"attempt to increment a past-the-end iterator" #924

New Issue

Closed

opened 2026-10-05 04:53:23 +02:00 by adam · 6 comments

adam commented 2026-10-05 04:53:23 +02:00

Owner

Copy link

Copy source

Hey,
I'm experiencing a crash with zinc since updating to the latest version today. Before, everything worked nicely.
Here's the debug log. The only external module I had been running was playback, although it wasn't even loaded on bitlbee (which somehow always was the one right before the crash).

Any ideas? I have no idea what to make of that message.

[2019-09-25 11:16:59.489707] (manavortex/bitlbee) ZNC -> IRC [MODE &bitlbee]
[2019-09-25 11:16:59.490291] (manavortex/bitlbee) IRC -> ZNC [:ubuntu 324 manavortex &bitlbee +Ct]
/usr/include/c++/5/debug/safe_iterator.h:346:error: attempt to increment a
    past-the-end iterator.

Objects involved in the operation:
iterator "this" @ 0x0x7fffffffc170 {
type = N11__gnu_debug14_Safe_iteratorIN9__gnu_cxx17__normal_iteratorIPK7CStringNSt9__cxx19986vectorIS3_SaIS3_EEEEENSt7__debug6vectorIS3_S8_EEEE (constant iterator);
  state = past-the-end;
  references sequence with type `NSt7__debug6vectorI7CStringSaIS1_EEE' @ 0x0x7fffffffc420
}

Thread 1 "znc" received signal SIGABRT, Aborted.
0x00007ffff6054428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
54	../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt full
#0  0x00007ffff6054428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
        resultvar = 0
        pid = 11398
        selftid = 11398
#1  0x00007ffff605602a in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x7fffffffbcd0}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ffff6bdaf95 in __gnu_debug::_Error_formatter::_M_error() const () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
No symbol table info available.
#3  0x000000000071e6fa in __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<CString const*, std::__cxx1998::vector<CString, std::allocator<CString> > >, std::__debug::vector<CString, std::allocator<CString> > >::operator++ (this=0x7fffffffc170) at /usr/include/c++/5/debug/safe_iterator.h:344
        __l = {_M_device = @0x7fffffffc210}
#4  0x000000000071990e in CChan::ModeChange (this=0xb9c630, sModes=..., vsModes=std::__debug::vector of length 0, capacity 0, pOpNick=0x0) at src/Chan.cpp:392
        bList = true
        sArg = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        bNoChange = 194

        cMode = @0x7fffffffc811: 67 'C'
        a = 1
        bAdd = true
        argIter = <error reading variable argIter (Cannot access memory at address 0x0)>
#5  0x0000000000717b8d in CChan::SetModes (this=0xb9c630, modes=..., vsModeParams=std::__debug::vector of length 0, capacity 0) at src/Chan.cpp:265
No locals.
#6  0x00000000006e5ee9 in CIRCSock::OnNumericMessage (this=0xb543f0, Message=...) at src/IRCSock.cpp:770
        pChan = 0xb9c630
        sCmd = @0x7fffffffd3b8: {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "324",
          static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        sServer = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "ubuntu", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        uRaw = 324
        sNick = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "manavortex", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        bResult = false


#7  0x00000000006dd430 in CIRCSock::ReadLine (this=0xb543f0, sData=...) at src/IRCSock.cpp:213
        sLine = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = ":ubuntu 324 manavortex &bitlbee +Ct",

          static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        bReturn = false
        Message = {m_Nick = {m_sChanPerms = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "",
              static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_pNetwork = 0x0,
            m_sNick = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "ubuntu", static CaseSensitive = CaseSensitivity::CaseSensitive,
              static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_sIdent = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "",
              static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive},
            m_sHost = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive,
              static CaseInsensitive = CaseSensitivity::CaseInsensitive}},
          m_sCommand = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "324", static CaseSensitive = CaseSensitivity::CaseSensitive,
            static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_vsParams = std::__debug::vector of length 3, capacity 4 = {
            {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "manavortex", static CaseSensitive = CaseSensitivity::CaseSensitive,
              static CaseInsensitive = CaseSensitivity::CaseInsensitive}, {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "&bitlbee",
              static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive},
            {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "+Ct", static CaseSensitive = CaseSensitivity::CaseSensitive,
              static CaseInsensitive = CaseSensitivity::CaseInsensitive}},

