Segfault trying to access addresses of a cluster through AddressIterator

[rg687]

Hello,

I am trying to access addresses belonging to a cluster but it ends up with a seg fault.

This is for LTC chain.

addr = 'LTU2cds4aSdXFip9sV4gXphnhxGQjgfjmg'
address = chain.address_from_string(addr)        
print ('balance addr', address.balance()/1e8)
cluster = cm.cluster_with_address(address)        
print ('type_equiv_size {}'.format(cluster.type_equiv_size))

> balance addr 101872.06398165
> type_equiv_size 19681702

and

for a in cluster.addresses:
    print (a)

ends up with a seg fault.

System Information

BlockSci version: latest v0.6
Using AMI: no
Total memory: 64

[maltemoeser]

I think this might have been the same issue as in #256, your code is working on my machine with the fix on the v0.6 branch. You'll need to re-run the clustering. Let me know if it did or didn't resolve this issue.

[rg687]

Hello,

It seems that I still have the same error. I use:

4.15.0-48-generic #51-Ubuntu SMP Wed Apr 3 08:28:49 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Distributor ID:	Ubuntu
Description:	Ubuntu 18.04.2 LTS
Release:	18.04
Codename:	bionic

edit: i use latest v0.6 with your patch

cat src/cluster/cluster_manager.cpp | grep -A 8  "auto it = typeIndexes.find(pair.second);"
            auto it = typeIndexes.find(pair.second);
            if(it != typeIndexes.end()) {
                // If an address type is not used, skip to the next one
                it->second = std::max(it->second, pair.first);
            } else {
                typeIndexes[pair.second] = pair.first;
            }
        }

and re-runned the clustering

[maltemoeser]

Just to make sure, you re-compiled and re-installed BlockSci?

[rg687]

yes

git clone -b v0.6 https://github.com/citp/BlockSci.git
cd BlockSci
mkdir release
cd release
CC=gcc-7 CXX=g++-7 cmake -DCMAKE_BUILD_TYPE=Release ..
make
sudo make install

cd ..
CC=gcc-7 CXX=g++-7 pip install --user -e blockscipy

[maltemoeser]

Okay thanks. I currently don't have a 18.04 instance set up, so it may take a bit until I can look into this. I can't reproduce this on 18.04, in case you can produce a gdb stacktrace, that would also be very helpful. Which change heuristic are you using for clustering (just to make sure I can reproduce the exact same clusters)?

[rg687]

I tried with no heuristics and blocksci.heuristics.change.legacy.unique_change
gdb returns:

Thread 1 "python" received signal SIGSEGV, Segmentation fault.
0x00007fffdfb221eb in blocksci::ScriptHashBase::getUint160Address() const () from /usr/lib/x86_64-linux-gnu/libblocksci.so

edit: trying with another computer

[maltemoeser]

Can you run backtrace in gdb after the crash and copy the longer stacktrace?

[rg687]

