0x00007ffff3d3ecd0 in _ IO_ vfprintf_ internal (s=0x7ffff40b5620 ＜_IO_2_1_stdout_＞

Created by QQ：851301776, mailbox ：[email protected], Welcome to technical exchange , This blog is mainly my own learning experience , Just to make a little progress every day ！

Personal motto ：
1. No one was born , As long as it is thick, it will happen .
2. You can have a low degree , You can skip school , But you have to learn

One 、 Wrong show

Thread 3 "onvif" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff1c4e700 (LWP 8982)]
0x00007ffff3d3ecd0 in _IO_vfprintf_internal (s=0x7ffff40b5620 <_IO_2_1_stdout_>, format=<optimized out>, 
    [email protected]=0x7a073d "% %d %s xADDR:%s\n", [email protected]=0x7ffff1c4da18) at vfprintf.c:1632
1632	vfprintf.c:  There is no file or directory .

Look at the stack ：

(gdb) bt
#0  0x00007ffff3d3ecd0 in _IO_vfprintf_internal (s=0x7ffff40b5620 <_IO_2_1_stdout_>, format=<optimized out>, 
    [email protected]=0x7a073d "% %d %s xADDR:%s\n", [email protected]=0x7ffff1c4da18) at vfprintf.c:1632
#1  0x00007ffff3e06aef in ___printf_chk ([email protected]=1, [email protected]=0x7a073d "% %d %s xADDR:%s\n") at printf_chk.c:35
#2  0x000000000075c168 in printf (__fmt=0x7a073d "% %d %s xADDR:%s\n") at /usr/include/x86_64-linux-gnu/bits/stdio2.h:104
#3  NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:158
#4  0x0000000000453416 in p_onvif_server_udp (arg=0xc67e00) at pthread_onvif_server_udp.c:303
#5  0x00007ffff7bc16ba in start_thread (arg=0x7ffff1c4e700) at pthread_create.c:333
#6  0x00007ffff3df751d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

  Determine where the code went wrong ：

Two 、 solve

1. Add breakpoint in wrong function

(gdb) b NVR_camera_channel_num_que.c:158
Breakpoint 1 at 0x75c13d: file NVR_camera_channel_num_que.c, line 158.

2. Restart and step through

(gdb) r
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /mnt/hgfs/project/visual_gateway/software/src_intra_20220618/onvif 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[2022/06/21 15:02:29]: vivsual gateway is starting
[2022/06/21 15:02:29]: [2022/06/21 15:02:29]: para file already exist!
[2022/06/21 15:02:29]: parameter config file init succeed!~
[2022/06/21 15:02:29]: init complete!
[2022/06/21 15:02:29]: Redis_host_port:6379
[2022/06/21 15:02:29]: Redis_protocol_type:tcp
[2022/06/21 15:02:29]: Redis_protocol_type:127.0.0.1
[2022/06/21 15:02:29]: Redis_whether_use:YES
[2022/06/21 15:02:29]: Redis_channel_name:pubtoplat
[2022/06/21 15:02:29]: MySQL_host_port:3306
[2022/06/21 15:02:29]: MySQL_user_name:root
[2022/06/21 15:02:29]: MySQL_pass_word:1
[2022/06/21 15:02:29]: MySQL_host_ip:127.0.0.1
[2022/06/21 15:02:29]: MySQL_database:demo1
[2022/06/21 15:02:29]: MySQL_charset:utf8
[2022/06/21 15:02:29]: MySQL_protocol_type:tcp
[2022/06/21 15:02:29]: UDP_active:YES
[2022/06/21 15:02:29]: TCP_active:YES
[2022/06/21 15:02:29]: TCP_passivity:YES
[2022/06/21 15:02:29]: up_sip_id:34020000002000000001
[2022/06/21 15:02:29]: up_Realm:34020000002
[2022/06/21 15:02:29]: up_Password:123456789
[2022/06/21 15:02:29]: up_Username:admin
[2022/06/21 15:02:29]: up_Nonce:1622614946
[2022/06/21 15:02:29]: up_host:192.168.1.2
[2022/06/21 15:02:29]: up_port:6100
[2022/06/21 15:02:29]: UDP_AC_SIP_id:34020000002000000001
[2022/06/21 15:02:29]: UDP_AC_Realm:3402000000
[2022/06/21 15:02:29]: UDP_AC_Password:123456789
[2022/06/21 15:02:29]: UDP_AC_Username:root
[2022/06/21 15:02:29]: UDP_AC_Nonce:1622614945
[2022/06/21 15:02:29]: UDP_ListenHost_buff:eth0
[2022/06/21 15:02:29]: UDP_ListenPort:5800
[2022/06/21 15:02:29]: TCP_AC_SIP_id:34020000002000000004
[2022/06/21 15:02:29]: TCP_AC_Realm:3402000001
[2022/06/21 15:02:29]: TCP_AC_Password:123456789
[2022/06/21 15:02:29]: TCP_AC_Username:root
[2022/06/21 15:02:29]: TCP_AC_Nonce:1622614945
[2022/06/21 15:02:29]: TCP_ListenHost_buff:eth1
[2022/06/21 15:02:29]: TCP_ListenPort:5900
[2022/06/21 15:02:29]: TCP_PS_SIP_id:34020000002000000005
[2022/06/21 15:02:29]: TCP_PS_Realm:3402000002
[2022/06/21 15:02:29]: TCP_PS_Password:123456789
[2022/06/21 15:02:29]: TCP_PS_Username:root
[2022/06/21 15:02:29]: TCP_PS_Nonce:1622614945
[2022/06/21 15:02:29]: TCP_SerHost_buff:eth2
[2022/06/21 15:02:29]: TCP_SerPort:6000
[2022/06/21 15:02:29]: msg_conf_file:../msg/msg_file.txt
[2022/06/21 15:02:29]: SIP_connect_STA_file:../para/platform_para.txt
ptr->msg_qid:0
[New Thread 0x7ffff7fc0700 (LWP 9045)]
[2022/06/21 15:02:29]: Create Pthread (p_data_deal) ok 
[New Thread 0x7ffff1c4e700 (LWP 9046)]
[2022/06/21 15:02:29]: Create Pthread (p_onvif_server_udp) ok 
[2022/06/21 15:02:29]: p_data_deal stack size: 1052672
pthread_onvif_server_udp.c 269 p_onvif_server_udp suc
pthread_onvif_server_udp.c 278 p_onvif_server_udp recv 



