View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0000712 | LDMud 3.3 | Runtime | public | 2010-01-17 14:43 | 2011-02-23 22:22 |
| Reporter | zesstra | Assigned To | zesstra | ||
| Priority | normal | Severity | crash | Reproducibility | have not tried |
| Status | resolved | Resolution | fixed | ||
| Platform | x86_64 | OS | MacOS X | OS Version | 10.5.x |
| Target Version | 3.3.720 | Fixed in Version | 3.3.720 | ||
| Summary | 0000712: get_type_info(<closure>, 4) looses refcount to function name of <closures> | ||||
| Description | I had some crashes in my homemud, illegal svalues ((free_svalue) Illegal svalue 0x102afe460 type 188909664) and a segmentation fault in save_string(). It occurred while moving test players automatically through the lib. I have core dumps for 2 different crashes (although I think they are related). (I will post all data into 'Additional Information', so that they are not mailed around with every change of this issue.) I can provoke the issue quite reliably, but right now I need the complete MG mublib for it. The cores are both around 550 MB large. *sigh* Actually... I just notice: both core dumps have _exactly_ the same size: 557469696. -r-------- 1 dsch dsch 557469696 18 Jan 16:36 core.27855 -r-------- 1 dsch dsch 557469696 18 Jan 20:32 core.31337 I don't believe in coindidence here... | ||||
| Additional Information | First crash: =========== #0 0x00000001000d178d in dump_core () at simulate.c:587 587 *((char*)0) = 0/a; (gdb) bt #0 0x00000001000d178d in dump_core () at simulate.c:587 0000001 0x00000001000d16bf in fatal (fmt=Could not find the frame base for "fatal". ) at simulate.c:649 0000002 0x000000010004e578 in int_free_svalue (v=0x102afe460) at interpret.c:1129 0000003 0x000000010004e87f in free_svalue (v=0x102afe460) at interpret.c:1292 0000004 0x00000001000869aa in free_map_chain (m=0x10fa12268, mch=0x102afe458, no_data=false) at mapping.c:371 0000005 0x0000000100086910 in _free_mapping (m=0x10fa12268, no_data=false) at mapping.c:668 0000006 0x000000010004f6c6 in inl_transfer_svalue (dest=0x108bf2548, v=0x10016dcf0) at interpret.c:2036 0000007 0x0000000100059cfd in eval_instruction (first_instruction=0x1035175e4 "a\004\002?\003<&\b?\002", initial_sp=0x10016da60) at interpret.c:10214 0000008 0x000000010006d778 in apply_low (fun=0x102b3a4b8, ob=0x105920298, num_arg=4, b_ign_prot=false, allowRefs=false) at interpret.c:17052 0000009 0x000000010006de58 in int_apply (fun=0x102b3a4b8, ob=0x105920298, num_arg=4, b_ign_prot=false, b_use_default=true) at interpret.c:17246 0000010 0x0000000100068dc0 in eval_instruction (first_instruction=0x102f26704 "\b\t\002\017/k\001\031\002\017\022\002*x\t)b\036", initial_sp=0x10016d940) at interpret.c:16510 0000011 0x000000010006d778 in apply_low (fun=0x102c7ccc0, ob=0x104b48c70, num_arg=1, b_ign_prot=false, allowRefs=false) at interpret.c:17052 0000012 0x000000010006de58 in int_apply (fun=0x102c7ccc0, ob=0x104b48c70, num_arg=1, b_ign_prot=false, b_use_default=true) at interpret.c:17246 0000013 0x0000000100068dc0 in eval_instruction (first_instruction=0x102f07bec "a\005\v\036", initial_sp=0x10016d820) at interpret.c:16510 #14 0x000000010006d778 in apply_low (fun=0x102ae8520, ob=0x105920298, num_arg=2, b_ign_prot=false, allowRefs=false) at interpret.c:17052 #15 0x000000010006de58 in int_apply (fun=0x102ae8520, ob=0x105920298, num_arg=2, b_ign_prot=false, b_use_default=true) at interpret.c:17246 #16 0x0000000100068dc0 in eval_instruction (first_instruction=0x1058f453f "b\036\004\n\006\036", initial_sp=0x10016d6e0) at interpret.c:16510 #17 0x00000001000d10a0 in catch_instruction (flags=6, offset=15, i_sp=0x100bf3710, i_pc=0x1058f453f "b\036\004\n\006\036", i_fp=0x10016d650, reserve_cost=100000, i_context=0x0) at simulate.c:449 #18 0x0000000100058b17 in eval_instruction (first_instruction=0x1058f480c "a\001\002\022\n\016`?\026", initial_sp=0x10016d5f0) at interpret.c:9721 #19 0x000000010006facb in int_call_lambda (lsvp=0x10c3ec188, num_arg=1, allowRefs=false, external=true) at interpret.c:18143 #20 0x00000001000d8cd1 in execute_callback (cb=0x10c3ec188, nargs=0, keep=false, toplevel=true) at simulate.c:4067 #21 0x0000000100011bd0 in call_out () at call_out.c:441 #22 0x000000010000d500 in backend () at backend.c:733 #23 0x0000000100082ae3 in main (argc=2, argv=0x7fff5fbff850) at main.c:673 Last operations + LPC stack: 2010.01.18 20:32:26 (free_svalue) Illegal svalue 0x102afe460 type 188909664 2010.01.18 20:32:26 Current object was human:teutates human:teutates std/thing/properties.c line 207 0x102db92bf: 107 branch_when_zero (1:132) line 207 0x102db9306: 98 save_arg_frame (0:131) line 236 0x102db9307: 125 2 push_local_variable_lvalue (1:132) 0x102db9309: 208 this_object (2:133) 0x102db930a: 10 3 cstring0 (3:134) 0x102db930c: 30 0 local (4:135) 0x102db930e: 42 + (5:136) 0x102db930f: 414 8 call_resolved (4:135) 0x102db9311: 99 restore_arg_frame (2:133) 0x102db9312: 107 402791939 branch_when_zero (1:132) 0x102db9317: 8 0 identifier (0:131) line 240 0x102db9319: 15 const0 (1:132) 0x102db931a: 61 index (2:133) 0x102db931b: 30 0 local (1:132) 0x102db931d: 61 index (2:133) 0x102db931e: 24 return (1:132) human:teutates std/player/life.c line 666 0x103531712: 99 restore_arg_frame (23:128) line 666 0x103531713: 10 21 cstring0 (22:127) line 667 0x103531715: 98 save_arg_frame (23:128) 0x103531716: 10 21 cstring0 (24:129) 0x103531718: 111 call_function (25:130) human:teutates std/thing/properties.c line 199 0x102db92ac: 97 513 clear_locals (0:133) line 199 0x102db92af: 208 this_object (0:133) line 203 0x102db92b0: 198 objectp (1:134) 0x102db92b1: 108 6401 branch_when_non_zero (1:134) 0x102db92b4: 8 0 identifier (0:133) line 207 0x102db92b6: 18 3 clit (1:134) 0x102db92b8: 61 index (2:135) 0x102db92b9: 30 0 local (1:134) 0x102db92bb: 61 index (2:135) 0x102db92bc: 125 1 push_local_variable_lvalue (1:134) 0x102db92be: 40 = (2:135) 0x102db92bf: 107 branch_when_zero (1:134) 0x102db9306: 98 save_arg_frame (0:133) line 236 0x102db9307: 125 2 push_local_variable_lvalue (1:134) 0x102db9309: 208 this_object (2:135) 0x102db930a: 10 3 cstring0 (3:136) 0x102db930c: 30 0 local (4:137) 0x102db930e: 42 + (5:138) 0x102db930f: 414 8 call_resolved (4:137) 0x102db9311: 99 restore_arg_frame (2:135) 0x102db9312: 107 402791939 branch_when_zero (1:134) 0x102db9317: 8 0 identifier (0:133) line 240 0x102db9319: 15 const0 (1:134) 0x102db931a: 61 index (2:135) 0x102db931b: 30 0 local (1:134) 0x102db931d: 61 index (2:135) 0x102db931e: 24 return (1:134) human:teutates std/player/life.c line 667 0x10353171b: 99 restore_arg_frame (25:130) line 667 0x10353171c: 10 48 cstring0 (24:129) line 668 0x10353171e: 98 