Ubuntu
sane-backends package

scanimage assert failure: * Error in `scanimage': double free or corruption (top): 0x0000000002598130 *

Bug #1208091 reported by pqwoerituytrueiwoq on 2013-08-04

This bug affects 7 people

Affects		Status	Importance	Assigned to
	sane-backends (Debian)	Fix Released	Unknown	debbugs #854705
	sane-backends (Ubuntu)	Incomplete	Medium	Unassigned
Nominated for Xenial by Rolf Leggewie
Nominated for Zesty by Rolf Leggewie

Bug Description

Similar errors occur when the normal user runs this command
Accessing sacnner using network, setup notes are here
http://ubuntuforums.org/showthread.php?t=1519201
My other virtualbox client has no issue here
the server is running xubuntu 13.04
This output is from the saucy client

www-data@127.0.0.1:/home/www-data/"INUSE":0," www-data@127.0.0.1:/home/www-data/ /lib/x86_64-linux-gnu/libc.so.6(+0x80996)64-linux-gnu/libc.so.6(fclose+64-linux-gnu/libnss_64-linux-gnu/libc.so.6(getservbyn64-linux-gnu/libc.so.6(+0xcb72b)64-linux-gnu/libc.so.6(+0xcba93)64-linux-gnu/libc.so.6(getaddrinfx86_64-linux-gnu/sane/libsane-x86_64-linux-gnu/sane/libsane-x86_64-linux-gnu/libsane.x86_64-linux-gnu/libsane. /lib/x86_64-linux-gnu/libc.so.6(__ ======= Memory map: ========
00400000-0040a000 r-xp 00000000 08:01 1355 0060a000-0060b000 r--p 0000a000 08:01 1355 0060b000-0060c000 rw-p 0000b000 08:01 1355 0258d000-025ae000 rw-p 00000000 00:00 0 7f4373bdd000-7f4373bf2000 r-xp 00000000 08:01 1604 7f4373bf2000-7f4373df1000 ---p 00015000 08:01 1604 7f4373df1000-7f4373df2000 r--p 00014000 08:01 1604 7f4373df2000-7f4373df3000 rw-p 00015000 08:01 1604 7f4373df3000-7f4373dff000 r-xp 00000000 08:01 1621 7f4373dff000-7f4373ffe000 ---p 0000c000 08:01 1621 7f4373ffe000-7f4373fff000 r--p 0000b000 08:01 1621 7f4373fff000-7f4374000000 rw-p 0000c000 08:01 1621 7f4374000000-7f4374021000 rw-p 00000000 00:00 7f4374021000-7f4378000000 ---p 00000000 00:00 7f437810e000-7f437810f000 ---p 00000000 00:00 7f437810f000-7f437890f000 rw-p 00000000 00:00 0 7f437890f000-7f4378916000 r-xp 00000000 08:01 1615 7f4378916000-7f4378b15000 ---p 00007000 08:01 1615 7f4378b15000-7f4378b16000 r--p 00006000 08:01 1615 7f4378b16000-7f4378b17000 rw-p 00007000 08:01 1615 7f4378b17000-7f4378b5b000 r-xp 00000000 08:01 5920 7f4378b5b000-7f4378d5a000 ---p 00044000 08:01 5920 7f4378d5a000-7f4378d5b000 r--p 00043000 08:01 5920 7f4378d5b000-7f4378d5c000 rw-p 00044000 08:01 5920 7f4378d5c000-7f4378d73000 r-xp 00000000 08:01 1617 7f4378d73000-7f4378f73000 ---p 00017000 08:01 1617 7f4378f73000-7f4378f74000 r--p 00017000 08:01 1617 7f4378f74000-7f4378f75000 rw-p 00018000 08:01 1617 7f4378f75000-7f4378f79000 rw-p 00000000 00:00 7f4378f79000-7f4378f88000 r-xp 00000000 08:01 140219 7f4378f88000-7f4379188000 ---p 0000f000 08:01 140219 7f4379188000-7f4379189000 r--p 0000f000 08:01 140219 7f4379189000-7f437918a000 rw-p 00010000 08:01 140219 7f437918a000-7f4379195000 r-xp 00000000 08:01 140221 7f4379195000-7f4379394000 ---p 0000b000 08:01 140221 7f4379394000-7f4379395000 r--p 0000a000 08:01 140221 7f4379395000-7f4379396000 rw-p 0000b000 08:01 140221 7f4379396000-7f43793a4000 r-xp 00000000 08:01 159231 7f43793a4000-7f43795a3000 ---p 0000e000 08:01 159231 7f43795a3000-7f43795a4000 r--p 0000d000 08:01 159231 7f43795a4000-7f43795a5000 rw-p 0000e000 08:01 159231 7f43795a5000-7f43795a8000 r-xp 00000000 08:01 1605 7f43795a8000-7f43797a7000 ---p 00003000 08:01 1605 7f43797a7000-7f43797a8000 r--p 00002000 08:01 1605 7f43797a8000-7f43797a9000 rw-p 00003000 08:01 1605 7f43797a9000-7f4379965000 r-xp 00000000 08:01 1627 7f4379965000-7f4379b65000 ---p 001bc000 08:01 1627 7f4379b65000-7f4379b69000 r--p 001bc000 