption (out)
Aborted (core dumped)

Running the same through GDB yields this:

$ gdb /usr/bin/python3
...
(gdb) run /usr/bin/variety
Starting program: /usr/bin/python3 /usr/bin/variety
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe5f77700 (LWP 26326)]
[New Thread 0x7fffe5776700 (LWP 26327)]
[New Thread 0x7fffe4f75700 (LWP 26328)]
[New Thread 0x7fffd7fff700 (LWP 26332)]
[New Thread 0x7fffd77fe700 (LWP 26333)]
double free or corruption (out)

Thread 1 "python3" received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.

(gdb) bt
#0  0x00007ffff7a22e97 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1  0x00007ffff7a24801 in __GI_abort () at abort.c:79
#2  0x00007ffff7a6d897 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7b9ab9a "%s\n")
    at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007ffff7a7490a in malloc_printerr (str=str@entry=0x7ffff7b9c870 "double free or corruption (out)") at malloc.c:5350
#4  0x00007ffff7a7be75 in _int_free (have_lock=0, p=0xe14030, av=0x7ffff7dcfc40 <main_arena>) at malloc.c:4278
#5  0x00007ffff7a7be75 in __GI___libc_free (mem=0xe14040) at malloc.c:3124
#6  0x00007ffff4b3be10 in  () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#7  0x00007ffff468df15 in  () at /usr/lib/python3/dist-packages/gi/_gi.cpython-36m-x86_64-linux-gnu.so
#8  0x00007ffff4689ede in  () at /usr/lib/python3/dist-packages/gi/_gi.cpython-36m-x86_64-linux-gnu.so
#9  0x00007ffff468ba48 in  () at /usr/lib/python3/dist-packages/gi/_gi.cpython-36m-x86_64-linux-gnu.so
#10 0x00007ffff467fcb9 in  () at /usr/lib/python3/dist-packages/gi/_gi.cpython-36m-x86_64-linux-gnu.so
#11 0x00000000005a730c in _PyObject_FastCallKeywords ()
#12 0x0000000000503073 in  ()
#13 0x0000000000506859 in _PyEval_EvalFrameDefault ()
#14 0x0000000000501945 in _PyFunction_FastCallDict ()
#15 0x0000000000591461 in  ()
#16 0x000000000059ebbe in PyObject_Call ()
#17 0x0000000000545068 in  ()
#18 0x0000000000506b39 in _PyEval_EvalFrameDefault ()
#19 0x0000000000502209 in  ()
#20 0x0000000000502f3d in  ()
#21 0x0000000000506859 in _PyEval_EvalFrameDefault ()
#22 0x0000000000504c28 in  ()
#23 0x0000000000502540 in  ()
#24 0x0000000000502f3d in  ()
#25 0x0000000000507641 in _PyEval_EvalFrameDefault ()
#26 0x0000000000504c28 in  ()
#27 0x0000000000502540 in  ()
#28 0x0000000000502f3d in  ()
#29 0x0000000000506859 in _PyEval_EvalFrameDefault ()
#30 0x0000000000502209 in  ()
#31 0x0000000000502f3d in  ()
#32 0x0000000000506859 in _PyEval_EvalFrameDefault ()
#33 0x0000000000504c28 in  ()
#34 0x0000000000506393 in PyEval_EvalCode ()
#35 0x0000000000634d52 in  ()
#36 0x0000000000634e0a in PyRun_FileExFlags ()
#37 0x00000000006385c8 in PyRun_SimpleFileExFlags ()
#38 0x000000000063915a in Py_Main ()
#39 0x00000000004a6f10 in main ()

I've also run the same executable under valgrind:
$ valgrind --log-file=./variety.valgrind.log --leak-check=full --track-origins=yes --expensive-definedness-checks=yes variety

The result of the above command (file variety.valgrind.log is attached here (would be too long to paste as text).

Note: The crash does not reproduce while running under valgrind! The app starts and during the run, I manually exited it by right-clicking on the tray icon and selecting "exit".

However, an interesting message is received on console during this valgrind run:

(variety:27045): Gdk-CRITICAL **: 13:11:10.863: gdk_window_thaw_toplevel_updates: assertion 'window->update_and_descendants_freeze_count > 0' failed

Attaching the valgrind logs file:
variety.valgrind.log.gz

Please, feel free to communicate with me for any additional information or debugging aid.

Thanks for maintaining the program!

[jlu5]

Hello,

The gdb backtrace might be slightly more informative if you install the debug symbols for libglib-2.0 (package libglib2.0-0-dbgsym).

Aside from that, which wallpaper sources are you using? Did you tweak your config to do anything special? Could there potentially be corrupt images in one of your sources? (Possibly verify using https://stackoverflow.com/a/4780718)

[trackrx]

Thanks. I already installed the debug info packages (for Python3 itself and libglib). Then it stopped reproducing. I don't think it is related to debug symbols, it's the nature of this kind of bug to only happen sometimes.

I will continue running the program under debug for as long as needed to try and find the cause. Will update here with my findings.

As for the sources, yes I played with them. I'll try to extract my config and share here when I find time for it...

[jlu5]

Yeah.. sporadic bugs are way harder to fix than ones that happen consistently :(

[trackrx]

Well, I checked all currently downloaded images using this script:

#!/usr/bin/python
from PIL import Image
import os

def check(fname):
	try:
		im = Image.open(fname)
		im.verify()
		return True
	except Exception, e:
		print "ERROR:", e
	return False

def walk(path):
	for name in os.listdir(path):
		fullname = os.path.join(path, name)
		if os.path.isfile(fullname):
			yield fullname
		elif os.path.isdir(fullname):
			for subname in walk(fullname):
				yield subname

variety_datadir = os.path.expanduser('~/.config/variety')

for fullname in walk(variety_datadir):
	if fullname.endswith(".jpeg") or fullname.endswith(".jpg") or fullname.endswith(".gif") or fullname.endswith(".png"):
		if not check(fullname):
			print "BAD:", fullname

It shows that all currently downloaded images are considered fine.

On the other hand, the crash still didn't reproduce. So, when it does happen, I'll re-run this script to find out whether there are any corrupt images, in addition to looking at the gdb backtrace. That knowledge may help a bit deciphering this issue.

I'll also walk over the code maybe see something. Hope to find some time for that soon.

Will post any updates here.

[trackrx]

Hi @jlu5

I have an additional thought about it. As I already mentioned, I use a laptop which is put into "sleep" several times a day (to conserve battery).

It could happen that if the system goes to sleep in the middle of variety downloading an image, the image may end up corrupted on disk somehow?

I did a quick look over variety Python code and didn't notice a validity check over downloaded images. I looked in the area of "save_locally" and "download_one" methods.

Maybe it's worth to add such a check in any case and skip (maybe even delete) image files that do not pass basic verification criteria. What do you think?