[Opendnssec-user] 1.5.0a2 crasher in ldns_rr_list_push_rr

[Paul Wouters]

This is the crasher I've been trying to get trace of:

(gdb) bt
#0  0x0000003988232885 in raise () from /lib64/libc.so.6
#1  0x0000003988234065 in abort () from /lib64/libc.so.6
#2  0x000000398826f977 in __libc_message () from /lib64/libc.so.6
#3  0x0000003988275296 in malloc_printerr () from /lib64/libc.so.6
#4  0x000000398827a900 in _int_realloc () from /lib64/libc.so.6
#5  0x000000398827aaf5 in realloc () from /lib64/libc.so.6
#6  0x0000003b2bc33512 in ldns_rr_list_push_rr (rr_list=0x97b0f0,
     rr=0xc06ef120) at ./rr.c:1077
#7  0x000000000041bc31 in ixfr_del_rr ()
#8  0x000000000041f6b4 in rrset_sign ()
#9  0x0000000000411621 in worker_start ()
#10 0x000000000040d301 in worker_thread_start ()
#11 0x00000039886077f1 in start_thread () from /lib64/libpthread.so.0
#12 0x00000039882e5ccd in clone () from /lib64/libc.so.6

#6  0x0000003b2bc33512 in ldns_rr_list_push_rr (rr_list=0x97b0f0,
     rr=0xc06ef120) at ./rr.c:1077
         rrs = <value optimized out>
         rr_count = 32768
         cap = 65536

for reference:

(gdb) list
1072			ldns_rr **rrs;
1073 
1074			if(cap == 0)
1075				cap = LDNS_RRLIST_INIT;  /* initial list
size */
1076			else	cap *= 2;
1077			rrs = LDNS_XREALLOC(rr_list->_rrs, ldns_rr *,
cap);
1078			if (!rrs) {
1079				return false;
1080			}
1081			rr_list->_rrs = rrs;

This is with ldns 1.6.13. With 1.6.12 it also crashed.

Paul