================= + dump__wsdd__ProbeMatches + >>>
wsdd__ProbeMatches: (0x7fffe8047da0)
   |- __sizeProbeMatch: 1
   |- ProbeMatch: (0x7fffe8047da8)
      |- 0
         |- wsa__EndpointReference: (0x7fffe80466f0)
            |- Address: urn:uuid:055e81bd-1787-49f8-bb60-3cda6d9939da
            |- ReferenceProperties: (null)
            |- ReferenceParameters: (null)
            |- PortType: (null)
            |- ServiceName: (null)
            |- __size: 0
            |- __any: (null)
            |- __anyAttribute: 
         |- Types: tdn:NetworkVideoTransmitter tds:Device
         |- Scopes: (0x7fffe8047f80)
            |- __item:  onvif://www.onvif.org/type/video_encoder onvif://www.onvif.org/type/audio_encoder onvif://www.onvif.org/type/ptz onvif://www.onvif.org/Profile/Streaming onvif://www.onvif.org/hardware/hisi onvif://www.onvif.org/mfr/ipcamera onvif://www.onvif.org/location/country/china onvif://www.onvif.org/location/city/tianjin onvif://www.onvif.org/mac onvif://www.onvif.org/firmware/APP_V3.3.0.20200713 onvif://www.onvif.org/name/ipcamera
            |- MatchBy: (null)
         |- XAddrs: http://192.168.3.110:80/onvif/device_service 
         |- MetadataVersion: 1
================= - dump__wsdd__ProbeMatches - <<<
pthread_onvif_server_udp.c 283 p_onvif_server_udp suc
pthread_onvif_server_udp.c 301 p_onvif_server_udp count:1 
[Switching to Thread 0x7ffff1c4e700 (LWP 9046)]

Thread 3 "onvif" hit Breakpoint 1, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe80466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:160
160			if(SUC_RET == memcmp(tmp_node->nvr_XAddr, nvr_XAddr, MAX(strlen(tmp_node->nvr_XAddr), strlen(nvr_XAddr))) )

Step by step debugging ：

Thread 3 "onvif" hit Breakpoint 2, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:148
148		if((!p) || (!nvr_XAddr))
(gdb) n
147	{
(gdb) 
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
147	{
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
156		for(tmp_node = &(p->head.p_next);tmp_node != &(p->tail); tmp_node = tmp_node->p_next)
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n

Thread 3 "onvif" hit Breakpoint 1, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:160
160			if(SUC_RET == memcmp(tmp_node->nvr_XAddr, nvr_XAddr, MAX(strlen(tmp_node->nvr_XAddr), strlen(nvr_XAddr))) )
(gdb) n
158			printf("% %d %s xADDR:%s\n", __FILE__, __LINE__, __func__, nvr_XAddr);
(gdb) n

