rsync - Jul 2002 - Rsync: Segmentation fault

Rsync 2.5.5; transfer via ssh; sparc-sun-solaris2.5 (Ultra 1); gcc 2.8.1.
Every time rsync on this box causes boundary violation. I attached two
strange examples. I have a few rsync's corefiles (100MB and above) and I
can examine them. I will be grateful for any help.
-Mirek

<------------------------------------------------------------------------->
received 966761 names
done
recv_file_list done
[...]
rsync: connection unexpectedly closed (21807465 bytes read so far)
rsync error: error in rsync protocol data stream (code 12) at io.c(150)
_exit_cleanup(code=12, file=io.c, line=150): about to call exit(12)


Core was generated by `/rsync/bin/rsync --server --sender -vvvlHogDtprRS
--partial --numeric-ids . /'.
Program terminated with signal 11, Segmentation fault.
[...]
(gdb) bt
#0  0x2d898 in dopr (buffer=0xef7ffcb8 <Address 0xef7ffcb8 out of bounds>,
    maxlen=1024, format=0x3c6d8 "rsync error: %s (code %d) at
%s(%d)\n",
    args=0xef800114) at lib/snprintf.c:155
Cannot access memory at address 0xef7ffad4.
(gdb) p currlen
Cannot access memory at address 0xef7ffb04.
<------------------------------------------------------------------------->


<------------------------------------------------------------------------->
io timeout after 120 seconds - exiting
rsync error: timeout in data send/receive (code 30) at io.c(85)
_exit_cleanup(code=30, file=io.c, line=85): about to call exit(30)


Core was generated by `/rsync/bin/rsync --server --sender -vvvlHogDtprRS
--timeout=120 --partial --num'.
Program terminated with signal 11, Segmentation fault.
[...]
(gdb) bt
#0  0x2d898 in dopr (buffer=0xef800118 "", maxlen=1024,
    format=0x3c6d8 "rsync error: %s (code %d) at %s(%d)\n",
args=0xef800574)
    at lib/snprintf.c:155
Cannot access memory at address 0xef7fff34.
(gdb) p currlen
Cannot access memory at address 0xef7fff64.
<------------------------------------------------------------------------->

On Tue, 2 Jul 2002, Miroslaw Luc wrote:
> Rsync 2.5.5; transfer via ssh; sparc-sun-solaris2.5 (Ultra 1); gcc 2.8.1.
                                 ^^^^^^^^^^^^^^^^^^^^
More info.
Not only on this platform: sparc-sun-solaris2.8 and sparc-sun-sunos4.1.3
too; rsync compiled with gcc 2.95.3 and 2.7.2.3 respectively. On error
rsync tries to send some debug messages and this causes rsync to dump
core. And now I can make rsync's corefiles on demand.:) For example,
--timeout=1.
Please see appended stack trace from the pstack command from Solaris 8:
rprintf()->rwrite()->_exit_cleanup()->log_exit()->rprintf() and so
on
many, many times (ca 21000 times in this case). Loop...? What now?

-Mirek
PS: The gdb's output below doesn't tell me anything new.
<------------------------------------------------------------------------->
This GDB was configured as "sparc-sun-solaris2.8"...
Core was generated by `/rsync/bin/rsync --server --sender -logDtprRS
--timeout=1 --partial --numeric-i'.
[...]
(gdb) bt
#0  0x3f2b0 in dopr_outch (buffer=0xff3f0240 "", currlen=0xff3f0124,
    maxlen=1024, c=Cannot access memory at address 0xff3effd7
) at lib/snprintf.c:744
Cannot access memory at address 0xff3effac
(gdb)
<------------------------------------------------------------------------->
core '../core' of 18066:        /rsync/bin/rsync --server --sender
-logDtprRS --timeout=1 --partial --

