{"thread":{"id":"18001","subject":"http-push: double free or corruption (!prev): 0x09fedb50","startedAt":"2009-02-24T23:45:38Z","lastAt":"2009-02-28T16:46:41Z","messageCount":3,"participants":["Felipe Contreras","Daniel Stenberg"],"isPatch":false,"patchVersion":null,"patchTotal":null},"messages":[{"id":"106124","messageId":"94a0d4530902241545h6781aefbne275f8017d65c8ee@mail.gmail.com","threadId":"18001","inReplyTo":null,"subject":"http-push: double free or corruption (!prev): 0x09fedb50","fromName":"Felipe Contreras","fromEmail":"felipe.contreras@gmail.com","sentAt":"2009-02-24T23:45:38Z","receivedAt":"2009-02-24T23:45:38Z","isPatch":false,"sender":{"key":"felipe.contreras@gmail.com","avatar":"https://avatars.githubusercontent.com/u/8358?v=4"},"body":"Hi,\n\nI'm trying to push over https and I keep getting a crash. \"curl -netrc\nhttps://server/repo/HEAD\" seems to work fine.\n\nAfter that I keep getting this error for a while:\nError: cannot lock existing info/refs\nerror: failed to push some refs to 'https://server/repo'\n\nI'm attaching the output of valgrind and this is the backtrace (not on\nthe same run):\n#0  0x00fef416 in __kernel_vsyscall ()\n#1  0x005d7460 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64\n#2  0x005d8e28 in abort () at abort.c:88\n#3  0x00614fed in __libc_message (do_abort=2, fmt=0x6efe68 \"*** glibc\ndetected *** %s: %s: 0x%s ***\\n\") at\n../sysdeps/unix/sysv/linux/libc_fatal.c:170\n#4  0x0061b3a4 in malloc_printerr (action=2, str=0x6eff60 \"double free\nor corruption (!prev)\", ptr=0x9fedb50) at malloc.c:5994\n#5  0x0061d356 in __libc_free (mem=0x9fedb50) at malloc.c:3625\n#6  0x064d5b37 in PR_Free (ptr=0x0) at\n../../../mozilla/nsprpub/pr/src/malloc/prmem.c:490\n#7  0x00df72f8 in nss_ZRealloc (pointer=0x9fedb58, newSize=4096) at arena.c:1076\n#8  0x00de579b in pem_CreateObject (fwInstance=0x8109ba0,\nfwSession=0x810bac8, mdToken=0x8109cf8, pTemplate=0xbfffd6e4,\nulAttributeCount=4, pError=0xbfffd608) at pobject.c:1080\n#9  0x00de73ce in pem_mdSession_CreateObject (mdSession=0x810bb38,\nfwSession=0x810bac8, mdToken=0x8109cf8, fwToken=0x810b098,\nmdInstance=0xe08180, fwInstance=0x8109ba0,\n    arena=0x810aff8, pTemplate=0xbfffd6e4, ulAttributeCount=4,\npError=0xbfffd608) at psession.c:156\n#10 0x00deb7f4 in nssCKFWSession_CreateObject (fwSession=0x810bac8,\npTemplate=0xbfffd6e4, ulAttributeCount=4, pError=0xbfffd608) at\nsession.c:1353\n#11 0x00df32c9 in NSSCKFWC_CreateObject (fwInstance=0x8109ba0,\nhSession=1, pTemplate=0xbfffd6e4, ulCount=4, phObject=0xbfffd698) at\nwrap.c:1991\n#12 0x00de24ac in pemC_CreateObject (hSession=1, pTemplate=0xbfffd6e4,\nulCount=4, phObject=0xbfffd698) at\n../../../../../dist/public/nss/nssck.api:566\n#13 0x0562fece in PK11_CreateNewObject (slot=0x810ad50, session=1,\ntheTemplate=0xbfffd6e4, count=4, token=0, objectID=0xbfffd698) at\npk11obj.c:412\n#14 0x05630150 in PK11_CreateGenericObject (slot=0x810ad50,\npTemplate=0xbfffd6e4, count=4, token=0) at pk11obj.c:1346\n#15 0x052ae9a3 in nss_load_cert (filename=0x9899fb8\n\"/etc/pki/tls/certs/ca-bundle.crt\", cacert=1) at nss.c:346\n#16 0x052af3b7 in Curl_nss_connect (conn=0x81d28f8, sockindex=0) at nss.c:956\n#17 0x052a6fd5 in Curl_ssl_connect_nonblocking (conn=0x81d28f8,\nsockindex=0, done=0xbfffebf9) at sslgen.c:249\n#18 0x05286e57 in https_connecting (done=0xbfffebf9, conn=0x81d28f8)\nat http.c:1751\n#19 Curl_http_connect (conn=0x81d28f8, done=0xbfffebf9) at http.c:1713\n#20 0x052a0855 in multi_runsingle (multi=0x80be9c0, easy=0x814d238) at\nmulti.c:1005\n#21 