save_arg_frame (25:130) 0x10353171f: 10 48 cstring0 (26:131) 0x103531721: 111 call_function (27:132) human:teutates std/thing/properties.c line 199 0x102db92ac: 97 513 clear_locals (0:135) line 199 0x102db92af: 208 this_object (0:135) line 203 0x102db92b0: 198 objectp (1:136) 0x102db92b1: 108 6401 branch_when_non_zero (1:136) 0x102db92b4: 8 0 identifier (0:135) line 207 0x102db92b6: 18 3 clit (1:136) 0x102db92b8: 61 index (2:137) 0x102db92b9: 30 0 local (1:136) 0x102db92bb: 61 index (2:137) 0x102db92bc: 125 1 push_local_variable_lvalue (1:136) 0x102db92be: 40 = (2:137) 0x102db92bf: 107 branch_when_zero (1:136) 0x102db9306: 98 save_arg_frame (0:135) line 236 0x102db9307: 125 2 push_local_variable_lvalue (1:136) 0x102db9309: 208 this_object (2:137) 0x102db930a: 10 3 cstring0 (3:138) 0x102db930c: 30 0 local (4:139) 0x102db930e: 42 + (5:140) 0x102db930f: 414 8 call_resolved (4:139) 0x102db9311: 99 restore_arg_frame (2:137) 0x102db9312: 107 402791939 branch_when_zero (1:136) 0x102db9317: 8 0 identifier (0:135) line 240 0x102db9319: 15 const0 (1:136) 0x102db931a: 61 index (2:137) 0x102db931b: 30 0 local (1:136) 0x102db931d: 61 index (2:137) 0x102db931e: 24 return (1:136) human:teutates std/player/life.c line 668 0x103531724: 99 restore_arg_frame (27:132) line 668 0x103531725: 10 3 cstring0 (26:131) line 669 0x103531727: 98 save_arg_frame (27:132) 0x103531728: 10 3 cstring0 (28:133) 0x10353172a: 111 call_function (29:134) human:teutates std/thing/properties.c line 199 0x102db92ac: 97 513 clear_locals (0:137) line 199 0x102db92af: 208 this_object (0:137) line 203 0x102db92b0: 198 objectp (1:138) 0x102db92b1: 108 6401 branch_when_non_zero (1:138) 0x102db92b4: 8 0 identifier (0:137) line 207 0x102db92b6: 18 3 clit (1:138) 0x102db92b8: 61 index (2:139) 0x102db92b9: 30 0 local (1:138) 0x102db92bb: 61 index (2:139) 0x102db92bc: 125 1 push_local_variable_lvalue (1:138) 0x102db92be: 40 = (2:139) 0x102db92bf: 107 branch_when_zero (1:138) 0x102db9306: 98 save_arg_frame (0:137) line 236 0x102db9307: 125 2 push_local_variable_lvalue (1:138) 0x102db9309: 208 this_object (2:139) 0x102db930a: 10 3 cstring0 (3:140) 0x102db930c: 30 0 local (4:141) 0x102db930e: 42 + (5:142) 0x102db930f: 414 8 call_resolved (4:141) 0x102db9311: 99 restore_arg_frame (2:139) 0x102db9312: 107 402791939 branch_when_zero (1:138) 0x102db9317: 8 0 identifier (0:137) line 240 0x102db9319: 15 const0 (1:138) 0x102db931a: 61 index (2:139) 0x102db931b: 30 0 local (1:138) 0x102db931d: 61 index (2:139) 0x102db931e: 24 return (1:138) human:teutates std/player/life.c line 669 0x10353172d: 99 restore_arg_frame (29:134) line 669 0x10353172e: 170 269 m_caggregate (28:133) line 670 0x103531731: 111 call_function (3:108) human:teutates std/thing/properties.c line 146 0x102db91fc: 97 514 clear_locals (0:111) line 146 0x102db91ff: 208 this_object (0:111) line 150 0x102db9200: 198 objectp (1:112) 0x102db9201: 108 6401 branch_when_non_zero (1:112) 0x102db9204: 8 0 identifier (0:111) line 154 0x102db9206: 16 const1 (1:112) 0x102db9207: 61 index (2:113) 0x102db9208: 30 0 local (1:112) 0x102db920a: 61 index (2:113) 0x102db920b: 14 number (1:112) 0x102db9214: 54 & (2:113) 0x102db9215: 107 branch_when_zero (1:112) 0x102db9219: 8 0 identifier (0:111) line 157 0x102db921b: 18 2 clit (1:112) 0x102db921d: 61 index (2:113) 0x102db921e: 30 0 local (1:112) 0x102db9220: 61 index (2:113) 0x102db9221: 125 2 push_local_variable_lvalue (1:112) 0x102db9223: 40 = (2:113) 0x102db9224: 107 branch_when_zero (1:112) 0x102db926f: 98 save_arg_frame (0:111) line 188 0x102db9270: 125 3 push_local_variable_lvalue (1:112) 0x102db9272: 208 this_object (2:113) 0x102db9273: 10 2 cstring0 (3:114) 0x102db9275: 30 0 local (4:115) 0x102db9277: 42 + (5:116) 0x102db9278: 30 1 local (4:115) 0x102db927a: 414 8 call_resolved (5:116) 0x102db927c: 99 restore_arg_frame (2:113) 0x102db927d: 107 402857475 branch_when_zero (1:112) 0x102db9282: 98 save_arg_frame (0:111) line 192 0x102db9283: 30 0 local (1:112) 0x102db9285: 30 1 local (2:113) 0x102db9287: 15 const0 (3:114) 0x102db9288: 192 extern_call (4:115) 0x102db9289: 111 call_function (5:116) 0x102db8fec: 208 this_object (0:117) line 73 0x102db8fed: 198 objectp (1:118) 0x102db8fee: 108 6401 branch_when_non_zero (1:118) 0x102db8ff1: 8 0 identifier (0:117) line 78 0x102db8ff3: 16 const1 (1:118) 0x102db8ff4: 61 index (2:119) 0x102db8ff5: 30 0 local (1:118) 0x102db8ff7: 61 index (2:119) 0x102db8ff8: 18 128 clit (1:118) 0x102db8ffa: 14 number (2:119) 0x102db9003: 55 | (3:120) 0x102db9004: 54 & (2:119) 0x102db9005: 38 && (1:118) 0x102db9010: 38 886091011 && (1:118) line 79 0x102db9015: 38 && (1:118) line 80 0x102db901d: 107 branch_when_zero (1:118) 0x102db9021: 8 0 identifier (0:117) line 84 0x102db9023: 16 const1 (1:118) 0x102db9024: 61 index (2:119) 0x102db9025: 30 0 local (1:118) 0x102db9027: 61 index (2:119) 0x102db9028: 14 number (1:118) 0x102db9031: 54 & (2:119) 0x102db9032: 38 && (1:118) 0x102db903f: 38 && (1:118) line 85 0x102db904d: 107 402789123 branch_when_zero (1:118) 0x102db9052: 30 2 local (0:117) line 89 0x102db9054: 16 const1 (1:118) 0x102db9055: 51 == (2:119) 0x102db9056: 39 5 || (1:118) 0x102db9058: 30 2 local (0:117) 0x102db905a: 18 4 clit (1:118) 0x102db905c: 51 == (2:119) 0x102db905d: 38 && (1:118) 0x102db906b: 38 && (1:118) 0x102db9076: 38 886091011 && (1:118) line 90 0x102db907b: 38 && (1:118) line 91 0x102db9083: 107 402854659 branch_when_zero (1:118) 0x102db9088: 30 2 local (0:117) line 94 0x102db908a: 28 switch (1:118) 0x102db914a: 30 1 local (0:117) line 127 0x102db914c: 108 branch_when_non_zero (1:118) 0x102db915c: 30 1 local (0:117) line 128 0x102db915e: 30 0 local (1:118) 0x102db9160: 8 0 identifier (2:119) 0x102db9162: 30 2 local (3:120) 0x102db9164: 126 push_indexed_lvalue (4:121) 0x102db9165: 130 index_lvalue (3:120) 0x102db9166: 41 (void)= (2:119) line 129 0x102db9167: 27 0 191 0 130 1 0 0 338 ' CheckBPs' in 'd/erzmagier/zesstra/tools/libtester/libtester.c' ('d/erzmagier/zesstra/tools/libtester/libtester') line 224 52892 ' bewege' in 'd/erzmagier/zesstra/tools/libtester/libtester.c' ('d/erzmagier/zesstra/tools/libtester/libtester') line 101 152898 ' CATCH' in ('d/erzmagier/zesstra/tools/libtester/libtester') 162795 ' move' in ' std/living/moving.c' (' human:teutates') line 393 165263 ' NotifyMove' in ' std/player/moving.c' (' human:teutates') line 152 165270 ' NotifyMove' in ' std/living/moving.c' (' human:teutates') line 158 165768 ' InitAttack' in ' std/living/combat.c' (' human:teutates') line 2054 165780 ' Attack2' in ' std/living/combat.c' ('d/gebirge/morgoth/drak/npc/baaz#474') line 572 170777 ' Attack' in ' std/living/combat.c' ('d/gebirge/morgoth/drak/npc/baaz#474') line 