 000154ec _start   (0, 0, 0, 0, 0, 0) + 5c
 00021678 main     (9, ffbefd14, ffbefd3c, 73cd8, 0, 0) + 2b0
 0002079c start_server (0, 1, 2, 74620, 0, 74079) + cc
 00020034 do_server_sender (0, 1, 2, 74620, 1, 1c0f4) + 264
 0001aa2c send_files (74798, 1, 0, 1, 0, 0) + 9d8
 00023588 match_sums (1, 75130, a0f00, 0, 3a3d6d6, ffbef688) + 260
 00022518 matched  (1, 75130, a0f00, 0, 428000, fffffffe) + 174
 00030c2c send_token (1, fffffffe, a0f00, 0, 420000, 8000) + 4c
 0002f848 simple_send_token (1, fffffffe, a0f00, 0, 420000, 8000) + c4
 0002e1b8 write_buf (1, 115d80, 8000, 8000, 0, 420000) + 1c
 0002df98 writefd  (1, 115d80, 8000, 3f0000, 0, 40000) + 178
 0002dd8c io_flush (73a3c, ffc, ffc, 0, 6d, 754b0) + 94
 0002dc8c mplex_write (1, 0, 754b0, ffc, 0, 0) + 138
 0002d79c writefd_unbuffered (1, ffbe6210, 1000, 0, 6d, ffbe6214) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbe6110, ffbe5fe8) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbe5a90, 40, ffbe5ef4, ffbe5f08, 11) + 134
 0002e4bc io_multiplex_write (1, ffbe5a90, 40, ffbe5ef4, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbe5a90, 40, 0, a1f2a9) + 138
 0002d79c writefd_unbuffered (1, ffbe4928, 44, 4, a, ffbe492c) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbe4828, ffbe4700) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbe41a8, 40, ffbe460c, ffbe4620, 11) + 134
 0002e4bc io_multiplex_write (1, ffbe41a8, 40, ffbe460c, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbe41a8, 40, 0, a1f2ed) + 138
 0002d79c writefd_unbuffered (1, ffbe3040, 44, 4, a, ffbe3044) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbe2f40, ffbe2e18) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbe28c0, 40, ffbe2d24, ffbe2d38, 11) + 134
 0002e4bc io_multiplex_write (1, ffbe28c0, 40, ffbe2d24, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbe28c0, 40, 0, a1f331) + 138
 0002d79c writefd_unbuffered (1, ffbe1758, 44, 4, a, ffbe175c) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbe1658, ffbe1530) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbe0fd8, 40, ffbe143c, ffbe1450, 11) + 134
 0002e4bc io_multiplex_write (1, ffbe0fd8, 40, ffbe143c, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbe0fd8, 40, 0, a1f375) + 138
 0002d79c writefd_unbuffered (1, ffbdfe70, 44, 4, a, ffbdfe74) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbdfd70, ffbdfc48) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbdf6f0, 40, ffbdfb54, ffbdfb68, 11) + 134
 0002e4bc io_multiplex_write (1, ffbdf6f0, 40, ffbdfb54, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbdf6f0, 40, 0, a1f3b9) + 138
 0002d79c writefd_unbuffered (1, ffbde588, 44, 4, a, ffbde58c) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbde488, ffbde360) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbdde08, 40, ffbde26c, ffbde280, 11) + 134
 0002e4bc io_multiplex_write (1, ffbdde08, 40, ffbde26c, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbdde08, 40, 0, a1f3fd) + 138
 0002d79c writefd_unbuffered (1, ffbdcca0, 44, 4, a, ffbdcca4) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbdcba0, ffbdca78) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbdc520, 40, ffbdc984, ffbdc998, 11) + 134
 0002e4bc io_multiplex_write (1, ffbdc520, 40, ffbdc984, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbdc520, 40, 0, a1f441) + 138
 0002d79c writefd_unbuffered (1, ffbdb3b8, 44, 4, a, ffbdb3bc) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbdb2b8, ffbdb190) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbdac38, 40, ffbdb09c, ffbdb0b0, 11) + 134
 0002e4bc io_multiplex_write (1, ffbdac38, 40, ffbdb09c, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbdac38, 40, 0, a1f485) + 138
 0002d79c writefd_unbuffered (1, ffbd9ad0, 44, 4, a, ffbd9ad4) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbd99d0, ffbd98a8) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbd9350, 40, ffbd97b4, ffbd97c8, 11) + 134
 0002e4bc io_multiplex_write (1, ffbd9350, 40, ffbd97b4, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbd9350, 40, 0, a1f4c9) + 138
 0002d79c writefd_unbuffered (1, ffbd81e8, 44, 4, a, ffbd81ec) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbd80e8, ffbd7fc0) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbd7a68, 40, ffbd7ecc, ffbd7ee0, 11) + 134
 0002e4bc io_multiplex_write (1, ffbd7a68, 40, ffbd7ecc, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbd7a68, 40, 0, a1f50d) + 138
 0002d79c writefd_unbuffered (1, ffbd6900, 44, 4, a, ffbd6904) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbd6800, ffbd66d8) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbd6180, 40, ffbd65e4, ffbd65f8, 11) + 134
 0002e4bc io_multiplex_write (1, ffbd6180, 40, ffbd65e4, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbd6180, 40, 0, a1f551) + 138
 0002d79c writefd_unbuffered (1, ffbd5018, 44, 4, a, ffbd501c) + 1f4
 0002c93c check_timeout (0, 0, 0, 0, ffbd4f18, ffbd4df0) + 138
 00019b50 _exit_cleanup (1e, 5a338, 55, 0, 3e8, 0) + 338
 000257c0 log_exit (1e, 5a338, 55, 0, 0, 0) + 100
 00024cc0 rprintf  (1, 57e38, 57b50, 1e, 5a338, 55) + 134
 00024974 rwrite   (1, ffbd4898, 40, ffbd4cfc, ffbd4d10, 11) + 134
 0002e4bc io_multiplex_write (1, ffbd4898, 40, ffbd4cfc, 0, 0) + 84
 0002dc8c mplex_write (1, 1, ffbd4898, 40, 0, a1f595) + 138
 0002d980 writefd_unbuffered (1, ffbd3730, 44, 4, a, ffbd3734) + 3d8