          m_mssTags = {<std::__debug::map<CString, CString, std::less<CString>, std::allocator<std::pair<CString const, CString> > >> = std::__debug::map with 0 elements,
            _vptr.MCString = 0x80fec0 <vtable for MCString+16>,

            static EmptyMap = {<std::__debug::map<CString, CString, std::less<CString>, std::allocator<std::pair<CString const, CString> > >> = std::__debug::map with 0 elements, _vptr.MCString = 0x80fec0 <vtable for MCString+16>, static EmptyMap = <same as static member of an already seen type>}}, m_time = {tv_sec = 1569403019, tv_usec = 490421},
          m_pNetwork = 0xb3f870



, m_pClient = 0x0, m_pChan = 0x0, m_eType = CMessage::Type::Numeric, m_bColon = false}
#8  0x000000000064c657 in Csock::PushBuff (this=0xb543f0,
    data=0xc675c0 ":ubuntu 324 manavortex &bitlbee +Ct\r\nteam - Logging in: Logged in\r\n:HeroofTelemark!76561198033492586@steam JOIN &bitlbee * :Niel Nightrunner\r\n:ubuntu MODE &bitlbee +v HeroofTelemark\r\n:HeroofTelemark!7"..., len=37, bStartAtZero=false) at src/Csocket.cpp:2524
        sBuff = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = ":ubuntu 324 manavortex &bitlbee +Ct\r\n",
          static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        iFind = 36
        iStartPos = 0
#9  0x000000000064ff15 in CSocketManager::Loop (this=0xaf5d20) at src/Csocket.cpp:3613
        iLen = 4096
        cBuff = {
          m_pBuffer = 0xc675c0 ":ubuntu 324 manavortex &bitlbee +Ct\r\nteam - Logging in: Logged in\r\n:HeroofTelemark!76561198033492586@steam JOIN &bitlbee * :Niel Nightrunner\r\n:ubuntu MODE &bitlbee +v HeroofTelemark\r\n:HeroofTelemark!7"...}
        bytes = 37
        pcSock = 0xb543f0
        iErrno = CSocketManager::SUCCESS

        itSock = {first = , second = CSocketManager::SUCCESS}
        mpeSocks = std::__debug::map with 1 elements = {[0xb543f0] = CSocketManager::SUCCESS}
        iMilliNow = 1569403019489






#10 0x0000000000650352 in CSocketManager::DynamicSelectLoop (this=0xaf5d20, iLowerBounds=100000, iUpperBounds=300000000, iMaxResolution=3600) at src/Csocket.cpp:3671
No locals.
#11 0x00000000006664f2 in CZNC::Loop (this=0xaf5c20) at src/znc.cpp:252
        sError = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        eState = CZNC::ECONFIG_NOTHING
#12 0x000000000062b74a in main (argc=2, argv=0x7fffffffe518) at src/main.cpp:535
        SignalHandler = std::unique_ptr<CSignalHandler> containing 0xb93570
        iRet = 0
        sConfig = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        sDataDir = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}
        iArg = -1
        iOptIndex = -1

        bMakeConf = false
        bMakePass = false
        bAllowRoot = false
        bForeground = true
        bMakePem = false
        pZNC = 0xaf5c20
        sConfigError = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive,
          static CaseInsensitive = CaseSensitivity::CaseInsensitive}