08:01 1627 7f4379b69000-7f4379b6b000 rw-p 001c0000 08:01 1627 7f4379b6b000-7f4379b70000 rw-p 00000000 00:00 7f4379b70000-7f4379b77000 r-xp 00000000 08:01 133923 7f4379b77000-7f4379d76000 ---p 00007000 08:01 133923 7f4379d76000-7f4379d77000 r--p 00006000 08:01 133923 7f4379d77000-7f4379d78000 rw-p 00007000 08:01 133923 7f4379d78000-7f4379d9b000 r-xp 00000000 08:01 1618 7f4379f83000-7f4379f86000 rw-p 00000000 00:00 7f4379f94000-7f4379f9a000 rw-p 00000000 00:00 7f4379f9a000-7f4379f9b000 r--p 00022000 08:01 1618 7f4379f9b000-7f4379f9d000 rw-p 00023000 08:01 1618 7ffff0848000-7ffff0869000 rw-p 00000000 00:00 0 7ffff09fe000-7ffff0a00000 r-xp 00000000 00:00 0 ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 Usage: scanimage [OPTION]... />PHP-Scanner-Server$ scanimage -f "{\"ID\":%i,\"INUSE\":0,\"DEVICE\":\"%d\",\"NAME\":\"%v %m %t\"},"
;DEVICE":"net:10.0.0.50:plustek:libusb:003:002","NAME":"UMAX 3400 flatbed scanner"},{"ID":1,"INUSE":0,"DEVICE":"net:10.0.0.50:hpaio:/usb/Deskjet_F4400_series?serial=CN05DC61TP05C5","NAME":"Hewlett-Packard Deskjet_F4400_series all-in-one"},
/>PHP-Scanner-Server$ scanimage --help -d 'net:10.0.0.50:plustek:libusb:003:002'
(top): 0x0000000002598130 ***
/>[0x7f4379829996]
/>0x14d)[0x7f43798179bd]
/>files.so.2(_nss_files_getservbyname_r+0x11b)[0x7f4373df7adb]
/>ame_r+0xd2)[0x7f43798bf022]
/>[0x7f437987472b]
/>[0x7f4379874a93]
/>o+0xf4)[0x7f4379878d74]
/>net.so.1(+0x6c3c)[0x7f437939cc3c]
/>net.so.1(sane_net_init+0x428)[0x7f437939d438]
/>so.1(+0x3b00)[0x7f4379b73b00]
/>so.1(sane_dll_open+0xe2)[0x7f4379b74842]
/>libc_start_main+0xf5)[0x7f43797cade5]
/usr/bin/scanimage
/usr/bin/scanimage
/usr/bin/scanimage
[heap]
/lib/x86_64-linux-gnu/libgcc_s.so.1
/lib/x86_64-linux-gnu/libgcc_s.so.1
/lib/x86_64-linux-gnu/libgcc_s.so.1
/lib/x86_64-linux-gnu/libgcc_s.so.1
/lib/x86_64-linux-gnu/libnss_files-2.17.so
/lib/x86_64-linux-gnu/libnss_files-2.17.so
/lib/x86_64-linux-gnu/libnss_files-2.17.so
/lib/x86_64-linux-gnu/libnss_files-2.17.so
0
0
0
[stack:17829]
/lib/x86_64-linux-gnu/librt-2.17.so
/lib/x86_64-linux-gnu/librt-2.17.so
/lib/x86_64-linux-gnu/librt-2.17.so
/lib/x86_64-linux-gnu/librt-2.17.so
/lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
/lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
/lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
/lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
/lib/x86_64-linux-gnu/libpthread-2.17.so
/lib/x86_64-linux-gnu/libpthread-2.17.so
/lib/x86_64-linux-gnu/libpthread-2.17.so
/lib/x86_64-linux-gnu/libpthread-2.17.so
0
/usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
/usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
/usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
/usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
/usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
/usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
/usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
/usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
/lib/x86_64-linux-gnu/libdl-2.17.so
/lib/x86_64-linux-gnu/libdl-2.17.so
/lib/x86_64-linux-gnu/libdl-2.17.so
/lib/x86_64-linux-gnu/libdl-2.17.so
/lib/x86_64-linux-gnu/libc-2.17.so
/lib/x86_64-linux-gnu/libc-2.17.so
/lib/x86_64-linux-gnu/libc-2.17.so
/lib/x86_64-linux-gnu/libc-2.17.so
0
/usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
/usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
/usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
/usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
/lib/x86_64-linux-gnu/ld-2.17.so
0
0
/lib/x86_64-linux-gnu/ld-2.17.so
/lib/x86_64-linux-gnu/ld-2.17.so
[stack]
[vdso]
[vsyscall]