	[... the loop below repeates ca 21000 times ...]
-> 00024cc0 rprintf  (1, 5a3e0, 44, ff1a34a1, ff1a34a1, ff19c764) + 134 
<-
-> 00024b20 rwrite   (1, ffbd3120, 40, ffbd3584, 236a8, ff17a8a8) + 2e0 
<-
-> 00019b50 _exit_cleanup (d, 57d38, 117, 73f10, 40, ffbd3120) + 338    
<-
-> 000257c0 log_exit (d, 57d38, 117, 73f10, ffbd3120, 40) + 100         
<-
-> 00024cc0 rprintf  (1, 57e38, 57c10, d, 57d38, 117) + 134             
<-

 00024cc0 rprintf  (1, 57e38, 57c10, d, 57d38, 117) + 134
 00024b20 rwrite   (1, ff3f0838, 45, ff3f0c9c, ff3f0cb0, 11) + 2e0
 00019b50 _exit_cleanup (d, 57d38, 117, 73f10, 45, ff3f0838) + 338
 000257c0 log_exit (d, 57d38, 117, 73f10, ff3f0838, 45) + 100
 00024bc8 rprintf  (1, 57e38, 57c10, d, 57d38, 117) + 3c
 0003f328 vsnprintf (ff3f0240, 400, 57e38, ff3f06a4, ff3f06b8, 11) + 24
 0003cce8 dopr     (ff3f0240, 400, 57e38, ff3f06a4, 0, 0) + f0
 0003f2b0 dopr_outch (ff3f0240, ff3f0124, 400, 72, 0, 0) + 14
<------------------------------------------------------------------------->