(gdb) backtrace                                                                                                                                                                                              
#0  0x00007fffdfb221eb in blocksci::ScriptHashBase::getUint160Address() const () from /usr/lib/x86_64-linux-gnu/libblocksci.so                                                                               
#1  0x00007fffdfb222b4 in blocksci::ScriptAddress<(blocksci::AddressType::Enum)4>::addressString[abi:cxx11]() const () from /usr/lib/x86_64-linux-gnu/libblocksci.so                                         
#2  0x00007fffdfb24277 in blocksci::ScriptAddress<(blocksci::AddressType::Enum)4>::toPrettyString[abi:cxx11]() const () from /usr/lib/x86_64-linux-gnu/libblocksci.so                                        
#3  0x00007fffe0447b9e in ?? () from /home/ca/BlockSci/blockscipy/blocksci/_blocksci.cpython-37m-x86_64-linux-gnu.so                                                                                         
#4  0x00007fffe06ef483 in ?? () from /home/ca/BlockSci/blockscipy/blocksci/_blocksci.cpython-37m-x86_64-linux-gnu.so  
#5  0x000055555568fa65 in _PyMethodDef_RawFastCallDict (method=0x5555565ff0b0, self=0x7fffdf75dd20, args=0x7fffffffd660, nargs=1, kwargs=<optimized out>)
    at /tmp/build/80754af9/python_1544812943833/work/Objects/call.c:515
#6  0x000055555568fbb1 in _PyCFunction_FastCallDict (func=0x7fffdf75e990, args=<optimized out>, nargs=<optimized out>, kwargs=<optimized out>)
    at /tmp/build/80754af9/python_1544812943833/work/Objects/call.c:582
#7  0x0000555555681cb3 in _PyObject_Call_Prepend (callable=0x7fffdf75e990, obj=<optimized out>, args=0x7ffff7f8b048, kwargs=0x0) at /tmp/build/80754af9/python_1544812943833/work/Objects/call.c:904
#8  0x000055555566b403 in _PyObject_FastCallDict (callable=0x7fffdded4348, args=<optimized out>, nargs=<optimized out>, kwargs=0x0) at /tmp/build/80754af9/python_1544812943833/work/Objects/call.c:125
#9  0x00005555556c532a in call_unbound (nargs=<optimized out>, args=<optimized out>, self=<optimized out>, func=<optimized out>, unbound=<optimized out>)
    at /tmp/build/80754af9/python_1544812943833/work/Objects/typeobject.c:1484
#10 call_method (nargs=0, args=0x0, name=0x555555885680 <id>, obj=0x7fffdded5148) at /tmp/build/80754af9/python_1544812943833/work/Objects/typeobject.c:1513
#11 slot_tp_str (self=0x7fffdded5148) at /tmp/build/80754af9/python_1544812943833/work/Objects/typeobject.c:6314
#12 0x00005555556d9f12 in PyObject_Str (v=0x7fffdded5148) at /tmp/build/80754af9/python_1544812943833/work/Objects/object.c:527
#13 0x00005555556dc2ac in PyFile_WriteObject (v=0x7fffdded5148, f=<optimized out>, flags=<optimized out>) at /tmp/build/80754af9/python_1544812943833/work/Objects/fileobject.c:128
#14 0x00005555556e45c0 in builtin_print (self=<optimized out>, args=0x7ffff7f67b70, nargs=1, kwnames=<optimized out>) at /tmp/build/80754af9/python_1544812943833/work/Python/bltinmodule.c:1905
#15 0x00005555556ccfbc in _PyMethodDef_RawFastCallKeywords (method=0x555555883460 <builtin_methods+1120>, self=0x7ffff7fbfc28, args=0x7ffff7f67b70, nargs=<optimized out>, kwnames=<optimized out>)
    at /tmp/build/80754af9/python_1544812943833/work/Objects/call.c:656
#16 0x00005555556cd121 in _PyCFunction_FastCallKeywords (func=0x7ffff7f523a8, args=<optimized out>, nargs=<optimized out>, kwnames=<optimized out>)
    at /tmp/build/80754af9/python_1544812943833/work/Objects/call.c:730
#17 0x00005555557288d4 in call_function (kwnames=0x0, oparg=1, pp_stack=<synthetic pointer>) at /tmp/build/80754af9/python_1544812943833/work/Python/ceval.c:4554
#18 _PyEval_EvalFrameDefault (f=<optimized out>, throwflag=<optimized out>) at /tmp/build/80754af9/python_1544812943833/work/Python/ceval.c:3124
#19 0x0000555555669f19 in _PyEval_EvalCodeWithName (_co=0x7ffff7f055d0, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=0x0, kwargs=0x0,
    kwcount=0, kwstep=2, defs=0x0, defcount=0, kwdefs=0x0, closure=0x0, name=0x0, qualname=0x0) at /tmp/build/80754af9/python_1544812943833/work/Python/ceval.c:3930
--Type <RET> for more, q to quit, c to continue without paging--
#20 0x000055555566add4 in PyEval_EvalCodeEx (_co=<optimized out>, globals=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kws=<optimized out>, kwcount=0, 
    defs=0x0, defcount=0, kwdefs=0x0, closure=0x0) at /tmp/build/80754af9/python_1544812943833/work/Python/ceval.c:3959
#21 0x000055555566adfc in PyEval_EvalCode (co=<optimized out>, globals=<optimized out>, locals=<optimized out>) at /tmp/build/80754af9/python_1544812943833/work/Python/ceval.c:524
#22 0x00005555557839e4 in run_mod (mod=<optimized out>, filename=<optimized out>, globals=0x7ffff7ecc1f8, locals=0x7ffff7ecc1f8, flags=<optimized out>, arena=<optimized out>)
    at /tmp/build/80754af9/python_1544812943833/work/Python/pythonrun.c:1035
#23 0x000055555578dbd1 in PyRun_FileExFlags (fp=0x55555590c3f0, filename_str=<optimized out>, start=<optimized out>, globals=0x7ffff7ecc1f8, locals=0x7ffff7ecc1f8, closeit=1, flags=0x7fffffffdba0)
    at /tmp/build/80754af9/python_1544812943833/work/Python/pythonrun.c:988
#24 0x000055555578ddc3 in PyRun_SimpleFileExFlags (fp=0x55555590c3f0, filename=<optimized out>, closeit=1, flags=0x7fffffffdba0) at /tmp/build/80754af9/python_1544812943833/work/Python/pythonrun.c:429
#25 0x000055555578eedb in pymain_run_file (p_cf=0x7fffffffdba0, filename=0x5555558c6810 L"testgdb.py", fp=0x55555590c3f0) at /tmp/build/80754af9/python_1544812943833/work/Modules/main.c:427
#26 pymain_run_filename (cf=0x7fffffffdba0, pymain=0x7fffffffdcb0) at /tmp/build/80754af9/python_1544812943833/work/Modules/main.c:1537
#27 pymain_run_python (pymain=0x7fffffffdcb0) at /tmp/build/80754af9/python_1544812943833/work/Modules/main.c:2626
#28 pymain_main (pymain=0x7fffffffdcb0) at /tmp/build/80754af9/python_1544812943833/work/Modules/main.c:2787
#29 0x000055555578efbc in _Py_UnixMain (argc=<optimized out>, argv=<optimized out>) at /tmp/build/80754af9/python_1544812943833/work/Modules/main.c:2822
#30 0x00007ffff77e6b97 in __libc_start_main (main=0x55555564a830 <main>, argc=2, argv=0x7fffffffde08, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffddf8)
    at ../csu/libc-start.c:310
#31 0x0000555555733ed2 in _start () at ../sysdeps/x86_64/elf/start.S:103

[maltemoeser]

Great thanks. This seems indeed different from #256 and related to printing the actual address (which I didn't do when trying to reproduce this -- will try and report back).

[rg687]

Thanks a lot for your help!

Yeah I was trying

for a in cluster.addresses:
    print (a)

which seg faults

but i found out that

for a in cluster.addresses.to_list():
    print (a)

does produce the result i wanted

[maltemoeser]

Yeah it seems like the issue is with the address iterator returned by the cluster. Using to_list() should work as a workaround until that is fixed