Start image acquisition on a scanner device and write image data to
standard output.

Parameters are separated by a blank from single-character options (e.g.
-d epson) and by a "=" from multi-character options (e.g. --device-name=epson).
-d, --device-name=DEVICE use a given scanner device (e.g. hp:/dev/scanner)
    --format=pnm|tiff file format of output file
-i, --icc-profile=PROFILE include this ICC profile into TIFF file
-L, --list-devices show available scanner devices
-f, --formatted-device-list=FORMAT similar to -L, but the FORMAT of the output
                           can be specified: %d (device name), %v (vendor),
                           %m (model), %t (type), %i (index number), and
                           %n (newline)
-b, --batch[=FORMAT] working in batch mode, FORMAT is `out%d.pnm' or
                           `out%d.tif' by default depending on --format
    --batch-start=# page number to start naming files with
    --batch-count=# how many pages to scan in batch mode
    --batch-increment=# increase page number in filename by #
    --batch-double increment page number by two, same as
                           --batch-increment=2
    --batch-prompt ask for pressing a key before scanning a page
    --accept-md5-only only accept authorization requests using md5
-p, --progress print progress messages
-n, --dont-scan only set options, don't actually scan
-T, --test test backend thoroughly
-A, --all-options list all available backend options
-h, --help display this help message and exit
-v, --verbose give even more status messages
-B, --buffer-size=# change input buffer size (in kB, default 32)
-V, --version print version information
Aborted (core dumped)
www-data@127.0.0.1:/home/www-data/PHP-Scanner-Server$ scanimage --help -d 'net:10.0.0.50:plustek:libusb:003:002' --source ' in `scanimage'\'': double free or corruption (top): 0x0000000002598130 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x80996)[0x7f4379829996]
/lib/x86_64-linux-gnu/libc.so.6(fclose+0x14d)[0x7f43798179bd]
/lib/x86_64-linux-gnu/libnss_files.so.2(_nss_files_getservbyname_r+0x11b)[0x7f4373df7adb]
/lib/x86_64-linux-gnu/libc.so.6(getservbyname_r+0xd2)[0x7f43798bf022]
/lib/x86_64-linux-gnu/libc.so.6(+0xcb72b)[0x7f437987472b]
/lib/x86_64-linux-gnu/libc.so.6(+0xcba93)[0x7f4379874a93]
/lib/x86_64-linux-gnu/libc.so.6(getaddrinfo+0xf4)[0x7f4379878d74]
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1(+0x6c3c)[0x7f437939cc3c]
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1(sane_net_init+0x428)[0x7f437939d438]
/usr/lib/x86_64-linux-gnu/libsane.so.1(+0x3b00)[0x7f4379b73b00]
/usr/lib/x86_64-linux-gnu/libsane.so.1(sane_dll_open+0xe2)[0x7f4379b74842]
scanimage[0x401fa8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7f43797cade5]
scanimage[0x403924]
======= Memory map: ========
00400000-0040a000 r-xp 00000000 08:01 1355 /usr/bin/scanimage
0060a000-0060b000 r--p 0000a000 08:01 1355 /usr/bin/scanimage
0060b000-0060c000 rw-p 0000b000 08:01 1355 /usr/bin/scanimage
0258d000-025ae000 rw-p 00000000 00:00 0 '
Segmentation fault (core dumped)
www-data@127.0.0.1:/home/www-data/PHP-Scanner-Server$ lsusb -s '003:002'