Hey, I'm experiencing a crash with zinc since updating to the latest version today. Before, everything worked nicely. Here's the debug log. The only external module I had been running was playback, although it wasn't even loaded on bitlbee (which somehow always was the one right before the crash). Any ideas? I have no idea what to make of that message. ``` [2019-09-25 11:16:59.489707] (manavortex/bitlbee) ZNC -> IRC [MODE &bitlbee] [2019-09-25 11:16:59.490291] (manavortex/bitlbee) IRC -> ZNC [:ubuntu 324 manavortex &bitlbee +Ct] /usr/include/c++/5/debug/safe_iterator.h:346:error: attempt to increment a past-the-end iterator. Objects involved in the operation: iterator "this" @ 0x0x7fffffffc170 { type = N11__gnu_debug14_Safe_iteratorIN9__gnu_cxx17__normal_iteratorIPK7CStringNSt9__cxx19986vectorIS3_SaIS3_EEEEENSt7__debug6vectorIS3_S8_EEEE (constant iterator); state = past-the-end; references sequence with type `NSt7__debug6vectorI7CStringSaIS1_EEE' @ 0x0x7fffffffc420 } Thread 1 "znc" received signal SIGABRT, Aborted. 0x00007ffff6054428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 54 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory. (gdb) bt full #0 0x00007ffff6054428 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54 resultvar = 0 pid = 11398 selftid = 11398 #1 0x00007ffff605602a in __GI_abort () at abort.c:89 save_stage = 2 act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 0, sa_restorer = 0x7fffffffbcd0} sigs = {__val = {32, 0 <repeats 15 times>}} #2 0x00007ffff6bdaf95 in __gnu_debug::_Error_formatter::_M_error() const () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6 No symbol table info available. #3 0x000000000071e6fa in __gnu_debug::_Safe_iterator<__gnu_cxx::__normal_iterator<CString const*, std::__cxx1998::vector<CString, std::allocator<CString> > >, std::__debug::vector<CString, std::allocator<CString> > >::operator++ (this=0x7fffffffc170) at /usr/include/c++/5/debug/safe_iterator.h:344 __l = {_M_device = @0x7fffffffc210} #4 0x000000000071990e in CChan::ModeChange (this=0xb9c630, sModes=..., vsModes=std::__debug::vector of length 0, capacity 0, pOpNick=0x0) at src/Chan.cpp:392 bList = true sArg = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} bNoChange = 194 cMode = @0x7fffffffc811: 67 'C' a = 1 bAdd = true argIter = <error reading variable argIter (Cannot access memory at address 0x0)> #5 0x0000000000717b8d in CChan::SetModes (this=0xb9c630, modes=..., vsModeParams=std::__debug::vector of length 0, capacity 0) at src/Chan.cpp:265 No locals. #6 0x00000000006e5ee9 in CIRCSock::OnNumericMessage (this=0xb543f0, Message=...) at src/IRCSock.cpp:770 pChan = 0xb9c630 sCmd = @0x7fffffffd3b8: {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "324", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} sServer = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "ubuntu", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} uRaw = 324 sNick = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "manavortex", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} bResult = false #7 0x00000000006dd430 in CIRCSock::ReadLine (this=0xb543f0, sData=...) at src/IRCSock.cpp:213 sLine = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = ":ubuntu 324 manavortex &bitlbee +Ct", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} bReturn = false Message = {m_Nick = {m_sChanPerms = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_pNetwork = 0x0, m_sNick = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "ubuntu", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_sIdent = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_sHost = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}}, m_sCommand = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "324", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, m_vsParams = std::__debug::vector of length 3, capacity 4 = { {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "manavortex", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "&bitlbee", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}, {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "+Ct", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive}}, m_mssTags = {<std::__debug::map<CString, CString, std::less<CString>, std::allocator<std::pair<CString const, CString> > >> = std::__debug::map with 0 elements, _vptr.MCString = 0x80fec0 <vtable for MCString+16>, static EmptyMap = {<std::__debug::map<CString, CString, std::less<CString>, std::allocator<std::pair<CString const, CString> > >> = std::__debug::map with 0 elements, _vptr.MCString = 0x80fec0 <vtable for MCString+16>, static EmptyMap = <same as static member of an already seen type>}}, m_time = {tv_sec = 1569403019, tv_usec = 490421}, m_pNetwork = 0xb3f870 , m_pClient = 0x0, m_pChan = 0x0, m_eType = CMessage::Type::Numeric, m_bColon = false} #8 0x000000000064c657 in Csock::PushBuff (this=0xb543f0, data=0xc675c0 ":ubuntu 324 manavortex &bitlbee +Ct\r\nteam - Logging in: Logged in\r\n:HeroofTelemark!76561198033492586@steam JOIN &bitlbee * :Niel Nightrunner\r\n:ubuntu MODE &bitlbee +v HeroofTelemark\r\n:HeroofTelemark!7"..., len=37, bStartAtZero=false) at src/Csocket.cpp:2524 sBuff = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = ":ubuntu 324 manavortex &bitlbee +Ct\r\n", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} iFind = 36 iStartPos = 0 #9 0x000000000064ff15 in CSocketManager::Loop (this=0xaf5d20) at src/Csocket.cpp:3613 iLen = 4096 cBuff = { m_pBuffer = 0xc675c0 ":ubuntu 324 manavortex &bitlbee +Ct\r\nteam - Logging in: Logged in\r\n:HeroofTelemark!76561198033492586@steam JOIN &bitlbee * :Niel Nightrunner\r\n:ubuntu MODE &bitlbee +v HeroofTelemark\r\n:HeroofTelemark!7"...} bytes = 37 pcSock = 0xb543f0 iErrno = CSocketManager::SUCCESS itSock = {first = , second = CSocketManager::SUCCESS} mpeSocks = std::__debug::map with 1 elements = {[0xb543f0] = CSocketManager::SUCCESS} iMilliNow = 1569403019489 #10 0x0000000000650352 in CSocketManager::DynamicSelectLoop (this=0xaf5d20, iLowerBounds=100000, iUpperBounds=300000000, iMaxResolution=3600) at src/Csocket.cpp:3671 No locals. #11 0x00000000006664f2 in CZNC::Loop (this=0xaf5c20) at src/znc.cpp:252 sError = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} eState = CZNC::ECONFIG_NOTHING #12 0x000000000062b74a in main (argc=2, argv=0x7fffffffe518) at src/main.cpp:535 SignalHandler = std::unique_ptr<CSignalHandler> containing 0xb93570 iRet = 0 sConfig = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} sDataDir = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} iArg = -1 iOptIndex = -1 bMakeConf = false bMakePass = false bAllowRoot = false bForeground = true bMakePem = false pZNC = 0xaf5c20 sConfigError = {<std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >> = "", static CaseSensitive = CaseSensitivity::CaseSensitive, static CaseInsensitive = CaseSensitivity::CaseInsensitive} ``` <!-- github-sync-id:498165438 -->

