mirror of
https://github.com/jmcnamara/libxlsxwriter.git
synced 2026-05-15 14:15:54 -06:00
[GH-ISSUE #49] Crash in lxw_worksheet_assemble_xml_file #42
Labels
No labels
awaiting user feedback
bug
cmake
cmake
docs
feature request
in progress
long term
medium term
medium term
pull-request
question
question
ready to close
short term
under investigation
wontfix
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference: github-starred/libxlsxwriter#42
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @evanmiller on GitHub (May 29, 2016).
Original GitHub issue: https://github.com/jmcnamara/libxlsxwriter/issues/49
Originally assigned to: @jmcnamara on GitHub.
Hi, I am using libxlsxwriter 0.3.2 in a Mac program. I recently received a customer crash report that appears to originate inside libxlsxwriter. Here are the relevant bits:
It looks like there is a NULL pointer being dereferenced as part of a struct. I am not sure if it matters but the code is running on a background thread. I received the crash report automatically via Apple so I'm afraid I can't provide more details about the crash conditions.
@jmcnamara commented on GitHub (May 29, 2016):
Hi Evan,
I haven't had any other reports of this nature. Also, and I'm sure you know this, there isn't enough information there to debug it.
The library isn't thread safe. Are you writing to a worksheet using multiple threads by any chance?
At a guess it looks like the worksheet is trying to write to a filehandle that has already been closed.
John
@evanmiller commented on GitHub (May 29, 2016):
All the activity is on the same thread.
This may or may not be related, but I have also received reports that
LXW_ERROR_WORKBOOK_FILE_CREATEis being returned for some users -- I wonder if there is some issue with sandboxing and perhaps writing to temporary files.As for writing to a closed file handle -- is it possible to return an error rather than crash if that's what's happening here?
I realize this report isn't actionable in its current state, but it would be worth knowing if other users have experienced the same thing.
@jmcnamara commented on GitHub (May 29, 2016):
Interesting.
LXW_ERROR_WORKBOOK_FILE_CREATEonly occurs in one place in workbook.c:As you can see from the comment this error usually occurs when the lib (or in this case zlib) fails to create the overall zip container. This could be due to
Also, there should be an error on stderr in that case. You can test that yourself. This would return an error like:
Of course, your app is probably GUI based so this may not go anywhere useful.
However, the log in the original message says that error occurs in
lxw_worksheet_assemble_xml_file()which may indicate a tmpfile issue. Is it possible that the user has created a large number of worksheet (>2560) and exceed the system ulimit for open filehandles? It could also just be a permission issue.In packager.c there is the following code:
In particular this:
There is no check here that
lxw_tmpfile()succeeded which is a bug (at the very least).@evanmiller commented on GitHub (May 29, 2016):
I am guessing it is some kind of permissions issue, rather than exceeding the file handle limit. (Given the application design it is implausible a user will have thousands of worksheets exported.) I am able to reproduce the
LXW_ERROR_WORKBOOK_FILE_CREATEwhen I try exporting to an unwritable directory, for instance. (In the stderr log I do see the "Permission denied" message.)I haven't been able to reproduce the crash though, and so its cause remains a mystery to me -- I suppose I might have a "double close" somewhere in the application code but nothing jumps out. In any event, I endorse adding more checks to mitigate possible crash paths.
@jmcnamara commented on GitHub (May 29, 2016):
I think the tempfile is the issue.
Try the following to reproduce it with this patch:
Then make the target tmp dir unwritable and you will get a segfault:
@jmcnamara commented on GitHub (May 29, 2016):
And the backtrace looks similar:
@evanmiller commented on GitHub (May 29, 2016):
Yep, that looks just like the original crash report (modulo some function inlining).
Any chance of providing an error path whenever
lxw_tmpfileis called?@jmcnamara commented on GitHub (May 29, 2016):
Yes. I'm working on it. I'll push something today or tomorrow.
@evanmiller commented on GitHub (May 29, 2016):
Thanks!
@jmcnamara commented on GitHub (May 29, 2016):
I pushed a change to master that should prevent the segfault and give a proper error message.
There are still a few potential error conditions in the Zip code that I need to handle but these are a bit more esoteric. I'll ping you back in the next couple of days when I'm confident that all the error vectors are handled properly.
In the meantime you can try the code on the master branch.
@evanmiller commented on GitHub (May 30, 2016):
Thanks, will try it out.
Incidentally is there an lxw version of
strerror? Right now I have to update my code to produce human-readable messages for new error codes likeLXW_ERROR_WORKBOOK_TMPFILE-- I don't want to miss any codes introduced in future releases. Happy to open a new issue if not.@jmcnamara commented on GitHub (May 30, 2016):
That's a good suggestion. I'll look into adding it.
@jmcnamara commented on GitHub (May 30, 2016):
I've pushed a fix for this and other potential file failure issues.
However, for consistency I've renamed some of the error codes. Hopefully that won't require too much work on your part to change your error handling and the additional effort will be worth it.
I've also added a
lxw_strerrorfunction, see theexample/anotomy.cprogram and the updated docs:@evanmiller commented on GitHub (May 31, 2016):
Looks good to me, thanks! This issue is resolved as far as I'm concerned. Closing.
@jmcnamara commented on GitHub (May 31, 2016):
Packaged and release as version 0.3.5.
Thanks for the report.