Sentry Native Android SDK Crashing - sentry__string_eq Unhandled Segfault about sentry-native HOT 4 OPEN

from sentry-native.

Hi, thanks for the report. I can gather from the stack trace that this must have been in a sentry-android version that came bundled with sentry-native < 0.6.2. The segfault comes from passing NULL to strcmp() inside sentry__string_eq().

Adding ptr/len interfaces to the API, I rewrote many string functions and specifically added early checks for NULLs. Especially the code in sentry_value_set_by_key() has been made safer. This was released with sentry-android 6.19.0.

from sentry-native.

is the suggestion to upgrade to 6.19.0? If so, what is the the new expected behavior? So I can communicate back to the customer.

For example:

1. upgrade to 6.19.0
2. the sdk should not error on itself anymore, therefore no event for sending to Sentry.io.
3. or
4. upgrade to 6.19.0
5. the sdk might still error on itself, but the event will not get sent to Sentry.io? the sdk will fail more silently this time?

from sentry-native.

I would always recommend upgrading if there seems to be a bug in an SDK because we do not maintain separate release branches, so even if there is still an issue in the latest release, I can only supply a fix on top of that. Going deeper, this stack trace is probably from version 0.4.18 of the Native SDK, released over a year ago (and packaged with sentry-android 6.3.1).

The crash in the Native SDK is probably caused by the same memory corruption which caused the application to crash in the first place. We can make sure that we don't crash in that particular situation. However, the resulting crash event will still be affected by that. The stack trace shows that the segfault occurs when setting the event_id of the crash-event, meaning that either the constant string "event_id" is NULL or that the event internal structure has been corrupted, leaving us to try to iterate over non-existent key/value pairs of a fresh object (which has no entries yet).

What I mean by that: fingers crossed that we can send a halfway decent crash report in that case. Understanding how that situation is possible would be interesting, but I cannot gather that from the stack trace. Maybe @Swatinem can look at the event and check if he sees something relevant.

from sentry-native.