Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

buffer overflow detected #16378

Closed
cpanceac opened this issue Feb 4, 2022 · 9 comments
Closed

buffer overflow detected #16378

cpanceac opened this issue Feb 4, 2022 · 9 comments
Labels
Crash OS: Linux Issues specific to Linux distributions

Comments

@cpanceac
Copy link

cpanceac commented Feb 4, 2022

qBittorrent & operating system versions

qBittorrent version: v4.4.0
Fedora release 35 (Thirty Five)
qt-4.8.7-65.fc35.x86_64
libtorrent-0.13.8-6.fc35.x86_64
package libtorrent-rasterbar is not installed

What is the problem?

buffer overflow detected when pressing "Add torrent link" button.
This happens after a qbittorrent was running for a while (30 minutes?)
It does not happen immediately after starting it.

Steps to reproduce

Start qbittorrent
Wait 30 minutes (?) or more.
press "Add torrent link" button

Additional context

No response

Log(s) & preferences file(s)

$ qbittorrent
QSocketNotifier: Can only be used with threads started with QThread

(qbittorrent:4930): Gtk-WARNING **: 08:45:13.967: Theme parsing error: colors.css:71:44: Invalid number for color value

(qbittorrent:4930): Gtk-WARNING **: 08:45:13.967: Theme parsing error: colors.css:72:44: Invalid number for color value

(qbittorrent:4930): Gtk-WARNING **: 08:45:13.967: Theme parsing error: colors.css:74:53: Invalid number for color value

(qbittorrent:4930): Gtk-WARNING **: 08:45:13.967: Theme parsing error: colors.css:75:53: Invalid number for color value

(qbittorrent:4930): Gtk-WARNING **: 08:45:13.967: Theme parsing error: colors.css:76:56: Invalid number for color value

(qbittorrent:4930): Gtk-WARNING **: 08:45:13.967: Theme parsing error: colors.css:77:65: Invalid number for color value
The legacy data directory '/home/cornel/.local/share/data/qBittorrent' is used. It is recommended to move its content to '/home/cornel/.local/share/qBittorrent'
The legacy data directory '/home/cornel/.local/share/data/qBittorrent' is used. It is recommended to move its content to '/home/cornel/.local/share/qBittorrent'
The legacy data directory '/home/cornel/.local/share/data/qBittorrent' is used. It is recommended to move its content to '/home/cornel/.local/share/qBittorrent'
The legacy data directory '/home/cornel/.local/share/data/qBittorrent' is used. It is recommended to move its content to '/home/cornel/.local/share/qBittorrent'
qt.qpa.wayland: Wayland does not support QWindow::requestActivate()
The legacy data directory '/home/cornel/.local/share/data/qBittorrent' is used. It is recommended to move its content to '/home/cornel/.local/share/qBittorrent'
The legacy data directory '/home/cornel/.local/share/data/qBittorrent' is used. It is recommended to move its content to '/home/cornel/.local/share/qBittorrent'
*** buffer overflow detected ***: terminated


Please file a bug report at http://bug.qbittorrent.org and provide the following information:

