[Bug 1916501] Re: qemu-img convert segfaults with specific URL

2021-04-30 Thread Thomas Huth
https://gitlab.com/qemu-project/qemu/-/commit/0f418a207696b37f05d ** Changed in: qemu Status: New => Fix Released -- You received this bug notification because you are a member of qemu- devel-ml, which is subscribed to QEMU. https://bugs.launchpad.net/bugs/1916501 Title: qemu-img conve

[Bug 1916501] Re: qemu-img convert segfaults with specific URL

2021-03-09 Thread Max Reitz
I think I’ve come to kind of understood what might be wrong: qemu frees CURLSocket objects when “their” transfer is done, but libcurl’s documentation actually doesn’t note any long-lasting relationship between a socket and some transfer (i.e., a CURL object), so we probably shouldn’t free CURLSocke

[Bug 1916501] Re: qemu-img convert segfaults with specific URL

2021-03-03 Thread Max Reitz
Yes, as I wrote in comment 1, curl reports CURLMSG_DONE, the socket is freed, but then curl_multi_do() is called again for that socket (despite the CURLMSG_DONE). I suspect that qemu has interpreted the curl interface differently than curl itself (i.e., qemu has probably understood something wrong

[Bug 1916501] Re: qemu-img convert segfaults with specific URL

2021-03-02 Thread Julio Faracco
Guys, when I run with valgrind, I always get this when segfault occurs: ==74885== Invalid read of size 8 ==74885==at 0x1DC87D: curl_multi_do (curl.c:410) ==74885==by 0x23B949: aio_dispatch_handler (aio-posix.c:329) ==74885==by 0x23C0A1: aio_dispatch_handlers (aio-posix.c:372) ==74885==

[Bug 1916501] Re: qemu-img convert segfaults with specific URL

2021-02-23 Thread Max Reitz
I can reproduce this, and I can reproduce it back to 5.0 (haven’t tried any release before that). I couldn’t find a definite reason for why it breaks (curl_clean_state() is called because curl reports CURLMSG_DONE, freeing a socket, but then curl_multi_do() is called again for that socket, resulti