www-data@127.0.0.1:/home/www-data/PHP-Scanner-Server$ scanimage --help -d 'net:10.0.0.50:hpaio:/usb/Deskjet_F4400_series?serial=CN05DC61TP05C5'
*** Error in `scanimage': double free or corruption (top): 0x0000000002334f50 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x80996)[0x7ff4dc230996]
/lib/x86_64-linux-gnu/libc.so.6(fclose+0x14d)[0x7ff4dc21e9bd]
/lib/x86_64-linux-gnu/libnss_files.so.2(_nss_files_getservbyname_r+0x11b)[0x7ff4da90cadb]
/lib/x86_64-linux-gnu/libc.so.6(getservbyname_r+0xd2)[0x7ff4dc2c6022]
/lib/x86_64-linux-gnu/libc.so.6(+0xcb72b)[0x7ff4dc27b72b]
/lib/x86_64-linux-gnu/libc.so.6(+0xcba93)[0x7ff4dc27ba93]
/lib/x86_64-linux-gnu/libc.so.6(getaddrinfo+0xf4)[0x7ff4dc27fd74]
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1(+0x6c3c)[0x7ff4dbda3c3c]
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1(sane_net_init+0x428)[0x7ff4dbda4438]
/usr/lib/x86_64-linux-gnu/libsane.so.1(+0x3b00)[0x7ff4dc57ab00]
/usr/lib/x86_64-linux-gnu/libsane.so.1(sane_dll_open+0xe2)[0x7ff4dc57b842]
scanimage[0x401fa8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7ff4dc1d1de5]
scanimage[0x403924]
======= Memory map: ========
00400000-0040a000 r-xp 00000000 08:01 1355 /usr/bin/scanimage
0060a000-0060b000 r--p 0000a000 08:01 1355 /usr/bin/scanimage
0060b000-0060c000 rw-p 0000b000 08:01 1355 /usr/bin/scanimage
0232a000-0234b000 rw-p 00000000 00:00 0 [heap]
7ff4d4000000-7ff4d4021000 rw-p 00000000 00:00 0
7ff4d4021000-7ff4d8000000 ---p 00000000 00:00 0
7ff4da6f2000-7ff4da707000 r-xp 00000000 08:01 1604 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff4da707000-7ff4da906000 ---p 00015000 08:01 1604 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff4da906000-7ff4da907000 r--p 00014000 08:01 1604 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff4da907000-7ff4da908000 rw-p 00015000 08:01 1604 /lib/x86_64-linux-gnu/libgcc_s.so.1
7ff4da908000-7ff4da914000 r-xp 00000000 08:01 1621 /lib/x86_64-linux-gnu/libnss_files-2.17.so
7ff4da914000-7ff4dab13000 ---p 0000c000 08:01 1621 /lib/x86_64-linux-gnu/libnss_files-2.17.so
7ff4dab13000-7ff4dab14000 r--p 0000b000 08:01 1621 /lib/x86_64-linux-gnu/libnss_files-2.17.so
7ff4dab14000-7ff4dab15000 rw-p 0000c000 08:01 1621 /lib/x86_64-linux-gnu/libnss_files-2.17.so
7ff4dab15000-7ff4dab16000 ---p 00000000 00:00 0
7ff4dab16000-7ff4db316000 rw-p 00000000 00:00 0 [stack:17840]
7ff4db316000-7ff4db31d000 r-xp 00000000 08:01 1615 /lib/x86_64-linux-gnu/librt-2.17.so
7ff4db31d000-7ff4db51c000 ---p 00007000 08:01 1615 /lib/x86_64-linux-gnu/librt-2.17.so
7ff4db51c000-7ff4db51d000 r--p 00006000 08:01 1615 /lib/x86_64-linux-gnu/librt-2.17.so
7ff4db51d000-7ff4db51e000 rw-p 00007000 08:01 1615 /lib/x86_64-linux-gnu/librt-2.17.so
7ff4db51e000-7ff4db562000 r-xp 00000000 08:01 5920 /lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
7ff4db562000-7ff4db761000 ---p 00044000 08:01 5920 /lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
7ff4db761000-7ff4db762000 r--p 00043000 08:01 5920 /lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
7ff4db762000-7ff4db763000 rw-p 00044000 08:01 5920 /lib/x86_64-linux-gnu/libdbus-1.so.3.7.4
7ff4db763000-7ff4db77a000 r-xp 00000000 08:01 1617 /lib/x86_64-linux-gnu/libpthread-2.17.so
7ff4db77a000-7ff4db97a000 ---p 00017000 08:01 1617 /lib/x86_64-linux-gnu/libpthread-2.17.so
