Segmentation Fault on Ubuntu 14.10 / gcc 4.9.1 #395

jblackaby · 2015-01-09T17:59:43Z

Hi,

I have been using websocketpp successfully on several Mac OS and Linux systems (great library by the way). I recently moved to Ubuntu 14.10 with gcc 4.9.1 and I am now having an issue. It seems that if the client (web browser, Chrome or Firefox) sends a message that is 32 bytes or longer to the server (C++ app, websocket++), it crashes the server with a segfault. This only happens when using the -O3 compiler flag, otherwise it works correctly.

I have come up with a minimal test which reproduces it:

websockettest.cpp:

#include <iostream>
#include <websocketpp/config/asio_no_tls.hpp>
#include <websocketpp/server.hpp>

using namespace std;

websocketpp::server<websocketpp::config::asio> server;

void on_open(websocketpp::connection_hdl hdl)
{
    cout << "connected." << endl;
}

void on_close(websocketpp::connection_hdl hdl)
{
    cout << "disconnected." << endl;
}

void on_message(websocketpp::connection_hdl hdl,
                             websocketpp::server<websocketpp::config::asio>::message_ptr msg)
{
    if(msg->get_opcode() == websocketpp::frame::opcode::text) {
        cout << "received message: " << endl <<  msg->get_payload() << endl;
    }   
}

int main()
{
    int port = 9002;
    server.set_access_channels(websocketpp::log::alevel::all);
    server.set_reuse_addr(true);
    server.init_asio();
    server.set_message_handler(bind(&on_message, websocketpp::lib::placeholders::_1, websocketpp::lib::placeholders::_2));
    server.set_open_handler(bind(&on_open, websocketpp::lib::placeholders::_1));
    server.set_close_handler(bind(&on_close, websocketpp::lib::placeholders::_1));
    cout << "starting server on port: " << port << endl;
    server.listen(port);
    server.start_accept();
    server.run();
    return 0;
}

websockettest.html:

<!DOCTYPE html>
<html>
    <meta charset="utf-8" />
    <head>
    <script language="javascript" type="text/javascript">
        var ws_uri = "ws://localhost:9002";
        var socket;
        function init() 
        {
            socket = new WebSocket(ws_uri);
            socket.onopen = on_open;
            socket.onclose = on_close;
            socket.onmessage = on_message;
        }

        function on_open(evt)
        {
            console.log('CONNECTED');
            socket.send('0123456789012345678901234567890');
            socket.send('01234567890123456789012345678901');
        }
        function on_close(evt) { console.log('DISCONNECTED'); }
        function on_message(evt) { console.log('got message'); }

        window.onload = init;
    </script>
</html>

On every other system and when not using the -O3 compiler flag, this works and the server prints:

connected.
received message: 
0123456789012345678901234567890
received message:
01234567890123456789012345678901

On Ubuntu 14.10/GCC 4.9.1 I get:

connected.
received message: 
0123456789012345678901234567890
Segmentation fault (core dumped)

The segfault occurs before the on_message handler is fired. I could not debug it effectively with gdb since the problem only occurs with the -O3 flag, but by just using printfs, I was able to narrow it down to the word_mask_circ() function in frame.hpp. It seemed like all of the arguments were valid so I can not figure out what the problem is. I have tried 0.4.0 and the development branch.

The text was updated successfully, but these errors were encountered:

zaphoyd · 2015-01-10T02:08:59Z

can you try defining WEBSOCKETPP_STRICT_MASKING in the preprocessor and let me know if that fixes it?

jblackaby · 2015-01-10T04:28:52Z

Yes, that seems to have fixed it.

zaphoyd · 2015-01-10T10:34:50Z

By default WebSocket++ uses a masking system that bends the normal aliasing rules a bit for a sizable speed boost. Certain more exotic CPUs and very aggressive optimization flags are confused by this. That define forces strict masking that is slower but fully standard.

kallaballa · 2015-03-21T19:57:02Z

i encountered the exact same problem with debian 7 on armv7l (BananaPi) with g++-4.9.2-10.

