From: David Bremner <david@tethera.net>
To: Gaute Hope <eg@gaute.vetsj.com>, notmuch@notmuchmail.org
Subject: Re: talloc_abort in notmuch_thread_get_tags () when db has been
 modified
In-Reply-To: <1453106256-astroid-0-0ubhau8qws-26019@strange>
References: <1453106256-astroid-0-0ubhau8qws-26019@strange>
User-Agent: Notmuch/0.21+26~g9404723 (http://notmuchmail.org) Emacs/24.5.1
 (x86_64-pc-linux-gnu)
Date: Mon, 18 Jan 2016 08:25:00 -0400
Message-ID: <87k2n72hyb.fsf@zancas.localnet>
MIME-Version: 1.0
Content-Type: text/plain
Precedence: list

Gaute Hope <eg@gaute.vetsj.com> writes:

> Hi,
>
> a user of astroid [0] ran into a issue [1] (full trace at issue) where
> reading a long query causes a talloc_abort in notmuch_thread_get_tags
> (). 'notmuch new' is running at the same time, and most likely a thread
> in the query has been modified since the query was done. Note that a
> notmuch_thread_get_authors () call returns NULL without causing a full
> crash. The code causing the crash is:
>
> ```
>     for (tags = notmuch_thread_get_tags (nm_thread);
>          notmuch_tags_valid (tags);
>          notmuch_tags_move_to_next (tags))
>     {
>       tag = notmuch_tags_get (tags); // tag belongs to tags
>     }
>
>     // or db.cc:508 in astroid/src.
> ```
>

The most likely cause of such a crash looks to me like nm_thread is NULL
or corrupted when passed in to get_tags. It's used without checking as a
talloc context, and that call to talloc never returns.