segfault

[Jack Bates]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb7316920 (LWP 2879)]
ne_ssl_cert_free (cert=0x0) at ne_gnutls.c:1181
1181	    gnutls_x509_crt_deinit(cert->subject);
(gdb) bt
#0  ne_ssl_cert_free (cert=0x0) at ne_gnutls.c:1181
#1  0xb797b033 in ne__negotiate_ssl (sess=0x9690608) at ne_gnutls.c:724
#2  0xb796c469 in send_request (req=0x96911f8, request=0x9674570)
    at ne_request.c:1542
#3  0xb796b8c5 in ne_begin_request (req=0x96911f8) at ne_request.c:1167
#4  0xb796c0dd in ne_request_dispatch (req=0x96911f8) at ne_request.c:1376
#5  0xb79683ff in svn_ra_neon__request_dispatch (code_p=0xbfa158b8, 
    req=0x966b940, extra_headers=0x0, body=0x0, okay_1=200, okay_2=0, 
    pool=0x966e910) at subversion/libsvn_ra_neon/util.c:1446
#6  0xb7965b84 in exchange_capabilities (ras=0x966ea30, pool=0x966e910)
    at subversion/libsvn_ra_neon/session.c:797
#7  0xb796688e in svn_ra_neon__open (session=0x966e9c0, 
    repos_URL=0x96731b8 "https://cgi.sfu.ca:8080/svn", callbacks=0x966e948, 
    callback_baton=0x966e970, config=0x9655568, pool=0x966e910)
    at subversion/libsvn_ra_neon/session.c:1279
#8  0xb7e7917d in svn_ra_open3 (session_p=0xbfa15af8, 
    repos_URL=0x96731b8 "https://cgi.sfu.ca:8080/svn", uuid=0x0, 
    callbacks=0x966e948, callback_baton=0x966e970, config=0x9655568, 
    pool=0x966e910) at subversion/libsvn_ra/ra_loader.c:593
#9  0xb7eee49c in svn_client__open_ra_session_internal (ra_session=0xbfa15af8, 
    base_url=0x96731b8 "https://cgi.sfu.ca:8080/svn", base_dir=0x0, 
    base_access=0x0, commit_items=0x0, use_admin=0, read_only_wc=0, 
    ctx=0x9655518, pool=0x966e910) at subversion/libsvn_client/ra.c:317
---Type <return> to continue, or q <return> to quit---
#10 0xb7eeeb96 in svn_client__ra_session_from_path (ra_session_p=0xbfa15b78, 
    rev_p=0xbfa15b74, url_p=0xbfa15b6c, 
    path_or_url=0x96731b8 "https://cgi.sfu.ca:8080/svn", base_access=0x0, 
    peg_revision_p=0xbfa15bcc, revision=0xbfa15c68, ctx=0x9655518, 
    pool=0x966e910) at subversion/libsvn_client/ra.c:437
#11 0xb7edbfce in svn_client_list2 (
    path_or_url=0x96731b8 "https://cgi.sfu.ca:8080/svn", 
    peg_revision=0xbfa15bcc, revision=0xbfa15c68, depth=svn_depth_immediates, 
    dirent_fields=1, fetch_locks=0, list_func=0x8051b40 <print_dirent>, 
    baton=0xbfa15bd8, ctx=0x9655518, pool=0x966e910)
    at subversion/libsvn_client/list.c:136
#12 0x080518b0 in svn_cl__list (os=0x9654b50, baton=0xbfa15dc8, pool=0x96549b0)
    at subversion/svn/list-cmd.c:281
#13 0x0805472b in main (argc=637780, argv=0xb7d80578)
    at subversion/svn/main.c:2009
(gdb) 

I think the problem is in ne_gnutls.c, in "make_peers_chain", line 724:

            ne_ssl_cert_free(top);

I think the problem is that the first time through the loop, "top" is
NULL, so if "gnutls_x509_crt_init" or "gnutls_x509_crt_import" fail,
"ne_ssl_cert_free" is called on NULL.

I compiled neon trunk, r1555, and reproduced the segfault. I used neon
with the Subversion client to reproduce the segfault. Here is a
screenlog of checking out Subversion trunk and neon trunk, compiling,
running with gdb, and printing the backtrace:
http://cgi.sfu.ca/~jdbates/tmp/mod-gnutls/200810030/screenlog

To reproduce the segfault, I am connecting to my Apache server, running
mod_gnutls with an OpenPGP certificate. I think this is the reason that
"gnutls_x509_crt_import" fails : )

I setup an Apache server, running mod_gnutls with an OpenPGP
certificate, in case you want to test:
https://campcoop.com:9443/svn/mod-atom-svn

My goal is to authenticate to my Subversion repository using neon,
GnuTLS, and my GPG key. I think that neon does not yet support the
GnuTLS OpenPGP extension. Is anyone already working on adding this
support? Would a patch for adding this support be welcome?
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 197 bytes
Desc: This is a digitally signed message part
Url : http://lists.manyfish.co.uk/pipermail/neon/attachments/20081005/eeed256a/attachment-0010.bin 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/x-pkcs7-signature
Size: 1920 bytes
Desc: not available
Url : http://lists.manyfish.co.uk/pipermail/neon/attachments/20081005/eeed256a/attachment-0011.bin