Calthron · 2015-10-08T17:07:56Z

Can a static_assert or some other method be used in code to catch this during development?

TyRoXx · 2015-10-09T18:35:02Z

Websocket++ does not "bend" the rules. It violates them which leads to undefined behavior in this function:

inline void word_mask_exact(uint8_t* input, uint8_t* output, size_t length,
    const masking_key_type& key)
{
    size_t prepared_key = prepare_masking_key(key);
    size_t n = length/sizeof(size_t);
    size_t* input_word = reinterpret_cast<size_t*>(input);
    size_t* output_word = reinterpret_cast<size_t*>(output);

    for (size_t i = 0; i < n; i++) {
        output_word[i] = input_word[i] ^ prepared_key; // this line
    }

    for (size_t i = n*sizeof(size_t); i < length; i++) {
        output[i] = input[i] ^ key.c[i%4];
    }
}

The compiler may assume that any pointer to a size_t is properly aligned for a size_t. This is probably not the case for either the input or the output pointer.

ARM is not exotic and "aggressive" optimization flags are the norm. It is not the compiler who is confused by this issue.

zaphoyd · 2015-10-13T12:50:33Z

Looking in more detail at the exact rules for portability with respect to aliasing I agree with @TyRoXx. This sort of optimization can only be done safely with platform specific SIMD systems. I will be changing the default masking code to use the slower but well defined byte based masking.

LocutusOfBorg · 2016-01-28T15:27:30Z

thanks for fixing it! Please make a new release with the fix :)
(also because I would like to upload the new version in Debian, where 0.6.0 is the last release)

…ixes zaphoyd#395

zaphoyd · 2016-02-22T13:31:53Z

This fix has been committed and released in 0.7.0

kallaballa mentioned this issue Mar 21, 2015

Bus error on 20 characters or more. kallaballa/Janosh#14

Closed

tkarls mentioned this issue Oct 8, 2015

Segmentation Fault #469

Closed

theoreticalbts mentioned this issue Oct 9, 2015

Build websocketpp with WEBSOCKETPP_STRICT_MASKING cryptonomex/graphene#365

Closed

zaphoyd added Bug Core labels Oct 30, 2015

mkm85 pushed a commit to mkm85/websocketpp that referenced this issue Feb 14, 2016

Removes non-standards compliant masking behavior. fixes zaphoyd#469, f…

cbe87ff

…ixes zaphoyd#395

zaphoyd closed this as completed in 4e2fb75 Feb 22, 2016

gtritchie mentioned this issue Aug 28, 2017

Fix rsession websocket crashes rstudio/rstudio#1482

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Segmentation Fault on Ubuntu 14.10 / gcc 4.9.1 #395

Segmentation Fault on Ubuntu 14.10 / gcc 4.9.1 #395

jblackaby commented Jan 9, 2015

zaphoyd commented Jan 10, 2015

jblackaby commented Jan 10, 2015

zaphoyd commented Jan 10, 2015

kallaballa commented Mar 21, 2015

Calthron commented Oct 8, 2015

TyRoXx commented Oct 9, 2015

zaphoyd commented Oct 13, 2015

LocutusOfBorg commented Jan 28, 2016

zaphoyd commented Feb 22, 2016

Segmentation Fault on Ubuntu 14.10 / gcc 4.9.1 #395

Segmentation Fault on Ubuntu 14.10 / gcc 4.9.1 #395

Comments

jblackaby commented Jan 9, 2015

zaphoyd commented Jan 10, 2015

jblackaby commented Jan 10, 2015

zaphoyd commented Jan 10, 2015

kallaballa commented Mar 21, 2015

Calthron commented Oct 8, 2015

TyRoXx commented Oct 9, 2015

zaphoyd commented Oct 13, 2015

LocutusOfBorg commented Jan 28, 2016

zaphoyd commented Feb 22, 2016