7ff4db97a000-7ff4db97b000 r--p 00017000 08:01 1617 /lib/x86_64-linux-gnu/libpthread-2.17.so
7ff4db97b000-7ff4db97c000 rw-p 00018000 08:01 1617 /lib/x86_64-linux-gnu/libpthread-2.17.so
7ff4db97c000-7ff4db980000 rw-p 00000000 00:00 0
7ff4db980000-7ff4db98f000 r-xp 00000000 08:01 140219 /usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
7ff4db98f000-7ff4dbb8f000 ---p 0000f000 08:01 140219 /usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
7ff4dbb8f000-7ff4dbb90000 r--p 0000f000 08:01 140219 /usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
7ff4dbb90000-7ff4dbb91000 rw-p 00010000 08:01 140219 /usr/lib/x86_64-linux-gnu/libavahi-client.so.3.2.9
7ff4dbb91000-7ff4dbb9c000 r-xp 00000000 08:01 140221 /usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
7ff4dbb9c000-7ff4dbd9b000 ---p 0000b000 08:01 140221 /usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
7ff4dbd9b000-7ff4dbd9c000 r--p 0000a000 08:01 140221 /usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
7ff4dbd9c000-7ff4dbd9d000 rw-p 0000b000 08:01 140221 /usr/lib/x86_64-linux-gnu/libavahi-common.so.3.5.3
7ff4dbd9d000-7ff4dbdab000 r-xp 00000000 08:01 159231 /usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
7ff4dbdab000-7ff4dbfaa000 ---p 0000e000 08:01 159231 /usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
7ff4dbfaa000-7ff4dbfab000 r--p 0000d000 08:01 159231 /usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
7ff4dbfab000-7ff4dbfac000 rw-p 0000e000 08:01 159231 /usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1.0.23
7ff4dbfac000-7ff4dbfaf000 r-xp 00000000 08:01 1605 /lib/x86_64-linux-gnu/libdl-2.17.so
7ff4dbfaf000-7ff4dc1ae000 ---p 00003000 08:01 1605 /lib/x86_64-linux-gnu/libdl-2.17.so
7ff4dc1ae000-7ff4dc1af000 r--p 00002000 08:01 1605 /lib/x86_64-linux-gnu/libdl-2.17.so
7ff4dc1af000-7ff4dc1b0000 rw-p 00003000 08:01 1605 /lib/x86_64-linux-gnu/libdl-2.17.so
7ff4dc1b0000-7ff4dc36c000 r-xp 00000000 08:01 1627 /lib/x86_64-linux-gnu/libc-2.17.so
7ff4dc36c000-7ff4dc56c000 ---p 001bc000 08:01 1627 /lib/x86_64-linux-gnu/libc-2.17.so
7ff4dc56c000-7ff4dc570000 r--p 001bc000 08:01 1627 /lib/x86_64-linux-gnu/libc-2.17.so
7ff4dc570000-7ff4dc572000 rw-p 001c0000 08:01 1627 /lib/x86_64-linux-gnu/libc-2.17.so
7ff4dc572000-7ff4dc577000 rw-p 00000000 00:00 0
7ff4dc577000-7ff4dc57e000 r-xp 00000000 08:01 133923 /usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
7ff4dc57e000-7ff4dc77d000 ---p 00007000 08:01 133923 /usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
7ff4dc77d000-7ff4dc77e000 r--p 00006000 08:01 133923 /usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
7ff4dc77e000-7ff4dc77f000 rw-p 00007000 08:01 133923 /usr/lib/x86_64-linux-gnu/libsane.so.1.0.23
7ff4dc77f000-7ff4dc7a2000 r-xp 00000000 08:01 1618 /lib/x86_64-linux-gnu/ld-2.17.so
7ff4dc98a000-7ff4dc98d000 rw-p 00000000 00:00 0
7ff4dc99b000-7ff4dc9a1000 rw-p 00000000 00:00 0
7ff4dc9a1000-7ff4dc9a2000 r--p 00022000 08:01 1618 /lib/x86_64-linux-gnu/ld-2.17.so
7ff4dc9a2000-7ff4dc9a4000 rw-p 00023000 08:01 1618 /lib/x86_64-linux-gnu/ld-2.17.so
7fffaca61000-7fffaca82000 rw-p 00000000 00:00 0 [stack]
7fffacbfe000-7fffacc00000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]
Usage: scanimage [OPTION]...

