crash adding image on linux i386

[peterclemenko]

Autopsy crashes on Linux i386 while adding an image to a case. It appears to compliain about sigar not being in the library path with the following error shortly before the crash:

"Error loading sigar libraryjava.lang.UnsatisfiedLinkError: no libsigar in java.library.path"

The log is located at: https://gist.github.com/th3flyboy/b4aed635a4da60a48dcf

[adam-m]

It seems the crash is from TSK Jni bindings, not due to lack of sigar
library (it is handled).
Which commit of sleuthkit are you using?

On Tue, Mar 12, 2013 at 5:18 PM, th3flyboy notifications@github.com wrote:

Autopsy crashes on Linux i386 while adding an image to a case. It appears
to compliain about sigar not being in the library path with the following
error shortly before the crash: "Error loading sigar
libraryjava.lang.UnsatisfiedLinkError: no libsigar in java.library.path"

The log is located at:
https://gist.github.com/th3flyboy/b4aed635a4da60a48dcf

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/166
.

[adam-m]

Was able to reproduce on linux. Possibly recent leak fix in that frame uncovered using illegal memory address bug. Here is full stack trace in C:

[New LWP 4883]
warning: Can't read pathname for load map: Input/output error.
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/i386-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/lib/jvm/java-7-openjdk-i386/bin/java -Djdk.home=/usr/lib/jvm/java-7-openjd'.
Program terminated with signal 6, Aborted.
#0 0xb776c424 in __kernel_vsyscall ()
(gdb) bt
#0 0xb776c424 in kernel_vsyscall ()
#1 0xb75d11ef in raise () from /lib/i386-linux-gnu/libc.so.6
#2 0xb75d4835 in abort () from /lib/i386-linux-gnu/libc.so.6
#3 0xb6f11ee5 in os::abort(bool) ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#4 0xb7014db9 in VMError::report_and_die() ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#5 0xb6f1a6a8 in JVM_handle_linux_signal ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#6 0xb6f0e9f3 in signalHandler(int, siginfo, void) ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#7
#8 0xb75e8b8e in vfprintf () from /lib/i386-linux-gnu/libc.so.6
#9 0xb76a1438 in __vsnprintf_chk () from /lib/i386-linux-gnu/libc.so.6
#10 0xb76a1347 in __snprintf_chk () from /lib/i386-linux-gnu/libc.so.6
#11 0xb20d9559 in snprintf (
__fmt=0xb20f9a54 "INSERT INTO tsk_files (fs_obj_id, obj_id, type, attr_type, attr_id, name, meta_addr, dir_type, meta_type, dir_flags, meta_flags, size, crtime, ctime, atime, mtime, mode, gid, uid, md5, known, parent_p"..., n=4096,
s=0xafc816ec "INSERT INTO tsk_files (fs_obj_id, obj_id, type, attr_type, attr_id, name, meta_addr, dir_type, meta_type, dir_flags, meta_flags, size, crtime, ctime, atime, mtime, mode, gid, uid, md5, known, parent_p"...) at /usr/include/i386-linux-gnu/bits/stdio2.h:66
#12 TskDbSqlite::addFile (this=0xaf8216b8, fs_file=0xae900938, fs_attr=0xb683e960,
path=0xb20ed07b "", md5=0x0, known=TSK_DB_FILES_KNOWN_UNKNOWN, fsObjId=2, parObjId=2,
objId=@0xaeb01610: 3) at db_sqlite.cpp:780
#13 0xb20d9851 in TskDbSqlite::addFsFile (this=0xaf8216b8, fs_file=0xae900938,
fs_attr=0xb683e960, path=0xb20ed07b "", md5=0x0, known=TSK_DB_FILES_KNOWN_UNKNOWN,
fsObjId=2, objId=@0xaeb01610: 3) at db_sqlite.cpp:561
#14 0xb206d3f6 in TskAutoDb::insertFileData (this=0xaeb015c0, fs_file=0xae900938,
---Type to continue, or q to quit---c
fs_attr=0xb683e960, path=0xb20ed07b "", md5=0x0, known=TSK_DB_FILES_KNOWN_UNKNOWN)
at auto_db.cpp:288
#15 0xb206daa5 in TskAutoDb::processAttribute (this=0xaeb015c0, fs_file=0xae900938,
