[gentoo-user] realloc() failure in motion

[gentoo-user] realloc() failure in motion

[William Kenworthy]

Hi, I am setting up some  cameras (esp32cam) and intended to use motion 
for them but it crashes on startup with a realloc() error. The system is 
an up to date arm64 (odroid N2+), mostly stable. Has anyone seen this 
before?

BillK


ha /etc/motion # /usr/bin/motion -c /etc/motion/motion.conf -k 9 -d 9
[0:motion] [NTC] [ALL] conf_load: Processing thread 0 - config file 
/etc/motion/motion.conf
[0:motion] [NTC] [ALL] config_camera: Processing camera config file 
/etc/motion/camera0.conf
[0:motion] [NTC] [ALL] read_camera_dir: Processing config file 
/etc/motion/motion.conf
[0:motion] [NTC] [ALL] config_camera: Processing camera config file 
/etc/motion/motion.conf
realloc(): invalid old size
Aborted

[gentoo-user] Re: realloc() failure in motion

[Nuno Silva]

On 2022-09-18, William Kenworthy wrote:

> Hi, I am setting up some  cameras (esp32cam) and intended to use
> motion for them but it crashes on startup with a realloc() error. The
> system is an up to date arm64 (odroid N2+), mostly stable. Has anyone
> seen this before?
>
> BillK
>
>
> ha /etc/motion # /usr/bin/motion -c /etc/motion/motion.conf -k 9 -d 9
> [0:motion] [NTC] [ALL] conf_load: Processing thread 0 - config file
> /etc/motion/motion.conf
> [0:motion] [NTC] [ALL] config_camera: Processing camera config file
> /etc/motion/camera0.conf
> [0:motion] [NTC] [ALL] read_camera_dir: Processing config file
> /etc/motion/motion.conf
> [0:motion] [NTC] [ALL] config_camera: Processing camera config file
> /etc/motion/motion.conf
> realloc(): invalid old size
> Aborted

Could you try to get a stack trace from that?


I've never used "motion" and I don't know its source code, but [1] makes
me wonder if the failure could be happening in [2].

OTOH, from the output, "motion" has entered config_camera() and gone
beyond [2] a second time before the realloc() abort - but could these
two calls have received the same cnt?

From my very little understanding of the code and from your output, it
looks like "motion" might be processing motion.conf twice (the
"Processing thread 0 [...]" line precedes a call to conf_process(), as
does "Processing camera config file"). Is this intended?

[1] https://github.com/Motion-Project/motion/blob/HEAD/src/conf.c#L3204
[2] https://github.com/Motion-Project/motion/blob/HEAD/src/conf.c#L3180

(Links are to HEAD, as that's what I started reading.)

-- 
Nuno Silva

Re: [gentoo-user] Re: realloc() failure in motion

[William Kenworthy]

On 21/9/22 00:40, Nuno Silva wrote:
> On 2022-09-18, William Kenworthy wrote:
>
>> Hi, I am setting up some  cameras (esp32cam) and intended to use
>> motion for them but it crashes on startup with a realloc() error. The
>> system is an up to date arm64 (odroid N2+), mostly stable. Has anyone
>> seen this before?
>>
>> BillK
>>
>>
>> ha /etc/motion # /usr/bin/motion -c /etc/motion/motion.conf -k 9 -d 9
>> [0:motion] [NTC] [ALL] conf_load: Processing thread 0 - config file
>> /etc/motion/motion.conf
>> [0:motion] [NTC] [ALL] config_camera: Processing camera config file
>> /etc/motion/camera0.conf
>> [0:motion] [NTC] [ALL] read_camera_dir: Processing config file
>> /etc/motion/motion.conf
>> [0:motion] [NTC] [ALL] config_camera: Processing camera config file
>> /etc/motion/motion.conf
>> realloc(): invalid old size
>> Aborted
> Could you try to get a stack trace from that?
>
>
> I've never used "motion" and I don't know its source code, but [1] makes
> me wonder if the failure could be happening in [2].
>
> OTOH, from the output, "motion" has entered config_camera() and gone
> beyond [2] a second time before the realloc() abort - but could these
> two calls have received the same cnt?
>
>  From my very little understanding of the code and from your output, it
> looks like "motion" might be processing motion.conf twice (the
> "Processing thread 0 [...]" line precedes a call to conf_process(), as
> does "Processing camera config file"). Is this intended?
>
> [1] https://github.com/Motion-Project/motion/blob/HEAD/src/conf.c#L3204
> [2] https://github.com/Motion-Project/motion/blob/HEAD/src/conf.c#L3180
>
> (Links are to HEAD, as that's what I started reading.)
>
Yep, that was the problem - it was when looking the output from strace 
thst it hit me.  Its self caused in that I had a camera description file 
and also set a config variable to read the directory that the files are 
stored in.  From google hits on reallocate failures like this, its 
likely a lack of protection in the code for reading the config files 
multiple times at the root of the problem.  The documentation could be 
clearer about this, but thats on me.

BillK