adam closed this issue 2026-10-05 04:53:23 +02:00

adam commented 2026-10-05 04:53:24 +02:00

Author

Owner

Copy link

Copy source

[2019-09-25 11:16:59.490291] (manavortex/bitlbee) IRC -> ZNC [:ubuntu 324 manavortex &bitlbee +Ct]
[...]
#4  0x000000000071990e in CChan::ModeChange (this=0xb9c630, sModes=..., vsModes=std::__debug::vector of length 0, capacity 0, pOpNick=0x0) at src/Chan.cpp:392
[..]
        cMode = @0x7fffffffc811: 67 'C'

So... bitlbee sends a mode change with +Ct. According to CIRCSock::GetModeType, mode C has type ListArg, i.e. has an argument. However, no argument was sent. The STL debug features catch this attempt to go over the end of the argument list and aborts.

https://github.com/znc/znc/blob/7b6a5641690a56ca3f5aea00160cfa8837fa50fa/src/Chan.cpp#L389-L393

A quick look at bitlbee's source code finds the following CHANMODES value:
https://github.com/bitlbee/bitlbee/blob/0b1448f070917daf4966097a06b47fc4b2ce0c92/irc_send.c#L47

According to this, bitlbee says that all modes are a setting and never have a parameter.

Also relevant: CMODES is ntC: https://github.com/bitlbee/bitlbee/blob/0b1448f070917daf4966097a06b47fc4b2ce0c92/irc.h#L41

So, apparently ZNC is confused about the CHANMODES values of the server. No idea how this can happen, since I expect bitlbee to always send the same value (and ZNC treats unknown modes as NoArg). And a reconnect should end up with a new CIRCSock instance, so that also does not explain how things ended up in this situation.

@manavortex Are you always running ZNC under gdb or is this bug just easily reproducable for you? Could you perhaps provide some more information about how you are triggering this? Can you figure out what values bitlbee sends in its 005 numeric when znc connects to it?

