[Akonadi] [Bug 310711] akonadiserver crashes on malformed input to UNIX socket

[Tim Brown]

https://bugs.kde.org/show_bug.cgi?id=310711

--- Comment #3 from Tim Brown <kde at machine.org.uk> ---
#0  Akonadi::ImapStreamParser::readString (this=0x0) at
../../server/src/imapstreamparser.cpp:57
#1  0x000000000042063f in Akonadi::AkonadiConnection::slotNewData
(this=0x23fc370) at ../../server/src/akonadiconnection.cpp:124
#2  0x00007f332f32254f in QMetaObject::activate (sender=0x23b5db0, m=<optimized
out>, local_signal_index=<optimized out>, argv=0x0) at kernel/qobject.cpp:3547
#3  0x00007f332f32254f in QMetaObject::activate (sender=sender at entry=0x2424ce8,
m=m at entry=0x7f332f65f460 <QIODevice::staticMetaObject>,
local_signal_index=local_signal_index at entry=0, argv=argv at entry=0x0)
    at kernel/qobject.cpp:3547
#4  0x00007f332f36b0c0 in QIODevice::readyRead (this=this at entry=0x2424ce8) at
.moc/release-shared/moc_qiodevice.cpp:105
#5  0x00007f332ef123cc in QAbstractSocketPrivate::canReadNotification
(this=this at entry=0x2424d40) at socket/qabstractsocket.cpp:654
#6  0x00007f332ef169b2 in QAbstractSocket::waitForBytesWritten (this=0x2424ce8,
msecs=30000) at socket/qabstractsocket.cpp:1966
#7  0x000000000041f9d3 in Akonadi::AkonadiConnection::writeOut
(this=this at entry=0x23fc370, data=...) at
../../server/src/akonadiconnection.cpp:178
#8  0x0000000000421333 in Akonadi::AkonadiConnection::run (this=0x23fc370) at
../../server/src/akonadiconnection.cpp:100
#9  0x00007f332f211d0b in QThreadPrivate::start (arg=0x23fc370) at
thread/qthread_unix.cpp:307
#10 0x00007f332d50de0e in start_thread (arg=0x7f33157fa700) at
pthread_create.c:311
#11 0x00007f332d80a95d in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Line 57 is as follows:

  if ( !waitForMoreData( m_data.length() == 0 ) )

>From gdb:

(gdb) print m_data
Cannot access memory at address 0x8
(gdb) x/1i $pc
=> 0x4c67d0 <Akonadi::ImapStreamParser::readString()+32>:       mov   
0x8(%rsi),%rax
x/1x $rsi
Cannot access memory at address 0x0

-- 
You are receiving this mail because:
You are the assignee for the bug.