0x052a1099 in curl_multi_perform (multi_handle=0x80be9c0,\nrunning_handles=0xbfffec80) at multi.c:1460\n#22 0x0804df41 in step_active_slots () at http.c:450\n#23 0x0804df9f in run_active_slot (slot=0x80cd780) at http.c:474\n#24 0x0804f7b0 in remote_ls (path=<value optimized out>, flags=3,\nuserFunc=<value optimized out>, userData=0xbfffeefc) at\nhttp-push.c:1496\n#25 0x0805110d in get_remote_object_list () at http-push.c:1540\n#26 add_send_request (obj=0x83d0420, lock=0x8142050) at http-push.c:870\n#27 0x080511ee in get_delta (revs=0xbfffefb4, lock=0x8142050) at\nhttp-push.c:1695\n#28 0x08052204 in main (argc=3, argv=0xbffff314) at http-push.c:241\n\nAny ideas?\n\n-- \nFelipe Contreras\n\n\n==28907== Memcheck, a memory error detector.\n==28907== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.\n==28907== Using LibVEX rev 1804, a library for dynamic binary translation.\n==28907== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.\n==28907== Using valgrind-3.3.0, a dynamic binary instrumentation framework.\n==28907== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.\n==28907== \n==28907== My PID = 28907, parent PID = 27773.  Prog and args are:\n==28907==    /opt/git/libexec/git-core/git-http-push\n==28907==    https://dvcs.projects.maemo.org/git/gst-openmax\n==28907==    master\n==28907== \n--28907-- \n--28907-- Command line\n--28907--    /opt/git/libexec/git-core/git-http-push\n--28907--    https://dvcs.projects.maemo.org/git/gst-openmax\n--28907--    master\n--28907-- Startup, with flags:\n--28907--    -v\n--28907--    --log-file=/tmp/git-http-val-2.txt\n--28907-- Contents of /proc/version:\n--28907--   Linux version 2.6.27.15-170.2.24.fc10.i686 (mockbuild@x86-5.fedora.phx.redhat.com) (gcc version 4.3.2 20081105 (Red Hat 4.3.2-7) (GCC) ) #1 SMP Wed Feb 11 23:58:12 EST 2009\n--28907-- Arch and hwcaps: X86, x86-sse1-sse2\n--28907-- Page sizes: currently 4096, max supported 4096\n--28907-- Valgrind library directory: /usr/lib/valgrind\n--28907-- Reading syms from /lib/ld-2.9.so (0x4000000)\n--28907-- Reading debug info from /usr/lib/debug/lib/ld-2.9.so.debug...\n--28907-- Reading syms from /opt/git/libexec/git-core/git-http-push (0x8048000)\n--28907-- Reading syms from /usr/lib/valgrind/x86-linux/memcheck (0x38000000)\n--28907--    object doesn't have a dynamic symbol table\n--28907-- Reading suppressions file: /usr/lib/valgrind/default.supp\n--28907-- REDIR: 0x4019440 (index) redirected to 0x3802cf43 (vgPlain_x86_linux_REDIR_FOR_index)\n--28907-- Reading syms from /usr/lib/valgrind/x86-linux/vgpreload_core.so (0x4023000)\n--28907-- Reading syms from /usr/lib/valgrind/x86-linux/vgpreload_memcheck.so (0x4025000)\n==28907== WARNING: new redirection conflicts with existing -- ignoring it\n--28907--     new: 0x04019440 (index               ) R-> 0x04028f60 index\n--28907-- REDIR: 0x4019610 (strlen) redirected to 0x4029210 (strlen)\n--28907-- Reading syms from /usr/lib/libcurl.so.4.1.0 (0x5274000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libcurl.so.4.1.0.debug...\n--28907-- Reading syms from /lib/libz.so.1.2.3 (0x770000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libz.so.1.2.3.debug...\n--28907-- Reading syms from /lib/libcrypto.so.0.9.8g (0x4F94000)\n--28907--    object doesn't have a symbol table\n--28907-- Reading syms from /lib/libpthread-2.9.so (0x754000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libpthread-2.9.so.debug...