Thread 3 "onvif" received signal SIGSEGV, Segmentation fault.
0x00007ffff3d3ecd0 in _IO_vfprintf_internal (s=0x7ffff40b5620 <_IO_2_1_stdout_>, format=<optimized out>, 
    [email protected]=0x7a073d "% %d %s xADDR:%s\n", [email protected]=0x7ffff1c4da18) at vfprintf.c:1632
1632	vfprintf.c:  There is no file or directory .
(gdb) 

The problem basis is confirmed as ：

  Basic solution ： Mask the corresponding function

Continue debugging ：

Thread 3 "onvif" hit Breakpoint 2, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:148
148		if((!p) || (!nvr_XAddr))
(gdb) n
147	{
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
147	{
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
156		for(tmp_node = &(p->head.p_next);tmp_node != &(p->tail); tmp_node = tmp_node->p_next)
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n

Thread 3 "onvif" hit Breakpoint 1, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:160
160			if(SUC_RET == memcmp(tmp_node->nvr_XAddr, nvr_XAddr, MAX(strlen(tmp_node->nvr_XAddr), strlen(nvr_XAddr))) )
(gdb) n
164			printf("%s %d %s \n", __FILE__, __LINE__, __func__ );
(gdb) n
NVR_camera_channel_num_que.c 164 NVR_camera_channel_num_que_node_exists_XAddr 
156		for(tmp_node = &(p->head.p_next);tmp_node != &(p->tail); tmp_node = tmp_node->p_next)
(gdb) n

Thread 3 "onvif" hit Breakpoint 1, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:160
160			if(SUC_RET == memcmp(tmp_node->nvr_XAddr, nvr_XAddr, MAX(strlen(tmp_node->nvr_XAddr), strlen(nvr_XAddr))) )
(gdb) n

Thread 3 "onvif" received signal SIGSEGV, Segmentation fault.
strlen () at ../sysdeps/x86_64/strlen.S:106
106	../sysdeps/x86_64/strlen.S:  There is no file or directory .
(gdb) bt 
#0  strlen () at ../sysdeps/x86_64/strlen.S:106
#1  0x000000000075c14c in NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:160
#2  0x0000000000453416 in p_onvif_server_udp (arg=0xc67e00) at pthread_onvif_server_udp.c:303
#3  0x00007ffff7bc16ba in start_thread (arg=0x7ffff1c4e700) at pthread_create.c:333
#4  0x00007ffff3df751d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109

The problem here is to call strlen Segment error caused by function , At this time, it is necessary to analyze ：

memcmp(tmp_node->nvr_XAddr, nvr_XAddr, MAX(strlen(tmp_node->nvr_XAddr), strlen(nvr_XAddr))) )

In fact, those who often debug know , In fact, this kind of problem is the error of code logic , Access that has allocated memory but has not written data

Add in code ：

Thread 3 "onvif" hit Breakpoint 1, NVR_camera_channel_num_que_node_exists_XAddr ([email protected]=0xc67eb8, 
    nvr_XAddr=0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service ") at NVR_camera_channel_num_que.c:148
148		if((!p) || (!nvr_XAddr))
(gdb) n
147	{
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
147	{
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
156		for(tmp_node = &(p->head.p_next);tmp_node != &(p->tail); tmp_node = tmp_node->p_next)
(gdb) n
153		if(p->head.p_next == &(p->tail)) return 1;
(gdb) n
158			printf("tmp_node->nvr_XAddr:%p \n", tmp_node->nvr_XAddr);
(gdb) print  tmp_node->nvr_XAddr
$1 = '\000' <repeats 16 times>, "pubtoplat", '\000' <repeats 55 times>, "\353\030\000\000\000\000\000\000\321\000\000\000\000\000\000\000YES\000\377\177\000\000xK\v\364\377\177", '\000' <repeats 17 times>
(gdb) n
tmp_node->nvr_XAddr:0xc682c0 
159			printf("nvr_XAddr:%p\n", nvr_XAddr);
(gdb) print Quit
(gdb) print nvr_XAddr
$2 = 0x7fffe00466a0 "http://192.168.3.110:80/onvif/device_service "

  explain ： tmp_node->nvr_XAddr Corresponding empty address , At this time, you need to check the source code

This problem is the error of code logic .

Finally, find out that the simple linked list is not initialized , Cause the address to be empty , Error caused by circular judgment .

After modifying the code , The previous wave of debugging is as follows ：

  It's solved .

3、 ... and 、 emphasis

（1）printf The underlying function calls malloc function , If the program gets stuck in an endless loop , It's going to keep calling malloc

（2）gdb debugging , In fact, this kind of debugging is mainly ： The breakpoint 、 Single step 、 Print （print）