Segfault with XPAT on huge threads

Hi John, hi slrn users,

I stumbled upon a segfault, when trying to reconstruct _huge_ threads.¹

gdb is not very helpfull:

#v+
(gdb) file /usr/bin/slrn
(gdb) attach 5058
`system-supplied DSO at 0x6f724000' has disappeared; keeping its symbols.
0x6f743424 in __kernel_vsyscall ()
(gdb) cont

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0x00048930 in ?? ()
#2  0x00000000 in ?? ()
(gdb) 
#v-

[tail --debug output]
#v+
>XOVER 297249-297249
>

<224 Overview information for postings 297249-297249:
<297249	Re: Untersch?tzte Gefahren im Alltag	Andreas Dau <[email protected]>	Sat, 30 Aug 2008 13:43:47 +0200	<[email protected]>	<[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]> <[email protected]>	2241	17	Xref: news.lan.robgri.de de.alt.sysadmin.recovery:297249
<.
>XOVER 1276674734065955-1276674734065955
>

<502 Usage: XOVER [first[-[last]]]
#v-

297249 is the 1024th overview excerpt returned by XPAT.

however, I guess I've tracked it down to find_children_headers() and
tried the following patch, which avoids the segmentation fault. There is
a drawback, to wit the thread is not fully reconstructed.

#v+
diff -urNad slrn-1.0.0~pre17~/src/art.c slrn-1.0.0~pre17/src/art.c
--- slrn-1.0.0~pre17~/src/art.c	2009-12-02 08:03:47.000000000 +0100
+++ slrn-1.0.0~pre17/src/art.c	2009-12-02 08:06:44.737185566 +0100
@@ -6036,6 +6036,8 @@
 	if (NULL != find_header_from_serverid (id)) continue;
 	id_array[num_ids] = id;
 	num_ids++;
+
+	if (num_ids >= 999) break;
      }
    
    for (i = 0; i < num_ids; i++)
#v-

What puzzles me: the segfault is not reproducible if slrn is compiled
with -O0, so I'm not sure if I have found the real problem.

Rob
¹ I do this from time to time for performance measurement/optimization
-- 
grub rescue> help
Unknown command 'help'
Try 'help' for usage


------------------------------------------------------------------------------
Join us December 9, 2009 for the Red Hat Virtual Experience,
a free event focused on virtualization and cloud computing. 
Attend in-depth sessions from your desk. Your couch. Anywhere.
http://p.sf.net/sfu/redhat-sfdev2dev