\n--28907-- Reading syms from /lib/libexpat.so.1.5.2 (0xA17000)\n--28907--    object doesn't have a symbol table\n--28907-- Reading syms from /lib/libc-2.9.so (0x5AC000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libc-2.9.so.debug...\n--28907-- Reading syms from /lib/libidn.so.11.5.28 (0x212F000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libidn.so.11.5.28.debug...\n--28907-- Reading syms from /usr/lib/libssh2.so.1.0.0 (0x5128000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libssh2.so.1.0.0.debug...\n--28907-- Reading syms from /usr/lib/libldap-2.4.so.2.2.0 (0x50E4000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libldap-2.4.so.2.2.0.debug...\n--28907-- Reading syms from /lib/librt-2.9.so (0x889000)\n--28907-- Reading debug info from /usr/lib/debug/lib/librt-2.9.so.debug...\n--28907-- Reading syms from /usr/lib/libgssapi_krb5.so.2.2 (0x7638000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libgssapi_krb5.so.2.2.debug...\n--28907-- Reading syms from /usr/lib/libkrb5.so.3.3 (0x73E6000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libkrb5.so.3.3.debug...\n--28907-- Reading syms from /usr/lib/libk5crypto.so.3.1 (0x73BF000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libk5crypto.so.3.1.debug...\n--28907-- Reading syms from /lib/libcom_err.so.2.1 (0x739E000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libcom_err.so.2.1.debug...\n--28907-- Reading syms from /lib/libssl3.so (0x5190000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libssl3.so.debug...\n--28907-- Reading syms from /lib/libsmime3.so (0x5167000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libsmime3.so.debug...\n--28907-- Reading syms from /lib/libnss3.so (0x55ED000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnss3.so.debug...\n--28907-- Reading syms from /lib/libplds4.so (0x580000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libplds4.so.debug...\n--28907-- Reading syms from /lib/libplc4.so (0x6500000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libplc4.so.debug...\n--28907-- Reading syms from /lib/libnspr4.so (0x64C4000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnspr4.so.debug...\n--28907-- Reading syms from /lib/libdl-2.9.so (0x722000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libdl-2.9.so.debug...\n--28907-- Reading syms from /lib/libssl.so.0.9.8g (0x4F47000)\n--28907--    object doesn't have a symbol table\n--28907-- Reading syms from /usr/lib/liblber-2.4.so.2.2.0 (0x782E000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/liblber-2.4.so.2.2.0.debug...\n--28907-- Reading syms from /lib/libresolv-2.9.so (0x7232000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libresolv-2.9.so.debug...\n--28907-- Reading syms from /usr/lib/libsasl2.so.2.0.22 (0x7D9A000)\n--28907--    object doesn't have a symbol table\n--28907-- Reading syms from /usr/lib/libkrb5support.so.0.1 (0x73A3000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libkrb5support.so.0.1.debug...\n--28907-- Reading syms from /lib/libkeyutils-1.2.so (0x75D7000)\n--28907--    object doesn't have a symbol table\n--28907-- Reading syms from /lib/libnssutil3.so (0x514C000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnssutil3.so.debug...\n--28907-- Reading syms from /lib/libcrypt-2.9.so (0x7873000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libcrypt-2.9.so.debug...