qBittorrent version: v4.4.0

Caught signal: SIGABRT
Stack trace:
/lib64/libc.so.6 : ()+0x8f88c [0x7f86fef4688c]
/lib64/libc.so.6 : raise()+0x16 [0x7f86feef96a6]
/lib64/libc.so.6 : abort()+0xd3 [0x7f86feee37d3]
/lib64/libc.so.6 : ()+0x83a07 [0x7f86fef3aa07]
/lib64/libc.so.6 : __fortify_fail()+0x2a [0x7f86fefd826a]
/lib64/libc.so.6 : ()+0x11fbc6 [0x7f86fefd6bc6]
/lib64/libc.so.6 : ()+0x1211ab [0x7f86fefd81ab]
/lib64/libQt5WaylandClient.so.5 : ()+0xaaa7c [0x7f86eea36a7c]
/lib64/libQt5WaylandClient.so.5 : ()+0x9d08b [0x7f86eea2908b]
/lib64/libQt5Gui.so.5 : QInternalMimeData::retrieveData(QString const&, QVariant::Type) const+0x38 [0x7f870059e6e8]
/lib64/libQt5Core.so.5 : ()+0x2cab6d [0x7f86ff6a3b6d]
/lib64/libQt5Core.so.5 : QMimeData::text() const+0x51 [0x7f86ff6a48a1]
/lib64/libQt5Gui.so.5 : QClipboard::text(QClipboard::Mode) const+0x37 [0x7f8700590037]
qbittorrent : ()+0x23c96d [0x5589d1b0896d]
qbittorrent : ()+0x2325d1 [0x5589d1afe5d1]
/lib64/libQt5Core.so.5 : ()+0x2da348 [0x7f86ff6b3348]
/lib64/libQt5Widgets.so.5 : QAction::triggered(bool)+0x46 [0x7f8700bff916]
/lib64/libQt5Widgets.so.5 : QAction::activate(QAction::ActionEvent)+0xac [0x7f8700c0262c]
/lib64/libQt5Widgets.so.5 : ()+0x2a55aa [0x7f8700cfd5aa]
/lib64/libQt5Widgets.so.5 : QAbstractButton::mouseReleaseEvent(QMouseEvent*)+0xf7 [0x7f8700cfd707]
/lib64/libQt5Widgets.so.5 : QToolButton::mouseReleaseEvent(QMouseEvent*)+0xe [0x7f8700dfa31e]
/lib64/libQt5Widgets.so.5 : QWidget::event(QEvent*)+0x20e [0x7f8700c48e7e]
/lib64/libQt5Widgets.so.5 : QApplicationPrivate::notify_helper(QObject*, QEvent*)+0x83 [0x7f8700c06443]
/lib64/libQt5Widgets.so.5 : QApplication::notify(QObject*, QEvent*)+0xa84 [0x7f8700c0e074]
/lib64/libQt5Core.so.5 : QCoreApplication::notifyInternal2(QObject*, QEvent*)+0x128 [0x7f86ff67f7d8]
/lib64/libQt5Widgets.so.5 : QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer&, bool, bool)+0x1b7 [0x7f8700c0cb57]
/lib64/libQt5Widgets.so.5 : ()+0x20a450 [0x7f8700c62450]
/lib64/libQt5Widgets.so.5 : ()+0x20d6e5 [0x7f8700c656e5]
/lib64/libQt5Widgets.so.5 : QApplicationPrivate::notify_helper(QObject*, QEvent*)+0x83 [0x7f8700c06443]
/lib64/libQt5Core.so.5 : QCoreApplication::notifyInternal2(QObject*, QEvent*)+0x128 [0x7f86ff67f7d8]
/lib64/libQt5Gui.so.5 : QGuiApplicationPrivate::processMouseEvent(QWindowSystemInterfacePrivate::MouseEvent*)+0x6b8 [0x7f8700582b98]
/lib64/libQt5Gui.so.5 : QWindowSystemInterface::sendWindowSystemEvents(QFlagsQEventLoop::ProcessEventsFlag)+0xac [0x7f8700562c9c]
/lib64/libQt5WaylandClient.so.5 : ()+0xb9ac4 [0x7f86eea45ac4]
/lib64/libglib-2.0.so.0 : g_main_context_dispatch()+0x19f [0x7f86fe47605f]
/lib64/libglib-2.0.so.0 : ()+0xaa298 [0x7f86fe4cb298]
/lib64/libglib-2.0.so.0 : g_main_context_iteration()+0x33 [0x7f86fe473853]
/lib64/libQt5Core.so.5 : QEventDispatcherGlib::processEvents(QFlagsQEventLoop::ProcessEventsFlag)+0x68 [0x7f86ff6d0bb8]
/lib64/libQt5Core.so.5 : QEventLoop::exec(QFlagsQEventLoop::ProcessEventsFlag)+0x132 [0x7f86ff67e1e2]
/lib64/libQt5Core.so.5 : QCoreApplication::exec()+0x94 [0x7f86ff686724]
qbittorrent : ()+0xcca89 [0x5589d1998a89]
qbittorrent : ()+0xbae7a [0x5589d1986e7a]
/lib64/libc.so.6 : ()+0x2d560 [0x7f86feee4560]
/lib64/libc.so.6 : __libc_start_main()+0x7c [0x7f86feee460c]
qbittorrent : ()+0xc0865 [0x5589d198c865]
Aborted (core dumped)

@thalieht thalieht added Crash OS: Linux Issues specific to Linux distributions labels Feb 4, 2022
@cpanceac
Copy link
Author

cpanceac commented Feb 5, 2022

One interesting fact: after a few hours of running, if there's no torrent link in the clipboard, the "Add torrent link" window opens fine. However, after copying the link and attempting to paste the link into the said window, qbittorrent crashes. (not quite sure of the order of events here since it happened only once. I see this options:

  • client crashed when the link was copied (unlikely)
  • it crashed when i clicked the "Add torrent link" window's field
  • it crashed when i attempted ctrl-v on the window's field.
    )

@rag217
Copy link

rag217 commented Feb 9, 2022

i'm facing a similar issue on fedora 34 ..it keeps crashing if i do anything else while a torrent is downloading. i think the memory issue was always there but after the recent selinux update the os is aborting the app.

@cpanceac
Copy link
Author

@rag217, if sealert applet does not appear, then probably it's not selinux. Anyway, changing selinux from enforcing to permissive, may give us an indication if this fixes the problem.

@toppk
Copy link

toppk commented Apr 3, 2022

From the stack trace, this seem like a "harmless" buffer overflow that fedora captured with fortify. Given that it is inside the wayland backend, makes me think this maybe an issue inside qt, and not qbittorent. I launch qbittorrent with the environment variable QT_QPA_PLATFORM=xcb allows me to avoid this crash while adding magnet links. I suggest anyone encountering do the same until the underlying bug is found and fixed.

@toppk
Copy link

toppk commented Apr 3, 2022

I think this is an issue related to using select inside the qt wayland plugin for accessing the clipboard. If you happen to get a fd number greater than 1024 when accessing the clipboard this will trigger this issue (which is likely if you have a torrent with lots of files inside of it).

described here:
https://stackoverflow.com/questions/22827510/how-to-avoid-bad-fd-set-buffer-overflow-crash

A fix should be to convert the select to poll inside qt-wayland/src/client/qwaylanddataoffer.cpp QWaylandMimeData::readData() function.

I'm not sure if there is an upstream process for QT, but maybe fedora will take a patch.

@toppk
Copy link

toppk commented Apr 21, 2022

There is now a patched qtwayland in fedora 35 updates-testing, if you want to test a fix https://bodhi.fedoraproject.org/updates/FEDORA-2022-8b9d7da40a

the upstream fix is here for reference:
https://codereview.qt-project.org/c/qt/qtwayland/+/404299

@cpanceac
Copy link
Author

In the first day after installing the new qtwayland, i've not seen the problem anymore. Further testing may help but till then all looks good.

@luzpaz
Copy link
Contributor

luzpaz commented Apr 13, 2023

This ticket can probably be closed then

@luzpaz
Copy link
Contributor

luzpaz commented Nov 18, 2023

Closing

@luzpaz luzpaz closed this as completed Nov 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Crash OS: Linux Issues specific to Linux distributions
Projects
None yet
Development

No branches or pull requests

5 participants