Nut upsdev - Nov 2010 - segmentation fault in blazer_status().

Hi All,

i'm running blazer_usb on my home orvaldi ups and i'm observing in dmesg
one, two or three segafults of blazer_usb per day and notifications about
broken/re-established communication like this:

blazer_usb[2985]: Communications with UPS lost: status read failed!
blazer_usb[2985]: Communications with UPS re-established

today i've started ups service again with attached (c)gdb session for final
hunting...

Program received signal SIGSEGV, Segmentation fault.
__strspn_c2 (cmd=<value optimized out>) at
/usr/include/bits/string2.h:1063

(gdb) up
#1  blazer_status (cmd=<value optimized out>) at blazer.c:214

(gdb) p val
$1 = 0x0

(gdb) p buf
$5 =  
"(239.0\000\062\063\071.0\000\062\063\071.0\000\060\062\063\000\065\060.0\000\061\063.6\030\064\064.0\000\060\060\060\060\061\060\060\061",
'\000' <repeats 465 times>

(gdb) bt
#0  __strspn_c2 (cmd=<value optimized out>) at
/usr/include/bits/string2.h:1063
#1  blazer_status (cmd=<value optimized out>) at blazer.c:214
#2  0x0000000000403abb in upsdrv_updateinfo () at blazer.c:686
#3  0x0000000000406607 in main (argc=<value optimized out>, argv=<value
optimized out>) at main.c:625

199|         for (i = 0, val = strtok_r(buf+1, " ", &last);
status[i].var; i++, val = strtok_r(NULL, " \r\n", &last)) {
200|
201|                 if (!val) {
202|                         upsdebugx(2, "%s: parsing failed",
__func__);
203|                         return -1;
204|                 }
205|
206|                 if (strspn(val, "0123456789.") != strlen(val)) {
207|                         upsdebugx(2, "%s: non numerical value
[%s]", __func__, val);
208|                         continue;
209|                 }
210|
211|                 dstate_setinfo(status[i].var, status[i].fmt,
status[i].conv(val, NULL));
212|         }
213|
214+-------> if (strspn(val, "01") != 8) {
215|                 upsdebugx(2, "Invalid status [%s]", val);
216|                 return -1;
217|         }

except this rare segfauls the nut-2.4.3 package is great and works fine.
i can provide more debugging details if needed.

BR,
Pawel.

Citeren Pawel Sikora <pluto op agmk.net>:
> (gdb) up
> #1  blazer_status (cmd=<value optimized out>) at blazer.c:214
>
> (gdb) p val
> $1 = 0x0
Excellent, I missed checking for a NULL pointer somewhere in the code.  
Good catch!
> 199|         for (i = 0, val = strtok_r(buf+1, " ", &last);  
> status[i].var; i++, val = strtok_r(NULL, " \r\n", &last)) {
> 200|
> 201|                 if (!val) {
> 202|                         upsdebugx(2, "%s: parsing failed",
__func__);
> 203|                         return -1;
> 204|                 }
> 205|
> 206|                 if (strspn(val, "0123456789.") !=
strlen(val)) {
> 207|                         upsdebugx(2, "%s: non numerical value  
> [%s]", __func__, val);
> 208|                         continue;
> 209|                 }
> 210|
> 211|                 dstate_setinfo(status[i].var, status[i].fmt,  
> status[i].conv(val, NULL));
> 212|         }
                if (!val) {
                        upsdebugx(2, "%s: parsing failed", __func__);
                        return -1;
                }
> 213|
> 214+-------> if (strspn(val, "01") != 8) {
> 215|                 upsdebugx(2, "Invalid status [%s]", val);
> 216|                 return -1;
> 217|         }
>
> except this rare segfauls the nut-2.4.3 package is great and works fine.
> i can provide more debugging details if needed.
Most likely this won't be needed. It is pretty obvious from the trace  
what is happening. The last chunk of data from the UPS (with the  
status information) is lost and the strspn() function receives NULL  
pointer indicating there is no more data). Try out the above  
modification and let us know if this fixes the segfaults.

Best regards, Arjen
-- 
Please keep list traffic on the list (off-list replies will be rejected)

On Friday 05 November 2010 18:12:33 Arjen de Korte wrote:
> (...) Try out the above modification and let us know if this fixes the
segfaults.
with this patch blazer_usb works fine.

BR,
Pawel.