\n--28907-- Reading syms from /lib/libselinux.so.1 (0x786000)\n--28907--    object doesn't have a symbol table\n--28907-- REDIR: 0x622ca0 (index) redirected to 0x4028f30 (index)\n--28907-- REDIR: 0x624be0 (memchr) redirected to 0x4029610 (memchr)\n--28907-- REDIR: 0x623800 (rindex) redirected to 0x4028e40 (rindex)\n--28907-- REDIR: 0x61f6d0 (malloc) redirected to 0x4028a30 (malloc)\n--28907-- REDIR: 0x6255f0 (memcpy) redirected to 0x4029660 (memcpy)\n--28907-- REDIR: 0x623380 (strlen) redirected to 0x40291f0 (strlen)\n--28907-- REDIR: 0x61d2c0 (free) redirected to 0x4027850 (free)\n--28907-- REDIR: 0x628130 (strchrnul) redirected to 0x402a000 (strchrnul)\n--28907-- REDIR: 0x625140 (mempcpy) redirected to 0x402a060 (mempcpy)\n--28907-- REDIR: 0x61fb80 (realloc) redirected to 0x4028b40 (realloc)\n--28907-- REDIR: 0x6235a0 (strncmp) redirected to 0x4029460 (strncmp)\n--28907-- REDIR: 0x622e80 (strcpy) redirected to 0x4029250 (strcpy)\n--28907-- REDIR: 0x61f3a0 (calloc) redirected to 0x4026ae0 (calloc)\n--28907-- REDIR: 0x6250e0 (memset) redirected to 0x4029f30 (memset)\n--28907-- REDIR: 0x4019a00 (stpcpy) redirected to 0x4029d90 (stpcpy)\n--28907-- REDIR: 0x628060 (rawmemchr) redirected to 0x402a040 (rawmemchr)\n--28907-- REDIR: 0x6236b0 (strncpy) redirected to 0x4029320 (strncpy)\n--28907-- REDIR: 0x622e10 (strcmp) redirected to 0x40294f0 (strcmp)\n--28907-- REDIR: 0x6252d0 (stpcpy) redirected to 0x4029cc0 (stpcpy)\n--28907-- Reading syms from /lib/libnss_files-2.9.so (0x4449000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnss_files-2.9.so.debug...\n--28907-- Reading syms from /lib/libnss_mdns4_minimal.so.2 (0x4456000)\n--28907--    object doesn't have a symbol table\n--28907-- Reading syms from /lib/libnss_dns-2.9.so (0x4459000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnss_dns-2.9.so.debug...\n--28907-- REDIR: 0x6a6cb0 (__strcpy_chk) redirected to 0x402a5e0 (__strcpy_chk)\n--28907-- Reading syms from /lib/libsoftokn3.so (0x4460000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libsoftokn3.so.debug...\n--28907-- Reading syms from /usr/lib/libsqlite3.so.0.8.6 (0x3064000)\n--28907-- Reading debug info from /usr/lib/debug/usr/lib/libsqlite3.so.0.8.6.debug...\n--28907-- Reading syms from /lib/libnssdbm3.so (0x4499000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnssdbm3.so.debug...\n--28907-- REDIR: 0x622af0 (strcat) redirected to 0x4028fc0 (strcat)\n--28907-- Reading syms from /lib/libfreebl3.so (0x44C0000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libfreebl3.so.debug...\n--28907-- REDIR: 0x6255e0 (__memcpy_chk) redirected to 0x402a470 (__memcpy_chk)\n--28907-- Reading syms from /lib/libnsspem.so (0x4500000)\n--28907-- Reading debug info from /usr/lib/debug/lib/libnsspem.so.debug...\n--28907-- REDIR: 0x625070 (memmove) redirected to 0x4029f90 (memmove)\n--28907-- REDIR: 0x623430 (strnlen) redirected to 0x40291b0 (strnlen)\n==28907== Invalid write of size 4\n==28907==    at 0x45057BF: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x89713b8 is 0 bytes after a block of size 63,496 alloc'd\n==28907==    at 0x4026BA2: calloc (vg_replace_malloc.c:397)\n==28907==    by 0x64D6039: PR_Calloc (prmem.c:474)\n==28907==    by 0x4517297: nss_ZRealloc (arena.c:1056)\n==28907==    by 0x450579A: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907== \n==28907== Invalid write of size 4\n==28907==    at 0x450588A: pem_CreateObject (pobject.c:1089)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x89713bc is 4 bytes after a block of size 63,496 alloc'd\n==28907==    at 0x4026BA2: calloc (vg_replace_malloc.c:397)\n==28907==    by 0x64D6039: PR_Calloc (prmem.c:474)\n==28907==    by 0x4517297: nss_ZRealloc (arena.c:1056)\n==28907==    by 0x450579A: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907== \n==28907== Invalid read