SIGSEGV in CServer::destroy() via FileClientChunked destructor on resumed incremental backup

Version: 2.5.36.0
OS: Fedora 43, GCC 15, glibc 2.42

Crash occurs when a resumed incremental backup finishes/fails.
Log shows “Metadata was inconsistent” shortly before crash.

Stack trace:
#0 CServer::destroy() at Server.cpp:830 → obj->Remove() [use-after-free]
#1 FileClientChunked::~FileClientChunked() at FileClientChunked.cpp:99
#2 ServerDownloadThreadGroup::~ServerDownloadThreadGroup() at ServerDownloadThreadGroup.cpp:90
#3 std::auto_ptr::~auto_ptr()
#4 IncrFileBackup::doFileBackup()

Backup state at crash:

  • is_resumed = true

  • is_complete = false

  • backupid = 256

    LOG:
    $ journalctl -u urbackup-server -f
    abr 07 15:54:05 mad13f urbackupsrv[288295]: ERROR: Backup failed
    abr 07 15:54:06 mad13f urbackupsrv[288295]: WARNING: Exponential backoff: Waiting at least 40m before next file backup
    abr 07 15:56:03 mad13f urbackupsrv[288295]: ERROR: Constructing of filelist of “xxx.ts.net” failed: error - Async indexing process not found
    abr 07 15:56:03 mad13f urbackupsrv[288295]: ERROR: Hint: The most likely explanation for this error is that the client was restarted/rebooted during indexing
    abr 07 15:56:06 mad13f urbackupsrv[288295]: ERROR: Backup had an early error. Deleting partial backup.
    abr 07 16:05:03 mad13f urbackupsrv[288295]: WARNING: Not all folder metadata could be applied. Metadata was inconsistent.
    abr 07 16:05:09 mad13f systemd-coredump[319213]: [🡕] Process 288295 (urbackupsrv) of user 968 dumped core.

  • Thanks!