Illegal seek (reprise)

[Aioe]

On Sunday 25 January 2004 23:11, Russ Allbery wrote:
> So you have malloc arena corruption.  Something is doing a double-free,
> overwriting memory, or otherwise breaking malloc.  Now we have to figure
> out how to track that down, and whether it's in Perl or in INN and what
> triggers it.

if i use empty perl scripts, inn crashes in the same way.
If i disable perl script (ctlinnd perl n), after a short painfull life, inn crashes again but in a different manner:

-----------------

gdb
GNU gdb 2002-04-01-cvs
Copyright 2002 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-linux".
(gdb) attach 27209
Attaching to process 27209
Reading symbols from /news/bin/innd...done.
Reading symbols from /usr/lib/libdb3.so.3...done.
Loaded symbols for /usr/lib/libdb3.so.3
Reading symbols from /usr/lib/libpython2.1.so.0.0...done.
Loaded symbols for /usr/lib/libpython2.1.so.0.0
Reading symbols from /lib/libpthread.so.0...done.
[New Thread 1024 (LWP 27209)]
Loaded symbols for /lib/libpthread.so.0
Reading symbols from /lib/libdl.so.2...done.
Loaded symbols for /lib/libdl.so.2
Reading symbols from /lib/libutil.so.1...done.
Loaded symbols for /lib/libutil.so.1
Reading symbols from /lib/libm.so.6...done.
Loaded symbols for /lib/libm.so.6
Reading symbols from /usr/lib/libperl.so.5.6...done.
Loaded symbols for /usr/lib/libperl.so.5.6
Reading symbols from /lib/libcrypt.so.1...done.
Loaded symbols for /lib/libcrypt.so.1
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /lib/ld-linux.so.2...done.
Loaded symbols for /lib/ld-linux.so.2
Reading symbols from /lib/libnss_files.so.2...done.
Loaded symbols for /lib/libnss_files.so.2
Reading symbols from /lib/libnss_compat.so.2...done.
Loaded symbols for /lib/libnss_compat.so.2
Reading symbols from /lib/libnsl.so.1...done.
Loaded symbols for /lib/libnsl.so.1
Reading symbols from /usr/lib/perl5/auto/Digest/MD5/MD5.so...done.
Loaded symbols for /usr/lib/perl5/auto/Digest/MD5/MD5.so
Reading symbols from /usr/lib/perl/5.6.1/auto/Data/Dumper/Dumper.so...done.
Loaded symbols for /usr/lib/perl/5.6.1/auto/Data/Dumper/Dumper.so
Reading symbols from /usr/lib/perl/5.6.1/auto/IO/IO.so...done.
Loaded symbols for /usr/lib/perl/5.6.1/auto/IO/IO.so
Reading symbols from /usr/lib/perl/5.6.1/auto/Fcntl/Fcntl.so...done.
Loaded symbols for /usr/lib/perl/5.6.1/auto/Fcntl/Fcntl.so
Reading symbols from /usr/lib/python2.1/lib-dynload/strop.so...done.
Loaded symbols for /usr/lib/python2.1/lib-dynload/strop.so
0x4034e7ee in select () from /lib/libc.so.6
(gdb) cont
Continuing.

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1024 (LWP 27209)]
0x402f221f in malloc () from /lib/libc.so.6
(gdb) bt
#0  0x402f221f in malloc () from /lib/libc.so.6
#1  0x402f2074 in malloc () from /lib/libc.so.6
#2  0x08090e23 in x_malloc (size=19, file=0x809a3f1 "interface.c", line=648) at xmalloc.c:74
#3  0x0806d6ab in MatchGroups (
    g=0x8313255 "it.sport.nuoto:111\r\ni:106\r\n\r\ni:26\r\n15\r\n36\r\nio.genoa:193\r\nura.filosofia:1891\r\n.\bà\025,\b·à¼'0ï.\bàë.\b6iÁ_¸Å,\b\030]\n\b", len=18, pattern=0x8102de8 "it.*", exactmatch=false) at interface.c:648
#4  0x0806d810 in SMgetsub (article=
      {type = 188 '¼', data = 0x808fd00 "\211¡\020X\n\b\211P\004\215eè[^ÉÃ\215v", iov = 0xbffff4f8, iovcnt = 5, len = 2384, nextmethod = 97 'a', private = 0x81029d8, arrived = 0, expires = 0, groups = 0x8313255 "it.sport.nuoto:111\r\ni:106\r\n\r\ni:26\r\n15\r\n36\r\nio.genoa:193\r\nura.filosofia:1891\r\n.\bà\025,\b·à¼'0ï.\bàë.\b6iÁ_¸Å,\b\030]\n\b", groupslen = 18, token = 0x0}) at interface.c:691
#5  0x0806d8a9 in SMstore (article=
      {type = 188 '¼', data = 0x808fd00 "\211¡\020X\n\b\211P\004\215eè[^ÉÃ\215v", iov = 0xbffff4f8, iovcnt = 5, len = 2384, nextmethod = 97 'a', private = 0x81029d8, arrived = 0, expires = 0, groups = 0x8313255 "it.sport.nuoto:111\r\ni:106\r\n\r\ni:26\r\n15\r\n36\r\nio.genoa:193\r\nura.filosofia:1891\r\n.\bà\025,\b·à¼'0ï.\bàë.\b6iÁ_¸Å,\b\030]\n\b", groupslen = 18, token = 0x0}) at interface.c:717
#6  0x0805242f in ARTstore (cp=0x413e62dc) at art.c:530
#7  0x0805590e in ARTpost (cp=0x413e62dc) at art.c:2287
#8  0x0805da24 in NCpostit (cp=0x413e62dc) at nc.c:196
#9  0x0805f255 in NCproc (cp=0x413e62dc) at nc.c:985
#10 0x0805f9cf in NCreader (cp=0x413e62dc) at nc.c:1188
#11 0x0805adbc in CHANreadloop () at chan.c:1062
---Type <return> to continue, or q <return> to quit---
#12 0x0805cf14 in main (ac=4, av=0xbffffea4) at innd.c:666
(gdb)

------------------------

if i compile inn without perl support, innd accepts all messages without troubles.

> Could you send us a copy of the article that triggers the crash?  

it's difficult for me. 
There isn't in my spool an article with a crosspost like 
"it.sport.nuoto [it.sport.calc]io.genoa [it.cult]ura.filosofia" (it seems really crazy); the article number 111 in it.sport.nuoto doesn't exist.
I'm searching in my spool for the exact cunbatch file who makes crashes. 
When INN works wrong, _every_ article i feed inside make a crash like this.
When INN works well,  it accepts all articles as usual. The only way to recover INN is a complete reinstallation. 


greetings