of size 4\n==28907==    at 0x45056B7: pem_CreateObject (pobject.c:1054)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x89713b8 is 0 bytes after a block of size 63,496 alloc'd\n==28907==    at 0x4026BA2: calloc (vg_replace_malloc.c:397)\n==28907==    by 0x64D6039: PR_Calloc (prmem.c:474)\n==28907==    by 0x4517297: nss_ZRealloc (arena.c:1056)\n==28907==    by 0x450579A: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907== \n==28907== Invalid read of size 4\n==28907==    at 0x45056BA: pem_CreateObject (pobject.c:1054)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x1f4 is not stack'd, malloc'd or (recently) free'd\n==28907== \n==28907== Process terminating with default action of signal 11 (SIGSEGV): dumping core\n==28907==  Access not within mapped region at address 0x1F4\n==28907==    at 0x45056BA: pem_CreateObject (pobject.c:1054)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n--28907-- Discarding syms at 0x4449000-0x4456000 in /lib/libnss_files-2.9.so due to munmap()\n--28907-- Discarding syms at 0x4456000-0x4459000 in /lib/libnss_mdns4_minimal.so.2 due to munmap()\n--28907-- Discarding syms at 0x4459000-0x4460000 in /lib/libnss_dns-2.9.so due to munmap()\n==28907== \n==28907== ERROR SUMMARY: 1257 errors from 4 contexts (suppressed: 67 from 1)\n==28907== \n==28907== 1 errors in context 1 of 4:\n==28907== Invalid read of size 4\n==28907==    at 0x45056BA: pem_CreateObject (pobject.c:1054)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x1f4 is not stack'd, malloc'd or (recently) free'd\n==28907== \n==28907== 256 errors in context 2 of 4:\n==28907== Invalid write of size 4\n==28907==    at 0x450588A: pem_CreateObject (pobject.c:1089)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x89713bc is 4 bytes after a block of size 63,496 alloc'd\n==28907==    at 0x4026BA2: calloc (vg_replace_malloc.c:397)\n==28907==    by 0x64D6039: PR_Calloc (prmem.c:474)\n==28907==    by 0x4517297: nss_ZRealloc (arena.c:1056)\n==28907==    by 0x450579A: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907== \n==28907== 256 errors in context 3 of 4:\n==28907== Invalid write of size 4\n==28907==    at 0x45057BF: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x89713b8 is 0 bytes after a block of size 63,496 alloc'd\n==28907==    at 0x4026BA2: calloc (vg_replace_malloc.c:397)\n==28907==    by 0x64D6039: PR_Calloc (prmem.c:474)\n==28907==    by 0x4517297: nss_ZRealloc (arena.c:1056)\n==28907==    by 0x450579A: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907== \n==28907== 744 errors in context 4 of 4:\n==28907== Invalid read of size 4\n==28907==    at 0x45056B7: pem_CreateObject (pobject.c:1054)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n==28907==    by 0x52A6FD4: Curl_ssl_connect_nonblocking (sslgen.c:249)\n==28907==    by 0x5286E56: Curl_http_connect (http.c:1751)\n==28907==    by 0x52A0854: multi_runsingle (multi.c:1005)\n==28907==  Address 0x89713b8 is 0 bytes after a block of size 63,496 alloc'd\n==28907==    at 0x4026BA2: calloc (vg_replace_malloc.c:397)\n==28907==    by 0x64D6039: PR_Calloc (prmem.c:474)\n==28907==    by 0x4517297: nss_ZRealloc (arena.c:1056)\n==28907==    by 0x450579A: pem_CreateObject (pobject.c:1080)\n==28907==    by 0x45073CD: pem_mdSession_CreateObject (psession.c:156)\n==28907==    by 0x450B7F3: nssCKFWSession_CreateObject (session.c:1353)\n==28907==    by 0x45132C8: NSSCKFWC_CreateObject (wrap.c:1991)\n==28907==    by 0x45024AB: pemC_CreateObject (nssck.api:566)\n==28907==    by 0x562FECD: PK11_CreateNewObject (pk11obj.c:412)\n==28907==    by 0x563014F: PK11_CreateGenericObject (pk11obj.c:1346)\n==28907==    by 0x52AE9A2: nss_load_cert (nss.c:346)\n==28907==    by 0x52AF3B6: Curl_nss_connect (nss.c:956)\n--28907-- \n--28907-- supp:     67 dl-hack3-1\n==28907== \n==28907== IN SUMMARY: 1257 errors from 4 contexts (suppressed: 67 from 1)\n==28907== \n==28907== malloc/free: in use at exit: 34,422,167 bytes in 137,428 blocks.