Start image acquisition on a scanner device and write image data to
standard output.

Parameters are separated by a blank from single-character options (e.g.
-d epson) and by a "=" from multi-character options (e.g. --device-name=epson).
-d, --device-name=DEVICE use a given scanner device (e.g. hp:/dev/scanner)
    --format=pnm|tiff file format of output file
-i, --icc-profile=PROFILE include this ICC profile into TIFF file
-L, --list-devices show available scanner devices
-f, --formatted-device-list=FORMAT similar to -L, but the FORMAT of the output
                           can be specified: %d (device name), %v (vendor),
                           %m (model), %t (type), %i (index number), and
                           %n (newline)
-b, --batch[=FORMAT] working in batch mode, FORMAT is `out%d.pnm' or
                           `out%d.tif' by default depending on --format
    --batch-start=# page number to start naming files with
    --batch-count=# how many pages to scan in batch mode
    --batch-increment=# increase page number in filename by #
    --batch-double increment page number by two, same as
                           --batch-increment=2
    --batch-prompt ask for pressing a key before scanning a page
    --accept-md5-only only accept authorization requests using md5
-p, --progress print progress messages
-n, --dont-scan only set options, don't actually scan
-T, --test test backend thoroughly
-A, --all-options list all available backend options
-h, --help display this help message and exit
-v, --verbose give even more status messages
-B, --buffer-size=# change input buffer size (in kB, default 32)
-V, --version print version information
Aborted (core dumped)
www-data@127.0.0.1:/home/www-data/PHP-Scanner-Server$ scanimage --help -d 'net:10.0.0.50:hpaio:/usb/Deskjet_F4400_series?serial=CN05DC61TP05C5' --source ' in `scanimage'\'': double free or corruption (top): 0x0000000002334f50 ***
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(+0x80996)[0x7ff4dc230996]
/lib/x86_64-linux-gnu/libc.so.6(fclose+0x14d)[0x7ff4dc21e9bd]
/lib/x86_64-linux-gnu/libnss_files.so.2(_nss_files_getservbyname_r+0x11b)[0x7ff4da90cadb]
/lib/x86_64-linux-gnu/libc.so.6(getservbyname_r+0xd2)[0x7ff4dc2c6022]
/lib/x86_64-linux-gnu/libc.so.6(+0xcb72b)[0x7ff4dc27b72b]
/lib/x86_64-linux-gnu/libc.so.6(+0xcba93)[0x7ff4dc27ba93]
/lib/x86_64-linux-gnu/libc.so.6(getaddrinfo+0xf4)[0x7ff4dc27fd74]
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1(+0x6c3c)[0x7ff4dbda3c3c]
/usr/lib/x86_64-linux-gnu/sane/libsane-net.so.1(sane_net_init+0x428)[0x7ff4dbda4438]
/usr/lib/x86_64-linux-gnu/libsane.so.1(+0x3b00)[0x7ff4dc57ab00]
/usr/lib/x86_64-linux-gnu/libsane.so.1(sane_dll_open+0xe2)[0x7ff4dc57b842]
scanimage[0x401fa8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7ff4dc1d1de5]
scanimage[0x403924]
======= Memory map: ========
00400000-0040a000 r-xp 00000000 08:01 1355 /usr/bin/scanimage
0060a000-0060b000 r--p 0000a000 08:01 1355 /usr/bin/scanimage
0060b000-0060c000 rw-p 0000b000 08:01 1355 /usr/bin/scanimage
0232a000-0234b000 rw-p 00000000 00:00 0 '
scanimage: setting of option --source failed (Invalid argument)
Usage: scanimage [OPTION]...

