iipsrv segfault about iipsrv

[ruven]

What's the output from the tiffinfo command for your image?

[atomotic]

https://gist.github.com/atomotic/29b12d9b0643b1696b06

[ruven]

OK, so it's tiled, but it's not multi-resolution. If you're using imagemagick, make sure you specify ptif as the output format. See the image documentation page for more details.

[atomotic]

tried using ptif extension, and also converting using vips (following documentation page), same result.
this is what i see attaching a strace to the server pid:

root@li141-42:~# strace -p 7031
Process 7031 attached - interrupt to quit
accept(4,

{sa_family=AF_INET, sin_port=htons(36868), sin_addr=inet_addr("127.0.0.1")}, [16]) = 5
setsockopt(5, SOL_TCP, TCP_NODELAY, [1], 4) = 0
read(5, "\1\1\0\1\0\10\0\0\0\1\0\0\0\0\0\0\1\4\0\1\1\311\7\0\t\25PATH_I"..., 8192) = 504
gettimeofday({1420581237, 619102}, NULL) = 0
write(3, "QUERY_STRING not set\n", 21)  = 21
write(3, "\n", 1)                       = 1
gettimeofday({1420581237, 619548}, NULL) = 0
write(3, "Total Request Time: 446 microsec"..., 37) = 37
write(3, "image closed and deleted\n", 25) = 25
write(3, "Server count is 1\n", 18)     = 18
write(3, "\n", 1)                       = 1
write(5, "\1\6\0\1\2\271\7\0Server: iipsrv/1.0\r\nCont"..., 736) = 736
shutdown(5, 1 /* send */)               = 0
select(6, [5], NULL, NULL, {2, 0})      = 1 (in [5], left {1, 999998})
read(5, "", 1024)                       = 0
close(5)                                = 0
accept(4, {sa_family=AF_INET, sin_port=htons(36869), sin_addr=inet_addr("127.0.0.1")}, [16]) = 5
setsockopt(5, SOL_TCP, TCP_NODELAY, [1], 4) = 0
read(5, "\1\1\0\1\0\10\0\0\0\1\0\0\0\0\0\0\1\4\0\1\1\326\2\0\t\25PATH_I"..., 8192) = 512
gettimeofday({1420581247, 10466}, NULL) = 0
write(3, "Full Request is FIF=dama.ptif\n", 30) = 30
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
Process 7031 detached 

[ruven]

I've been trying to reproduce your seg fault on a fresh 64bit Debian Wheezy (7.7) installation and I can't get it to crash. Can you send me your iipsrv binary to try out?

[atomotic]

here the binary and a sample ptif: http://109.74.194.42/_iip/
thanks

[ruven]

Your binary works fine on my Debian Wheezy. The strace output doesn't really tell us much. Can you try running it through gdb or valgrind?

[atomotic]

ok, let's try valgrind.

i tried running the server as standalone (--bind) or with spawn-fcgi, then proxying with nginx.
should i try apache too?

[ruven]

valgrind ./iipsrv.fcgi --bind 127.0.0.1:9000
should give some useful information on what's happening. If not, you could also try debugging with gdb.

[atomotic]

