Repository navigation
SIGSEGV (Segfault) in sentry__value_new_addr / __vsnprintf_chk on Android #4830
Description
Integration
sentry-android
Build System
Gradle
AGP Version
8.12.0
Proguard
Enabled
Version
8.23.0
Steps to Reproduce
- Download TomTomApp from the playStore.
- Integrate sentry-android and/or sentry-android-ndk in the app.
- Run the app on an arm64 device.
- A native crash occurs and Sentry attempts to capture it.
- Instead of capturing, Sentry itself crashes with SIGSEGV during signal handling.
This was first observed in production.
Example of latest 3 logs attached:
sentry.logcat.zip
sentry.logcat(1).zip
sentry.logcat(2).zip
SIGSEGV: Segfault ?, in __vfprintf ?, in vsnprintf ?, in __vsnprintf_chk File "stdio.h", line 82, in _ZL8snprintfPcU17pass_object_size1mPKcz File "sentry_value.c", line 1180, in sentry__value_new_addr ... (140 additional frame(s) were not displayed)
Expected Result
Sentry should handle and capture the native crash, report it to Sentry.io, and not crash during its own signal handling.
Actual Result
Stacktrace appearing under the sentry issue:
libc +0x060040 __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x021d90 abort split_config.arm64_v8a.apk +0x04f16c sentry__unwind_stack_libunwindstack (sentry_unwinder_libunwindstack.cpp:46) split_config.arm64_v8a.apk +0x04e89c make_signal_event (sentry_backend_inproc.c:492) split_config.arm64_v8a.apk +0x04e89c handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648) app_process64 +0x00d05c <unknown> linker64 +0x1446a0 __kernel_rt_sigreturn libc +0x06003c __vfprintf libc +0x08032c vsnprintf libc +0x0494b8 __vsnprintf_chk split_config.arm64_v8a.apk +0x048120 _ZL8snprintfPcU17pass_object_size1mPKcz (stdio.h:82) split_config.arm64_v8a.apk +0x047fec sentry__value_new_addr (sentry_value.c:1180) split_config.arm64_v8a.apk +0x04912c sentry_value_new_stacktrace (sentry_value.c:1399) split_config.arm64_v8a.apk +0x04e8ec make_signal_event (sentry_backend_inproc.c:504) split_config.arm64_v8a.apk +0x04e8ec handle_ucontext (sentry_backend_inproc.c:581) split_config.arm64_v8a.apk +0x04e650 handle_signal (sentry_backend_inproc.c:648)
Activity
linear commentedon Oct 22, 2025
JAVA-213
supervacuus commentedon Oct 29, 2025
Thanks for the report @AlessandroSemeraro-tomtom!
It looks like the immediate cause in the Native SDK is the use of a
vfprintfdescendant to format addresses within the signal handler. In particular, it seems thatvfprintftries to deallocate an internal buffer using a pointer that doesn't point to an allocated region:The most likely cause in that context is that
vfprintfisn't signal safe, so it shouldn't be called from a signal handler. I will replace this with a signal-safe implementation.Note: while this is the most likely scenario, there could be another underlying environmental cause (memory corruption). Since any signal-unsafe functions should be removed from the signal handlers anyway, I would start with this first.
supervacuus commentedon Oct 29, 2025
Btw, the
logcatlogs show two types of crashes:Am I right to assume that those are the initial native crashes that the crashing handler received?
AlessandroSemeraro-tomtom commentedon Nov 3, 2025
Hey @supervacuus thanks for following up.
I think that the invalid dereference traces where our APK is at the top of the backtrace correspond to the original native crashes that the Sentry handler was trying to process.
The recursive SIGSEGV (with vfprintf / snprintf in sentry__value_new_addr) occurs afterwards, during Sentry’s own signal handling. I think we first get our app’s native crash, and then Sentry crashes while attempting to capture it.
I also noticed that sometimes Sentry groups unrelated native crashes under the same issue, which might be why you’re seeing a mix of both types of traces in the logs, but the main crash here should be the vfprintf call inside the signal handler.
8 remaining items
AlessandroSemeraro-tomtom commentedon Nov 6, 2025
@supervacuus I've checked with my team and the best option here is to just intake the next Sentry's version in our App with the potential fix. The bug is quite difficult to reproduce (native crash on our side) and we had only around 50 events for 40 users during one full month.
What I can do is to monitor if the fix is effective once it reaches production, and keep you posted under this thread. WDYT?
supervacuus commentedon Nov 6, 2025
Thanks @AlessandroSemeraro-tomtom for the event data and the feedback regarding severity/urgency and release strategy.
I think the suggested approach makes sense and we will just release the fixes when ready, keep you posted here and you signal if you see any changes once you deployed one of the fix releases or when the topic escalates unexpectedly.
OresteSalerno-TomTom commentedon Jan 22, 2026
@supervacuus is there any update about this issue? I see that the linked PR has been untouched for almost 2 months ...
supervacuus commentedon Jan 23, 2026
@OresteSalerno-TomTom, I am sorry for not giving an update in the meantime, but the work on the
sentry-nativebranch has been deprioritized in favor of releasing tombstone support.Preliminary tombstone support was released with 8.30.0, and we are working on finalizing a few more aspects, after which I will head back and finish the quite significant redesign of the
inprocbackend and test it thoroughly.supervacuus commentedon Feb 20, 2026
Quick update: we just released sentry-native
0.13.0, which includes a significant rewrite ofinprocthat includes changes to reduce exposure to the described issue. This release will be included in one of the next Android SDK releases. I will ping again when that release is out.supervacuus commentedon Mar 4, 2026
@OresteSalerno-TomTom, the related changes have been released with 8.34.0