Start image acquisition on a scanner device and write image data to
standard output.

ProblemType: Crash
DistroRelease: Ubuntu 13.10
Package: sane-utils 1.0.23-0ubuntu3
ProcVersionSignature: Ubuntu 3.10.0-6.17-generic 3.10.3
Uname: Linux 3.10.0-6-generic x86_64
ApportVersion: 2.12-0ubuntu2
Architecture: amd64
AssertionMessage: *** Error in `scanimage': double free or corruption (out): 0x00007fd69c000de0 ***
CrashCounter: 1
Date: Sat Aug 3 22:30:53 2013
ExecutablePath: /usr/bin/scanimage
InstallationDate: Installed on 2013-07-27 (7 days ago)
InstallationMedia: Xubuntu 13.10 "Saucy Salamander" - Alpha amd64 (20130727)
MarkForUpload: True
ProcCmdline: scanimage -f {"ID":%i,"INUSE":0,"DEVICE":"%d","NAME":"%v\ %m\ %t"},
ProcEnviron:
PATH=(custom, no user)
LANG=C
Signal: 6
SourcePackage: sane-backends
StacktraceTop:
__libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fd6ad1f26a0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
malloc_printerr (ptr=0x7fd69c000de0, str=0x7fd6ad1f27d0 "double free or corruption (out)", action=3) at malloc.c:4902
_int_free (av=<optimized out>, p=0x7fd69c000dd0, have_lock=0) at malloc.c:3758
_IO_new_fclose (fp=0x7fd69c000de0) at iofclose.c:85
internal_endent () at nss_files/files-XXX.c:161
Title: scanimage assert failure: *** Error in `scanimage': double free or corruption (out): 0x00007fd69c000de0 ***
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: lp

Tags:

Revision history for this message

pqwoerituytrueiwoq (pqwoerituytrueiwoq) wrote on 2013-08-04:

Dependencies.txt Edit (3.5 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (958 bytes, text/plain; charset="utf-8")
ProcMaps.txt Edit (50.1 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (788 bytes, text/plain; charset="utf-8")
Registers.txt Edit (666 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (6.9 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (11.7 KiB, text/plain; charset="utf-8")

information type:

Private → Public

Revision history for this message

Apport retracing service (apport) wrote on 2013-08-04:

StacktraceTop:
__libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fd6ad1f26a0 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
malloc_printerr (ptr=0x7fd69c000de0, str=0x7fd6ad1f27d0 "double free or corruption (out)", action=3) at malloc.c:4902
_int_free (av=<optimized out>, p=0x7fd69c000dd0, have_lock=0) at malloc.c:3758
_IO_new_fclose (fp=0x7fd69c000de0) at iofclose.c:85
internal_endent () at nss_files/files-XXX.c:161

