Regression in 22.04: segmentation fault when language is spanish

Bug #1988440 reported by JOSE
74
This bug affects 16 people
Affects Status Importance Assigned to Milestone
snap-store-desktop
Fix Released
Critical
Sergio Costas
libxmlb (Ubuntu)
Fix Released
Critical
Sergio Costas
Bionic
Won't Fix
Undecided
Sergio Costas
Focal
Fix Committed
Undecided
Sergio Costas
Jammy
Fix Committed
Undecided
Sergio Costas
Kinetic
Won't Fix
Critical
Sergio Costas

Bug Description

The discussion here describes the issue in full detail: https://forum.snapcraft.io/t/segment-fault-with-snap-store/31547

The bug was caused by a double-free in libxmlb, triggered by some specific data combination.

[Impact] This bug has been in the library since, at least, version 0.1.8, the one used in Bionic. Although the patch attached here fixes the problem in the "snap-store" snap, the bug is still present in the libraries distributed as .deb in Ubuntu, and also in the GNOME-42 extension snap. A patch has been sent both to the libxmlb repository (which has been accepted and merged) and to the Debian SALSA repository.

[Test plan] To test this bug, just download the GIT repository https://github.com/sergio-costas/test_libxmlb2 and follow the instructions. If the bug is there, valgrind will show an access to an already freed memory block and six CRITICAL errors will be shown by GLib.

[Where problems could occur] If another developer adds code that uses the 'xb_builder_xml_lang_prio_cb()' function and forgets to define a destruction function for the passed 'nodes_to_destroy' ptr_array, there would be a memory leak.

Changed in snap-store-desktop:
assignee: nobody → Sergio Costas (rastersoft-gmail)
importance: Undecided → Critical
status: New → In Progress
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

This should be fixed in "edge".

Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :
Changed in snap-store-desktop:
status: In Progress → Fix Committed
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

The fix is currently available in "edge".

Revision history for this message
Treno70 (atgm) wrote :

My language is italian but it's the same story

Changed in libxmlb (Ubuntu):
assignee: nobody → Sergio Costas (rastersoft-gmail)
status: New → Fix Released
importance: Undecided → Critical
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

I checked the GIT repository and the bug in libxmlb has been there since, at least, version 0.1.8, the one used in bionic, as is also in 0.1.15 (focal, impish), 0.3.6 (jammy) and 0.3.8 (kinetic).

Revision history for this message
Jorge Peinado (jpeinado) wrote :

Yes, fixed on the "edge" channel with:

#snap refresh --edge snap-store

Thank you for your work.

Changed in libxmlb (Ubuntu Jammy):
status: New → Triaged
Changed in libxmlb (Ubuntu Focal):
status: New → Triaged
Changed in libxmlb (Ubuntu Bionic):
status: New → Triaged
Changed in libxmlb (Ubuntu Jammy):
assignee: nobody → Sergio Costas (rastersoft-gmail)
Changed in libxmlb (Ubuntu Focal):
assignee: nobody → Sergio Costas (rastersoft-gmail)
Changed in libxmlb (Ubuntu Bionic):
assignee: nobody → Sergio Costas (rastersoft-gmail)
Revision history for this message
Ken VanDine (ken-vandine) wrote (last edit ):

The fix to the snap-store snap has been released to stable/ubuntu-22.04 and stable/ubuntu-22.10 tracks

description: updated
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

debdiff for Jammy.

Changed in libxmlb (Ubuntu Jammy):
status: Triaged → Fix Committed
Changed in libxmlb (Ubuntu Focal):
status: Triaged → In Progress
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

Debdiff for Focal

Changed in libxmlb (Ubuntu Focal):
status: In Progress → Fix Committed
Changed in libxmlb (Ubuntu Bionic):
status: Triaged → In Progress
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

Defdiff for Bionic

Changed in libxmlb (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

For Kinetic, the patch has already been sent to salsa.debian.org: https://salsa.debian.org/efi-team/libxmlb/-/merge_requests/6

Changed in libxmlb (Ubuntu Jammy):
status: Fix Committed → In Progress
Changed in libxmlb (Ubuntu Focal):
status: Fix Committed → In Progress
Changed in libxmlb (Ubuntu Bionic):
status: Fix Committed → In Progress
Changed in libxmlb (Ubuntu Kinetic):
status: Fix Released → In Progress
Revision history for this message
Steve Langasek (vorlon) wrote :

bionic has reached the end of standard support and now only receives security fixes via the ESM archive. I am therefore marking this wontfix for bionic.

Changed in libxmlb (Ubuntu Bionic):
status: In Progress → Won't Fix
Changed in snap-store-desktop:
status: Fix Committed → Fix Released
Steve Langasek (vorlon)
Changed in libxmlb (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote :

debdiff did not apply cleanly to kinetic due to whitespace issues, but I've fixed it up and sponsored the upload. Two other changes were necessary:
- bug number needs to be referenced in debian/changelog
- we need to run update-maintainer since this is an Ubuntu-specific upload

Revision history for this message
Steve Langasek (vorlon) wrote :

For jammy, the version number has been changed to 0.3.6-2ubuntu0.1.