\n==28907== malloc/free: 183,733 allocs, 46,305 frees, 103,693,559 bytes allocated.\n==28907== \n==28907== searching for pointers to 137,428 not-freed blocks.\n==28907== checked 33,125,564 bytes.\n==28907== \n==28907== LEAK SUMMARY:\n==28907==    definitely lost: 999,679 bytes in 4,301 blocks.\n==28907==      possibly lost: 31,878,328 bytes in 129,167 blocks.\n==28907==    still reachable: 1,544,160 bytes in 3,960 blocks.\n==28907==         suppressed: 0 bytes in 0 blocks.\n==28907== Rerun with --leak-check=full to see details of leaked memory.\n--28907--  memcheck: sanity checks: 3839 cheap, 69 expensive\n--28907--  memcheck: auxmaps: 0 auxmap entries (0k, 0M) in use\n--28907--  memcheck: auxmaps_L1: 0 searches, 0 cmps, ratio 0:10\n--28907--  memcheck: auxmaps_L2: 0 searches, 0 nodes\n--28907--  memcheck: SMs: n_issued      = 1335 (21360k, 20M)\n--28907--  memcheck: SMs: n_deissued    = 551 (8816k, 8M)\n--28907--  memcheck: SMs: max_noaccess  = 65535 (1048560k, 1023M)\n--28907--  memcheck: SMs: max_undefined = 0 (0k, 0M)\n--28907--  memcheck: SMs: max_defined   = 137 (2192k, 2M)\n--28907--  memcheck: SMs: max_non_DSM   = 792 (12672k, 12M)\n--28907--  memcheck: max sec V bit nodes:    6 (0k, 0M)\n--28907--  memcheck: set_sec_vbits8 calls: 9 (new: 6, updates: 3)\n--28907--  memcheck: max shadow mem size:   12976k, 12M\n--28907-- translate:            fast SP updates identified: 32,327 ( 87.7%)\n--28907-- translate:   generic_known SP updates identified: 3,355 (  9.1%)\n--28907-- translate: generic_unknown SP updates identified: 1,164 (  3.1%)\n--28907--     tt/tc: 279,903 tt lookups requiring 390,796 probes\n--28907--     tt/tc: 279,903 fast-cache updates, 6 flushes\n--28907--  transtab: new        25,728 (657,665 -> 9,147,911; ratio 139:10) [0 scs]\n--28907--  transtab: dumped     0 (0 -> ??)\n--28907--  transtab: discarded  293 (6,109 -> ??)\n--28907-- scheduler: 383,952,961 jumps (bb entries).\n--28907-- scheduler: 3,839/500,212 major/minor sched events.\n--28907--    sanity: 3840 cheap, 69 expensive checks.\n--28907--    exectx: 6,151 lists, 3,569 contexts (avg 0 per list)\n--28907--    exectx: 231,353 searches, 248,435 full compares (1,073 per 1000)\n--28907--    exectx: 0 cmp2, 1,975 cmp4, 0 cmpAll\n--28907--  errormgr: 17 supplist searches, 125 comparisons during search\n--28907--  errormgr: 1,324 errlist searches, 2,027 comparisons during search\n"},{"id":"106152","messageId":"alpine.DEB.1.10.0902250912470.28808@yvahk2.pbagnpgbe.fr","threadId":"18001","inReplyTo":"94a0d4530902241545h6781aefbne275f8017d65c8ee@mail.gmail.com","subject":"Re: http-push: double free or corruption (!prev): 0x09fedb50","fromName":"Daniel Stenberg","fromEmail":"daniel@haxx.se","sentAt":"2009-02-25T08:18:50Z","receivedAt":"2009-02-25T08:18:50Z","isPatch":false,"sender":{"key":"daniel@haxx.se","avatar":"https://gravatar.com/avatar/69fdca87edd17cee21ca2e79fc2ff671d644603c3dc27167430f3cd3dbab7ba8?d=mp&s=160"},"body":"On Wed, 25 Feb 2009, Felipe Contreras wrote:\n\n> I'm trying to push over https and I keep getting a crash. \"curl -netrc \n> https://server/repo/HEAD\" seems to work fine.