fs_attr=0xb683e960, path=0xb20ed07b "") at auto_db.cpp:606
#16 0xb206b203 in TskAuto::processAttributes (this=0xaeb015c0, fs_file=0xae900938,
path=0xb20ed07b "") at auto.cpp:563
#17 0xb206d4c8 in processFile (path=0xb20ed07b "", fs_file=0xae900938, this=0xaeb015c0)
at auto_db.cpp:551
#18 TskAutoDb::processFile (this=0xaeb015c0, fs_file=0xae900938, path=0xb20ed07b "")
at auto_db.cpp:527
#19 0xb206d099 in filterFs (fs_info=0xaeba0608, this=0xaeb015c0) at auto_db.cpp:254
#20 TskAutoDb::filterFs (this=0xaeb015c0, fs_info=0xaeba0608) at auto_db.cpp:234
#21 0xb206bd1e in TskAuto::findFilesInFsInt (this=0xaeb015c0, a_fs_info=0xaeba0608, a_inum=2)
at auto.cpp:521
#22 0xb206c0ed in TskAuto::findFilesInFsRet (this=0xaeb015c0, a_start=0,
a_ftype=TSK_FS_TYPE_DETECT) at auto.cpp:360
#23 0xb206c27a in TskAuto::findFilesInFs (this=0xaeb015c0, a_start=0,
a_ftype=TSK_FS_TYPE_DETECT) at auto.cpp:398
#24 0xb206c2c3 in TskAuto::findFilesInFs (this=0xaeb015c0, a_start=0) at auto.cpp:381
#25 0xb206c4b9 in TskAuto::findFilesInVs (this=0xaeb015c0, a_start=0,
a_vtype=TSK_VS_TYPE_DETECT) at auto.cpp:293
#26 0xb206c583 in TskAuto::findFilesInVs (this=0xaeb015c0, a_start=0) at auto.cpp:323
#27 0xb206c5c9 in TskAuto::findFilesInImg (this=0xaeb015c0) at auto.cpp:218
#28 0xb2070069 in TskAutoDb::addFilesInImgToDb (this=0xaeb015c0) at auto_db.cpp:319
#29 0xb2070240 in TskAutoDb::startAddImage (this=0xaeb015c0, numImg=1, imagePaths=0xaecd9d38,
imgType=TSK_IMG_TYPE_DETECT, sSize=0) at auto_db.cpp:378
#30 0xb211db6e in Java_org_sleuthkit_datamodel_SleuthkitJNI_runAddImgNat (env=0xae900528,
obj=0xafc82c78, process=, paths=0xafc82c88, num_imgs=1, timezone=0xafc82c80)
at dataModel_SleuthkitJNI.cpp:557
---Type to continue, or q to quit---c
#31 0xb480a83d in ?? ()
#32 0xb48032c7 in ?? ()
#33 0xb48032c7 in ?? ()
#34 0xb48032c7 in ?? ()
#35 0xb480345a in ?? ()
#36 0xb480345a in ?? ()
#37 0xb48039d8 in ?? ()
#38 0xb48032c7 in ?? ()
#39 0xb48032c7 in ?? ()
#40 0xb4803845 in ?? ()
#41 0xb48032c7 in ?? ()
#42 0xb4803845 in ?? ()
#43 0xb48003d9 in ?? ()
#44 0xb6df8d2f in JavaCalls::call_helper(JavaValue, methodHandle, JavaCallArguments, Thread)
() from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#45 0xb6f17476 in os::os_exception_wrapper(void ()(JavaValue, methodHandle_, JavaCallArguments_, Thread_), JavaValue_, methodHandle_, JavaCallArguments_, Thread_) ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#46 0xb6df7bd0 in JavaCalls::call_virtual(JavaValue_, KlassHandle, Symbol_, Symbol_, JavaCallArguments_, Thread_) () from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#47 0xb6df7c5b in JavaCalls::call_virtual(JavaValue_, Handle, KlassHandle, Symbol_, Symbol_, Thread_) () from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#48 0xb6e30e6d in thread_entry(JavaThread_, Thread_) ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#49 0xb6fe7ad6 in JavaThread::thread_main_inner() ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#50 0xb6f109f7 in java_start(Thread*) ()
from /usr/lib/jvm/java-7-openjdk-i386/jre/lib/i386/client/libjvm.so
#51 0xb7589d4c in start_thread () from /lib/i386-linux-gnu/libpthread.so.0
---Type to continue, or q to quit---c
#52 0xb768dace in clone () from /lib/i386-linux-gnu/libc.so.6

[adam-m]

Please try with latest sleuthkit pull, should be fixed now.

[peterclemenko]

The newest commits fixed it.

adam notifications@github.com wrote:

Please try with later sleuthkit pull, should be fixed now.

---

Reply to this email directly or view it on GitHub:
#166 (comment)

Sent from my Android phone with K-9 Mail. Please excuse my brevity.