Revision history for this message

Apport retracing service (apport) wrote on 2013-08-04: Stacktrace.txt

Stacktrace.txt Edit (9.8 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2013-08-04: StacktraceSource.txt

StacktraceSource.txt Edit (5.6 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2013-08-04: ThreadStacktrace.txt

ThreadStacktrace.txt Edit (15.6 KiB, text/plain)

Changed in sane-backends (Ubuntu):
importance:	Undecided → Medium
tags:	removed: need-amd64-retrace

Revision history for this message

pqwoerituytrueiwoq (pqwoerituytrueiwoq) wrote on 2013-08-04:

This may be relevant
On my raring server if i configure saned to scan the localhost it starts dumping errors like this
this was not a issue on Ubuntu 10.04

on saucy i kept trying to get it to work by running the command over and over eventually it worked after about 5 times
sometimes the application would jut hang and do nothing other times it will just segfault

Revision history for this message

John Paul Adrian Glaubitz (glaubitz) wrote on 2014-01-19:

I have sponsored sane-backends 1.0.24-1 and push another NMU today. It should be imported into Ubuntu soon.

Please test with the latest version once available in Ubuntu.

Bug Watch Updater (bug-watch-updater) on 2014-01-19

Changed in sane-backends (Debian):
status:	Unknown → New

Bug Watch Updater (bug-watch-updater) on 2014-01-20

Changed in sane-backends (Debian):
status:	New → Incomplete

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-05-06:

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in sane-backends (Ubuntu):
status:	New → Confirmed

Revision history for this message

Tuomas Suutari (tuomas-suutari) wrote on 2014-05-06:

Is this possibly a duplicate of #1224764 ?

Bug Watch Updater (bug-watch-updater) on 2014-10-27

Changed in sane-backends (Debian):
status:	Incomplete → Fix Released

Revision history for this message

Laurent Vivier (laurent-vivier) wrote on 2015-05-16:

#10

sane_net.patch Edit (662 bytes, text/plain)

I have the problem.

This is a race condition between the sane_net_init() loop adding devices from net.conf into the chained list and the AVAHI thread doing the same thing. As there is no lock to protect the head pointer, we can have list corruption. Delaying avahi_init() at the end of sane_net_init() corrects the problem.

Revision history for this message

Laurent Vivier (laurent-vivier) wrote on 2015-05-16:

#11

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 15.04
Release: 15.04
Codename: vivid

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2015-05-17:

#12

The attachment "sane_net.patch" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags:

added: patch

Revision history for this message

Rolf Leggewie (r0lf) wrote on 2017-02-09:

#13

Laurent, thank you for the analysis and patch. It seems this patch essentially still applies even to the latest Debian release (cf. https://sources.debian.net/src/sane-backends/1.0.25-3/backend/net.c/) Have you tried talking to Debian or upstream to get the patch included there?

Revision history for this message

Laurent Vivier (laurent-vivier) wrote on 2017-02-09:

#14

No, and I don't see anymore this problem with my computers using Fedora 25 or Ubuntu 16.04, so I think it should be already fixed upstream.

Revision history for this message

Rolf Leggewie (r0lf) wrote on 2017-02-09:

#15

update Debian tracker from http://bugs.debian.org/734103 to 854705

Changed in sane-backends (Debian):
status:	Fix Released → Unknown

Bug Watch Updater (bug-watch-updater) on 2017-02-09

Changed in sane-backends (Debian):
status:	Unknown → New

Bug Watch Updater (bug-watch-updater) on 2017-02-10

Changed in sane-backends (Debian):
status:	New → Fix Released

Revision history for this message

John Paul Adrian Glaubitz (glaubitz) wrote on 2017-05-05:

#16

@Laurent: Your patch has not been merged upstream, see [1].

Joerg (the maintainer of sane-backends in Debian) now wants to use the shotgun approach and drop Avahi support completely, arguing that it is broken. However, since your patch was never merged to the Debian package, I'm not surprised that people are still having Avahi issues.

> [1] https://anonscm.debian.org/cgit/sane/sane-backends.git/tree/backend/net.c#n967