\n\n> I'm attaching the output of valgrind and this is the backtrace (not on\n> the same run):\n\n> #6  0x064d5b37 in PR_Free (ptr=0x0) at\n> ../../../mozilla/nsprpub/pr/src/malloc/prmem.c:490\n> #7  0x00df72f8 in nss_ZRealloc (pointer=0x9fedb58, newSize=4096) at arena.c:1076\n> #8  0x00de579b in pem_CreateObject (fwInstance=0x8109ba0,\n> fwSession=0x810bac8, mdToken=0x8109cf8, pTemplate=0xbfffd6e4,\n> ulAttributeCount=4, pError=0xbfffd608) at pobject.c:1080\n\n[...]\n\n> Any ideas?\n\nYou didn't mention what libcurl version you use, but clearly this is built to \nuse NSS for the SSL layer so I guess you're using a Fedora-provided library.\n\nThere's already at least one NSS-libcurl-git related bug report[*] for Fedora \nsubmitted and I think you'll have a reason to follow that to see if you can \nhelp them or they can help you. To me this looks like at least one NSS bug.\n\nIn the mean time I suggest you attempt a work-around: build a new libcurl \npowered by another SSL library such as OpenSSL or GnuTLS. It's just a matter \nof running libcurl's configure with the proper command line\n\n[*] = https://bugzilla.redhat.com/show_bug.cgi?id=483222\n\n-- \n\n  / daniel.haxx.se\n"},{"id":"106537","messageId":"94a0d4530902280846mcfd30b1ka4bef4efbfc3240b@mail.gmail.com","threadId":"18001","inReplyTo":"alpine.DEB.1.10.0902250912470.28808@yvahk2.pbagnpgbe.fr","subject":"Re: http-push: double free or corruption (!prev): 0x09fedb50","fromName":"Felipe Contreras","fromEmail":"felipe.contreras@gmail.com","sentAt":"2009-02-28T16:46:41Z","receivedAt":"2009-02-28T16:46:41Z","isPatch":false,"sender":{"key":"felipe.contreras@gmail.com","avatar":"https://avatars.githubusercontent.com/u/8358?v=4"},"body":"Hi,\n\nHmm, you didn't CC me so I didn't see your message until now. In\ngeneral it's a good idea to CC people in case they are not suscribed,\nfortunately this is not the case.\n\nOn Wed, Feb 25, 2009 at 10:18 AM, Daniel Stenberg <daniel@haxx.se> wrote:\n> On Wed, 25 Feb 2009, Felipe Contreras wrote:\n>\n>> I'm trying to push over https and I keep getting a crash. \"curl -netrc\n>> https://server/repo/HEAD\" seems to work fine.\n>\n>> I'm attaching the output of valgrind and this is the backtrace (not on\n>> the same run):\n>\n>> #6  0x064d5b37 in PR_Free (ptr=0x0) at\n>> ../../../mozilla/nsprpub/pr/src/malloc/prmem.c:490\n>> #7  0x00df72f8 in nss_ZRealloc (pointer=0x9fedb58, newSize=4096) at\n>> arena.c:1076\n>> #8  0x00de579b in pem_CreateObject (fwInstance=0x8109ba0,\n>> fwSession=0x810bac8, mdToken=0x8109cf8, pTemplate=0xbfffd6e4,\n>> ulAttributeCount=4, pError=0xbfffd608) at pobject.c:1080\n>\n> [...]\n>\n>> Any ideas?\n>\n> You didn't mention what libcurl version you use, but clearly this is built\n> to use NSS for the SSL layer so I guess you're using a Fedora-provided\n> library.\n\nIndeed, Fedora 10; libcurl 7.18.2.\n\n> There's already at least one NSS-libcurl-git related bug report[*] for\n> Fedora submitted and I think you'll have a reason to follow that to see if\n> you can help them or they can help you. To me this looks like at least one\n> NSS bug.\n>\n> In the mean time I suggest you attempt a work-around: build a new libcurl\n> powered by another SSL library such as OpenSSL or GnuTLS. It's just a matter\n> of running libcurl's configure with the proper command line\n\nYes, actually I did that and it works fine. For the record, the new\nlibcurl with NSS still crashes.\n\n> [*] = https://bugzilla.redhat.com/show_bug.cgi?id=483222\n\nThanks.\n\n-- \nFelipe Contreras\n"}]}