(Also: The actual bug here (invalid mode change that has too few parameters for ZNC's taste) should definitely be fixed as well, I just do not understand how you hit this problem.)

``` [2019-09-25 11:16:59.490291] (manavortex/bitlbee) IRC -> ZNC [:ubuntu 324 manavortex &bitlbee +Ct] [...] #4 0x000000000071990e in CChan::ModeChange (this=0xb9c630, sModes=..., vsModes=std::__debug::vector of length 0, capacity 0, pOpNick=0x0) at src/Chan.cpp:392 [..] cMode = @0x7fffffffc811: 67 'C' ``` So... bitlbee sends a mode change with `+Ct`. According to `CIRCSock::GetModeType`, mode `C` has type `ListArg`, i.e. has an argument. However, no argument was sent. The STL debug features catch this attempt to go over the end of the argument list and aborts. https://github.com/znc/znc/blob/7b6a5641690a56ca3f5aea00160cfa8837fa50fa/src/Chan.cpp#L389-L393 A quick look at bitlbee's source code finds the following `CHANMODES` value: https://github.com/bitlbee/bitlbee/blob/0b1448f070917daf4966097a06b47fc4b2ce0c92/irc_send.c#L47 According to this, bitlbee says that all modes are a setting and never have a parameter. Also relevant: CMODES is `ntC`: https://github.com/bitlbee/bitlbee/blob/0b1448f070917daf4966097a06b47fc4b2ce0c92/irc.h#L41 So, apparently ZNC is confused about the `CHANMODES` values of the server. No idea how this can happen, since I expect bitlbee to always send the same value (and ZNC treats unknown modes as `NoArg`). And a reconnect should end up with a new `CIRCSock` instance, so that also does not explain how things ended up in this situation. @manavortex Are you always running ZNC under gdb or is this bug just easily reproducable for you? Could you perhaps provide some more information about how you are triggering this? Can you figure out what values bitlbee sends in its 005 numeric when znc connects to it? (Also: The actual bug here (invalid mode change that has too few parameters for ZNC's taste) should definitely be fixed as well, I just do not understand how you hit this problem.) <!-- github-comment-id:535076761 -->

adam commented 2026-10-05 04:53:24 +02:00

Author

Owner

Copy link

Copy source

Hey,
I've started regularly been running znc forked to the background, but since it started crashing earlier today it's now running in a screen under gdb. So far it's alive, but I also disconnected the bitlbee server network.

As in how to reproduce: I updated znc and started it with my usual config. I'm running both it and bitlbee on my own virtual box, both are up-to-date. Since my facebook plugin broke, bitlbee is just connecting to steam and discord.

Both are built from source from a checkout of the corresponding repository's master.

Tell me how to provide information, and I'll do it - the debugging info on the wiki was just about the right level of dumb for me :D

Hey, I've started regularly been running znc forked to the background, but since it started crashing earlier today it's now running in a screen under gdb. So far it's alive, but I also disconnected the bitlbee server network. As in how to reproduce: I updated znc and started it with my usual config. I'm running both it and bitlbee on my own virtual box, both are up-to-date. Since my facebook plugin broke, bitlbee is just connecting to steam and discord. Both are built from source from a checkout of the corresponding repository's master. Tell me how to provide information, and I'll do it - the debugging info on the wiki was just about the right level of dumb for me :D <!-- github-comment-id:535110093 -->

adam commented 2026-10-05 04:53:25 +02:00

Author

Owner

Copy link

Copy source

Please clarify which exact version do you mean as "latest".

Please clarify which exact version do you mean as "latest". <!-- github-comment-id:535114241 -->

adam commented 2026-10-05 04:53:26 +02:00

Author

Owner

Copy link

Copy source

znc is on commit 7b6a564169, merge branch 1.7.x, of master.
bitlbee is on commit fe122f3fa913c5bbb64f8d815b4687df44c5d422, debian/copyright: some more copyright attribution fixups

Both are built from source and up-to-date on the corresponding repo's master.

znc is on commit 7b6a5641690a56ca3f5aea00160cfa8837fa50fa, merge branch 1.7.x, of master. bitlbee is on commit fe122f3fa913c5bbb64f8d815b4687df44c5d422, debian/copyright: some more copyright attribution fixups Both are built from source and up-to-date on the corresponding repo's master. <!-- github-comment-id:535127521 -->

adam commented 2026-10-05 04:53:26 +02:00

Author

Owner

Copy link

Copy source

This looks related to #1661
@linuxdaemon

This looks related to #1661 @linuxdaemon <!-- github-comment-id:549531940 -->

adam commented 2026-10-05 04:53:27 +02:00

Author

Owner

Copy link

Copy source

Thank you :)

Thank you :) <!-- github-comment-id:550999936 -->

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

master

1.10.x

1.9.x

1.8.x

1.7.x

1.6.x

znc-1.10.3

znc-1.10.2

znc-1.10.2-rc1

znc-1.10.1

znc-1.10.1-rc1

znc-1.10.0

znc-1.10.0-rc1

znc-1.9.1

znc-1.9.0

znc-1.9.0-rc1

znc-1.8.2

znc-1.8.2-rc1

znc-1.8.1

znc-1.8.1-rc1

znc-1.8.0

znc-1.7.5

znc-1.7.5-rc1

znc-1.7.4

znc-1.7.4-rc1

znc-1.7.3

znc-1.7.3-rc1

znc-1.7.2

znc-1.7.2-rc1

znc-1.7.1

znc-1.7.1-rc1

znc-1.7.0

znc-1.6.6

znc-1.6.6-rc1

znc-1.6.5

znc-1.6.5-rc1

znc-1.6.4

znc-1.6.4-rc3

znc-1.6.4-rc2

znc-1.6.4-rc1

znc-1.6.3

znc-1.6.3-rc2

znc-1.6.3-rc1

znc-1.6.2

znc-1.6.2-rc1

znc-1.6.1

znc-1.6.1-rc1

znc-1.6.0

znc-1.4

znc-1.2

znc-1.0

znc-0.206

znc-0.204

znc-0.202

znc-0.200

znc-0.098

znc-0.096

znc-0.094

znc-0.092

znc-0.090

znc-0.080

znc-0.078

znc-0.076

znc-0.074

znc-0.072

znc-0.070

znc-0.068

znc-0.066

znc-0.064

znc-0.062

znc-0.060

znc-0.058

znc-0.056

znc-0.054

znc-0.054-rc3

znc-0.054-rc2

znc-0.054-rc1

znc-0.023

znc-0.025

znc-0.027

znc-0.028

znc-0.029

znc-0.030

znc-0.033

znc-0.034

znc-0.035

znc-0.036

znc-0.037

znc-0.038

znc-0.039

znc-0.040

znc-0.041

znc-0.043

znc-0.044

znc-0.045

znc-0.047

znc-0.050

znc-0.052

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

adam (Adam Wojcieszonek)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#924