socket_connect_addr crash

[AiXanadu]

0 libsystem_kernel.dylib 0x00007fff92875d42 __pthread_kill + 10
1 libsystem_pthread.dylib 0x00007fff92963457 pthread_kill + 90
2 libsystem_c.dylib 0x00007fff927db4bb __abort + 140
3 libsystem_c.dylib 0x00007fff927dbd7e __stack_chk_fail + 205
4 libimobiledevice-glue-1.0.0.dylib 0x000000011cd252f7 socket_connect_addr + 1607
5 libimobiledevice-1.0.6.dylib 0x000000011ccdcc34 idevice_connect + 308 (idevice.c:517)
6 libimobiledevice-1.0.6.dylib 0x000000011ccdd6e6 service_client_new + 70 (service.c:68)
7 libimobiledevice-1.0.6.dylib 0x000000011ccddae3 property_list_service_client_new + 67 (property_list_service.c:67)
8 libimobiledevice-1.0.6.dylib 0x000000011ccdf2f5 lockdownd_client_new_with_handshake + 101 (lockdown.c:634)

When I try to start the service "com.apple.springboardservices" on the Mac, I occasionally crash.
I use this service to get screen wallpaper.
I try to search for solutions, mostly stack overflow.
It takes about dozens of times to have a crash.

[AiXanadu]

With the same code, I haven't found this problem on the USB device yet. at present, only WiFi devices will appear.

[mexmer]

if it's happens only on wifi, issue might be, that device when to sleep just in time of query ... and socket you trying connect to was released just before you called connect on it .... question is, if anything can be done in connect function to prevent this, or it's just unhandled condition inside apple implementation.

[AiXanadu]

bool device_desktop_wallpaper(idevice_t _Device, const std::function<void(const XByteArray& _Picture)>& _Lambda) noexcept
{
	auto		vSync = false;
	auto		vPictureBytes = XByteArray();
	auto		vLockdownd = static_cast<lockdownd_client_t>(nullptr);
	auto		vService = static_cast<lockdownd_service_descriptor_t>(nullptr);
	auto		vSpringBoard = static_cast<sbservices_client_t>(nullptr);
	auto		vErrorL = lockdownd_client_new_with_handshake(_Device, &vLockdownd, "device_desktop_wallpaper");
	if(vErrorL != LOCKDOWN_E_SUCCESS)
	{
		return false;
	}

	do
	{
	
		if(lockdownd_start_service(vLockdownd, "com.apple.springboardservices", &vService) == LOCKDOWN_E_SUCCESS)
		{
			if(sbservices_client_new(_Device, vService, &vSpringBoard) != SBSERVICES_E_SUCCESS)
			{
				vSpringBoard = nullptr;
			}
			lockdownd_service_descriptor_free(vService);
		}
		if(vSpringBoard == nullptr)
		{
			break;
		}

		auto		vPictureData = static_cast<char*>(nullptr);
		auto		vPictureLength = static_cast<std::uint64_t>(0);
		if(sbservices_get_home_screen_wallpaper_pngdata(vSpringBoard, &vPictureData, &vPictureLength) != SBSERVICES_E_SUCCESS)
		{
			break;
		}
		if(vPictureData == nullptr && vPictureLength == 0)
		{
			break;
		}
		vPictureBytes = XByteArray(vPictureData, (std::size_t)vPictureLength);
		sbservices_get_home_screen_wallpaper_free(vPictureData);
		vSync = true;
	}while(false);

	if(vSync)
	{
		_Lambda(vPictureBytes);
		vSync = true;
	}
	
	if(vSpringBoard)
	{
		sbservices_client_free(vSpringBoard);
	}
	if(vLockdownd)
	{
		lockdownd_client_free(vLockdownd);
	}
	return vSync;
}

I just call it in separate threads and functions, and there is no multithreading.

It may also be in windows, but I use SEH to handle it.

template <class Fun, class ... T>
afc_error_t FunctionCallAfc(Fun _Call, T... vT)
{
	auto		vReturn = AFC_E_INVALID_ARG;
	if(_Call)
	{
#if defined(_XANADU_SYSTEM_WINDOWS)
		__try
		{
			vReturn = _Call(vT...);
		}
		__except(EXCEPTION_EXECUTE_HANDLER)
		{
			//ExceptionNormal(vFile, vFunc, vLine);
		}
#else
		try
		{
			vReturn = _Call(vT...);
		}
		catch(...)
		{
		}
#endif
	}
	return vReturn;
}

This can help me deal with most exceptions.

[nikias]

Looks like stack corruption. I wonder how that would happen...

[AiXanadu]

Looks like stack corruption. I wonder how that would happen...

It is described above.
Specifically, when connecting to a WIFI device and running the above code, there is a chance that this problem will occur.

[N4RUTOP]

I encountered the same issue, and after debugging, I found that the crash was caused by releasing a dangling pointer. Specifically, it happened at socket.c: 606 free(ifa->ifa_dstaddr);. The problem was solved by calling memset after allocating memory for the struct ifaddrs.

[nikias]

Should be fixed with 1085e46.