870 170885 ' Defend' in ' std/player/combat.c' (' human:teutates') line 157 175178 ' Defend' in ' std/living/combat.c' (' human:teutates') line 1559 175598 ' do_damage' in ' std/player/life.c' (' human:teutates') line 273 176035 ' ' in ' std/player/life.c' (' human:teutates') line 670 176071 ' SetProp' in 'std/thing/properties.c' (' human:teutates') line 192 176120 ' Set' in 'std/thing/properties.c' (' human:teutates') line 129 2010.01.18 20:32:26 LDMud aborting on fatal error. Floating point exception (core dumped) Second crash: ============ #0 0x000000010009dd92 in save_string (src=0x102afe458) at object.c:5723 5723 c = *cp++; (gdb) bt #0 0x000000010009dd92 in save_string (src=0x102afe458) at object.c:5723 0000001 0x000000010009f3c4 in save_svalue (v=0x102c82490, delimiter=44 ',', writable=false) at object.c:6235 0000002 0x000000010009e2c3 in save_array (v=0x102c82460) at object.c:5838 0000003 0x000000010009f48d in save_svalue (v=0x102c5b9c0, delimiter=44 ',', writable=false) at object.c:6252 0000004 0x000000010009e2c3 in save_array (v=0x102c5b940) at object.c:5838 0000005 0x000000010009f48d in save_svalue (v=0x102b170d8, delimiter=44 ',', writable=false) at object.c:6252 0000006 0x000000010009df74 in save_mapping_filter (key=0x102b170c8, data=0x102b170e8, extra=0x1) at object.c:5763 0000007 0x00000001000890d9 in walk_mapping (m=0x102bafa50, func=0x10009df00 <save_mapping_filter>, extra=0x1) at mapping.c:2022 0000008 0x000000010009e060 in save_mapping (m=0x102bafa50) at object.c:5790 0000009 0x000000010009f6b1 in save_svalue (v=0x102b17490, delimiter=44 ',', writable=false) at object.c:6303 0000010 0x000000010009df74 in save_mapping_filter (key=0x102b17480, data=0x102b174a0, extra=0x1) at object.c:5763 0000011 0x00000001000890d9 in walk_mapping (m=0x102bafae0, func=0x10009df00 <save_mapping_filter>, extra=0x1) at mapping.c:2022 0000012 0x000000010009e060 in save_mapping (m=0x102bafae0) at object.c:5790 0000013 0x000000010009f6b1 in save_svalue (v=0x102b174c8, delimiter=44 ',', writable=false) at object.c:6303 #14 0x000000010009df74 in save_mapping_filter (key=0x102b174b8, data=0x102b174d8, extra=0x1) at object.c:5763 #15 0x00000001000890d9 in walk_mapping (m=0x102bb1868, func=0x10009df00 <save_mapping_filter>, extra=0x1) at mapping.c:2022 #16 0x000000010009e060 in save_mapping (m=0x102bb1868) at object.c:5790 #17 0x000000010009f6b1 in save_svalue (v=0x102bb81a8, delimiter=44 ',', writable=false) at object.c:6303 #18 0x000000010009df74 in save_mapping_filter (key=0x102bb8198, data=0x102bb81b8, extra=0x1) at object.c:5763 #19 0x00000001000890d9 in walk_mapping (m=0x102bb18b0, func=0x10009df00 <save_mapping_filter>, extra=0x1) at mapping.c:2022 #20 0x000000010009e060 in save_mapping (m=0x102bb18b0) at object.c:5790 #21 0x000000010009f6b1 in save_svalue (v=0x102b3f868, delimiter=10 '\n', writable=false) at object.c:6303 #22 0x00000001000a0547 in v_save_object (sp=0x10016d620, numarg=1) at object.c:6805 #23 0x0000000100056cc9 in eval_instruction (first_instruction=0x7fff5fbfccd0 "\a3\030?\002", initial_sp=0x10016d620) at interpret.c:8478 #24 0x00000001000705b0 in int_call_lambda (lsvp=0x10016d600, num_arg=2, allowRefs=false, external=true) at interpret.c:18423 #25 0x0000000100074b2d in v_funcall (sp=0x10016d620, num_arg=3) at interpret.c:20695 #26 0x0000000100056cc9 in eval_instruction (first_instruction=0x102c6730c "a\001\005\036", initial_sp=0x10016d5e0) at interpret.c:8478 #27 0x00000001000662ae in eval_instruction (first_instruction=0x102b434ac "\n'?