root@li141-42:/opt/iipimage# valgrind --leak-check=full ./iipsrv.fcgi --bind 127.0.0.1:9000
==23566== Memcheck, a memory error detector
==23566== Copyright (C) 2002-2011, and GNU GPL'd, by Julian Seward et al.
==23566== Using Valgrind-3.7.0 and LibVEX; rerun with -h for copyright info
==23566== Command: ./iipsrv.fcgi --bind 127.0.0.1:9000
==23566==
==23566== Conditional jump or move depends on uninitialised value(s)
==23566==    at 0x5EE155C: srandom_r (random_r.c:198)
==23566==    by 0x5EE11F0: srand (random.c:213)
==23566==    by 0x406216: main (Main.cc:397)
==23566==
==23566== Invalid read of size 1
==23566==    at 0x4C294E2: strlen (mc_replace_strmem.c:390)
==23566==    by 0x406A62: main (char_traits.h:261)
==23566==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==23566==
==23566==
==23566== Process terminating with default action of signal 11 (SIGSEGV)
==23566==  Access not within mapped region at address 0x0
==23566==    at 0x4C294E2: strlen (mc_replace_strmem.c:390)
==23566==    by 0x406A62: main (char_traits.h:261)
==23566==  If you believe this happened as a result of a stack
==23566==  overflow in your program's main thread (unlikely but
==23566==  possible), you can try to increase the size of the
==23566==  main thread stack using the --main-stacksize= flag.
==23566==  The main thread stack size used in this run was 8388608.
==23566==
==23566== HEAP SUMMARY:
==23566==     in use at exit: 94,026 bytes in 43 blocks
==23566==   total heap usage: 57 allocs, 14 frees, 95,660 bytes allocated
==23566==
==23566== 27 bytes in 1 blocks are possibly lost in loss record 3 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAB92: std::string::_M_mutate(unsigned long, unsigned long, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAD2B: std::string::_M_replace_safe(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x4147DC: IIPResponse::IIPResponse() (basic_string.h:1128)
==23566==    by 0x406474: main (Main.cc:445)
==23566==
==23566== 28 bytes in 1 blocks are possibly lost in loss record 4 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC384: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC462: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x405DA2: main (Main.cc:138)
==23566==
==23566== 30 bytes in 1 blocks are possibly lost in loss record 5 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAB92: std::string::_M_mutate(unsigned long, unsigned long, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAD2B: std::string::_M_replace_safe(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x434AC1: Environment::getFileNamePattern() (basic_string.h:1128)
==23566==    by 0x405F86: main (Main.cc:233)
==23566==
==23566== 30 bytes in 1 blocks are possibly lost in loss record 6 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC384: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC462: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x434C10: Environment::getFileSystemPrefix() (Environment.h:137)
==23566==    by 0x405FAE: main (Main.cc:249)
==23566==
==23566== 37 bytes in 1 blocks are possibly lost in loss record 7 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC384: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC462: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x406847: main (Main.cc:490)
==23566==
==23566== 38 bytes in 1 blocks are possibly lost in loss record 8 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC384: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC462: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x4064B8: main (Main.cc:454)
==23566==
==23566== 40 bytes in 1 blocks are possibly lost in loss record 9 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC384: char* std::string::_S_construct<char const*>(char const*, char const*, std::allocator<char> const&, std::forward_iterator_tag) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CC462: std::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string(char const*, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x40697A: main (Main.cc:491)
==23566==
==23566== 43 bytes in 1 blocks are possibly lost in loss record 10 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAB92: std::string::_M_mutate(unsigned long, unsigned long, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAD2B: std::string::_M_replace_safe(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x41472C: IIPResponse::IIPResponse() (basic_string.h:1296)
==23566==    by 0x406474: main (Main.cc:445)
==23566==
==23566== 53 bytes in 1 blocks are possibly lost in loss record 13 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAB92: std::string::_M_mutate(unsigned long, unsigned long, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAD2B: std::string::_M_replace_safe(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x4147A9: IIPResponse::IIPResponse() (basic_string.h:1128)
==23566==    by 0x406474: main (Main.cc:445)
==23566==
==23566== 61 bytes in 1 blocks are possibly lost in loss record 14 of 31
==23566==    at 0x4C286E7: operator new(unsigned long) (vg_replace_malloc.c:287)
==23566==    by 0x57CA998: std::string::_Rep::_S_create(unsigned long, unsigned long, std::allocator<char> const&) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAB92: std::string::_M_mutate(unsigned long, unsigned long, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x57CAD2B: std::string::_M_replace_safe(unsigned long, unsigned long, char const*, unsigned long) (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.17)
==23566==    by 0x4147BB: IIPResponse::IIPResponse() (basic_string.h:1128)
==23566==    by 0x406474: main (Main.cc:445)
==23566==
==23566== LEAK SUMMARY:
==23566==    definitely lost: 0 bytes in 0 blocks
==23566==    indirectly lost: 0 bytes in 0 blocks
==23566==      possibly lost: 387 bytes in 10 blocks
==23566==    still reachable: 93,639 bytes in 33 blocks
==23566==         suppressed: 0 bytes in 0 blocks
==23566== Reachable blocks (those to which a pointer was found) are not shown.
==23566== To see them, rerun with: --leak-check=full --show-reachable=yes
==23566==
==23566== For counts of detected and suppressed errors, rerun with: -v
==23566== Use --track-origins=yes to see where uninitialised values come from
==23566== ERROR SUMMARY: 41 errors from 12 contexts (suppressed: 6 from 6)
Segmentation fault

[ruven]

Hmmm, still not clear what's going on. How recent is your iipsrv code? If it's not the latest, would you mind trying again with a fresh download from github: https://github.com/ruven/iipsrv/archive/master.zip ? And what compile flags are you using for iipsrv?

And is your Debian version also installed from the 7.7 iso? If not, which exact version?

[atomotic]

i did a git checkout, then

./autogen.sh
./configure
make
./src/iipsrv.fcgi --bind 127.0.0.1:9000

the server is a virtual machine at linode, debian 7.7 with these packages http://paste.debian.net/plain/139915

[ruven]

My Debian is a virtual machine using VirtualBox. Could this be a linode issue?

[brianhelba]

@atomotic Is it possible that #33 is your issue?

[atomotic]

indeed, #33 solves the problem. thanks!