Revision history for this message
Steve Langasek (vorlon) wrote :

Since this bug was originally filed, libxmlb in focal has been updated from 0.1.15-2 to 0.3.6-2build1~20.04.1; so we'll use the jammy patch here also.

Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello JOSE, or anyone else affected,

Accepted libxmlb into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libxmlb/0.3.8-1ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in libxmlb (Ubuntu Kinetic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-kinetic
Changed in libxmlb (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello JOSE, or anyone else affected,

Accepted libxmlb into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libxmlb/0.3.6-2ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in libxmlb (Ubuntu Focal):
status: In Progress → Fix Committed
tags: added: verification-needed-focal
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello JOSE, or anyone else affected,

Accepted libxmlb into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libxmlb/0.3.6-2ubuntu0.1~20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Utkarsh Gupta (utkarsh) wrote :

Ubuntu 22.10 (Kinetic Kudu) has reached end of life, so this bug will not be fixed for that specific release.

Changed in libxmlb (Ubuntu Kinetic):
status: Fix Committed → Won't Fix
Revision history for this message
Marco Trevisan (Treviño) (3v1n0) wrote (last edit ):
Download full text (6.4 KiB)

Tested on 22.04.

It took a while to get the test tool working, but.

With repo packages versions:

❯ apt-cache policy libxmlb2
libxmlb2:
  Installato: 0.3.6-2build1
  Candidato: 0.3.6-2build1
  Tabella versione:
     0.3.6-2ubuntu0.1 400
        400 http://archive.ubuntu.com/ubuntu jammy-proposed/main amd64 Packages
 *** 0.3.6-2build1 500
        500 http://archive.ubuntu.com/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

❯ LD_LIBRARY_PATH=/usr/lib/x86_64-linux-gnu/gnome-software valgrind --num-callers=25 ./test_xmlb
==141088== Memcheck, a memory error detector
==141088== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==141088== Using Valgrind-3.18.1 and LibVEX; rerun with -h for copyright info
==141088== Command: ./test_xmlb
==141088==
Loading test_files/xmls1
Loading test_files/xmls4
Loading test_files/xmls5
Loading test_files/yaml6
Loading2 test_files/metainfo1
Loading2 test_files/metainfo2
Loading2 test_files/appdata2

Loading3 test_files/hostfsapplications

Processing

Loaded and processed everything
==141088== Invalid free() / delete / delete[] / realloc()
==141088== at 0x484B27F: free (vg_replace_malloc.c:872)
==141088== by 0x4BFD03F: ptr_array_free (garray.c:1480)
==141088== by 0x10BCCD: glib_autoptr_clear_GPtrArray (glib-autocleanups.h:59)
==141088== by 0x10BCCD: glib_autoptr_cleanup_GPtrArray (glib-autocleanups.h:59)
==141088== by 0x10BCCD: test (test_xmlb.c:34)
==141088== by 0x10A87E: main (test_xmlb.c:116)
==141088== Address 0x10c16c is in a r-- mapped file /tmp/test_libxmlb2/test_xmlb segment
==141088==
==141088== Invalid free() / delete / delete[] / realloc()
==141088== at 0x484B27F: free (vg_replace_malloc.c:872)
==141088== by 0x4BFD03F: ptr_array_free (garray.c:1480)
==141088== by 0x10BCD5: glib_autoptr_clear_GPtrArray (glib-autocleanups.h:59)
==141088== by 0x10BCD5: glib_autoptr_cleanup_GPtrArray (glib-autocleanups.h:59)
==141088== by 0x10BCD5: test (test_xmlb.c:33)
==141088== by 0x10A87E: main (test_xmlb.c:116)
==141088== Address 0x10c1b0 is in a r-- mapped file /tmp/test_libxmlb2/test_xmlb segment
==141088==
==141088== Invalid free() / delete / delete[] / realloc()
==141088== at 0x484B27F: free (vg_replace_malloc.c:872)
==141088== by 0x10BCF7: g_autoptr_cleanup_generic_gfree (glib-autocleanups.h:28)
==141088== by 0x10BCF7: test (test_xmlb.c:27)
==141088== by 0x10A87E: main (test_xmlb.c:116)
==141088== Address 0x10c239 is in a r-- mapped file /tmp/test_libxmlb2/test_xmlb segment
==141088==
==141088==
==141088== HEAP SUMMARY:
==141088== in use at exit: 215,335 bytes in 2,898 blocks
==141088== total heap usage: 269,683 allocs, 266,793 frees, 21,857,917 bytes allocated
==141088==
==141088== LEAK SUMMARY:
==141088== definitely lost: 0 bytes in 0 blocks
==141088== indirectly lost: 0 bytes in 0 blocks
==141088== possibly lost: 832 bytes in 2 blocks
==141088== still reachable: 195,255 bytes in 2,693 blocks
==141088== suppressed: 0 bytes in 0 blocks
==141088== Rerun with --leak-check=full to see details of leaked memory
==141088==
==141088== For lists of detected and suppressed errors, rerun with: -s
==1410...

Read more...

tags: added: verification-failed-jammy
removed: verification-needed-jammy
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

@sergio could you please review the test result?

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.