-", initial_sp=0x10016d580) at interpret.c:15039 #28 0x000000010006d778 in apply_low (fun=0x102ae8670, ob=0x102a94e68, num_arg=0, b_ign_prot=false, allowRefs=false) at interpret.c:17052 #29 0x000000010006de58 in int_apply (fun=0x102ae8670, ob=0x102a94e68, num_arg=0, b_ign_prot=false, b_use_default=true) at interpret.c:17246 #30 0x000000010006e2c9 in sapply_int (fun=0x102ae8670, ob=0x102a94e68, num_arg=0, b_find_static=false, b_use_default=true) at interpret.c:17407 #31 0x00000001000d8d37 in execute_callback (cb=0x110a37d28, nargs=0, keep=false, toplevel=true) at simulate.c:4076 #32 0x0000000100011bd0 in call_out () at call_out.c:441 #33 0x000000010000d500 in backend () at backend.c:733 #34 0x0000000100082ae3 in main (argc=2, argv=0x7fff5fbff850) at main.c:673 This one was just a segmentation fault, no call to fatal(), no LPC stack trace... | ||||
| Tags | crash, memory corruption, reference counter | ||||
|
|
Exchanged information about the crashes by 2 similar ones, because I have core dumps for them. |
|
|
This bug was nasty, it showed itself in a variety of different effects (Crashes, not found functions, etc.), but finally Gnomi and me tracked it. It is present in 3.3. and 3.5, regardless of architecture. get_type_info(<closure>, 4) returns the name of the function of lfun-closures. Unfortunately it does not increment the refcount of that string. This can lead to the premature free'ing of the string and its memory, while it is still in use. That situation usually leads to memory corruption and all kinds of undefined behaviour. It might also be possible to exploit that in other ways than just DoS. I will prepare a fix soon. |
|
|
Ok, issue fixed in r2826 (3.5) and r2824 (3.3). |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2010-01-17 14:43 | zesstra | New Issue | |
| 2010-01-18 13:47 | zesstra | Note Added: 0001682 | |
| 2010-01-18 13:47 | zesstra | Summary | Crash in free_svalue(): Illegal svalue 0x113341f9a type 66281 => Crash in free_svalue(): Illegal svalue 0x102afe460 type 188909664 |
| 2010-01-18 13:47 | zesstra | Description Updated | |
| 2010-01-18 13:47 | zesstra | Additional Information Updated | |
| 2010-01-23 10:05 | zesstra | Project | LDMud 3.5 => LDMud 3.3 |
| 2010-01-23 10:53 | zesstra | Status | new => assigned |
| 2010-01-23 10:53 | zesstra | Assigned To | => zesstra |
| 2010-01-23 10:54 | zesstra | Note Added: 0001692 | |
| 2010-01-23 10:54 | zesstra | Target Version | 3.5.0 => |
| 2010-01-23 10:54 | zesstra | Summary | Crash in free_svalue(): Illegal svalue 0x102afe460 type 188909664 => get_type_info(<closure>, 4) looses refcount to function name of <closures> |
| 2010-01-23 10:55 | zesstra | Tag Attached: crash | |
| 2010-01-23 10:55 | zesstra | Tag Attached: memory corruption | |
| 2010-01-23 10:55 | zesstra | Tag Attached: reference counter | |
| 2010-01-24 11:34 | zesstra | Note Added: 0001694 | |
| 2010-01-24 11:34 | zesstra | Status | assigned => resolved |
| 2010-01-24 11:34 | zesstra | Fixed in Version | => 3.3.720 |
| 2010-01-24 11:34 | zesstra | Resolution | open => fixed |
| 2011-02-23 22:22 | zesstra | Target Version | => 3.3.720 |
