[sane-devel] Scanimage Segmentation fault : sane_get_option_descriptor(handle=..., option=5)

[Olaf Meeuwissen]

Hi,

moo can writes:

> Dear SANE Developers,
> I'm encountering some trouble with a Brother ADS-2800W (https://support.brother.com/g/b/spec.aspx?c=us&lang=en&prod=ads2800w_all). This scanner is using the brother5 driver (1.1.0-0 08/30/2018) provided by Brother.
>
> The problem was revealed following the use of gscan2pdf. At launch of gscan2pdf I have the following error: "Error retreiving scanner options: error getting option 5: invalid argument". You can find the related bug thread (https://sourceforge.net/p/gscan2pdf/bugs/313/) that I have with Jeffrey Ratcliffe (The developer of gscan2pdf).

I've scanned the bug thread and noted that you have contacted Brother.
Good!

>  the problem is also revealed with scanimage. Using the following command line "scanimage -d 'brother5:net1:dev0' -h" which is ending with a [dll] sane_get_option_descriptor(handle=0x55e07b804410,option=5) Segmentation fault
> You can find some details in the following attachments:- sane-scanimage.help.dll128.trace.txt
> - sane-scanimage.gdb.backtrace.txt
> - sane-xscanimage.gdb.backtrace.txt- brsaneconfig5-diagnostics.txt
>
> [... snip ...]
>
> What is not working:- scanimage -d 'brother5:net1:dev0' -h => [dll] sane_get_option_descriptor(handle=0x55e07b804410,option=5) Segmentation fault- gscan2pdf => Error retreiving scanner options: error getting option 5: invalid argument
>
>  I do not know what's behind this option 5.

> sysadmin at eita:~$ SANE_DEBUG_DLL=128 scanimage -h -d 'brother5:net1:dev0'
> [sanei_debug] Setting debug level of dll to 128.
> [... snip ...]
> [dll] init: backend `brother5' is version 1.0.1
> [dll] sane_open: open successful
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=0)
> [dll] sane_control_option(handle=0x55ba52d24150,option=0,action=0,value=0x7fff70df7c7c,info=(nil))
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=0)
> [dll] sane_control_option(handle=0x55ba52d24150,option=0,action=0,value=0x7fff70df7b80,info=(nil))
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=1)
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=2)
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=3)
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=4)
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=5)
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=6)

So sane_get_option_descriptor() with option=5 returns okay.

> [...]
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=4)
> [dll] sane_control_option(handle=0x55ba52d24150,option=4,action=0,value=0x7fff70df7ad0,info=(nil))
>     --source Automatic Document Feeder(left aligned)|Automatic Document Feeder(center aligned)|Automatic Document Feeder(left aligned,Duplex)|Automatic Document Feeder(center aligned,Duplex) [Automatic Document Feeder(left aligned)]
>         Selects the scan source (such as a document-feeder).
> [dll] sane_get_option_descriptor(handle=0x55ba52d24150,option=5)
> Segmentation fault

but trying to use its return value triggers a segfault.  The scanimage
code exits with an error if the return value is NULL.  For a non-NULL
value it starts accessing the SANE_Option_Descriptor fields.

I am pretty sure that that's were the segfault happens.  If not, I'd
expect a sane_get_option_descriptor() call fro option=6 to be logged.
So, it very much looks like the third-party, non-free Brother backend
returns a bad SANE_Option_Descriptor.

Perhaps you can check in the debugger what gets returned but this is
something that only Brother can fix for you.

Hope this helps,
--
Olaf Meeuwissen, LPIC-2            FSF Associate Member since 2004-01-27
 GnuPG key: F84A2DD9/B3C0 2F47 EA19 64F4 9F13  F43E B8A4 A88A F84A 2DD9
 Support Free Software                        https://my.fsf.org/donate
 Join the Free Software Foundation              https://my.fsf.org/join