Bug 1164340

Summary: segfault when viewing a RHEL entitlement certificate in X509V3_EXT_get v3_lib.c:15
Product: [Fedora] Fedora Reporter: Adrian Likins <alikins>
Component: xcaAssignee: Patrick Monnerat <patrick>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: rawhideCC: patrick
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: xca-1.1.0-1.fc20 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-01-14 07:26:22 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
example rhel entitlement cert that crashes xca cert "show details"
none
targz of 'dump db" output with cert that shows crash none

Description Adrian Likins 2014-11-14 17:22:11 UTC
Description of problem:

I imported a entitlement certificate from a RHEL system
(/etc/pki/entitlement/*.pem).

When trying to view the cert details from the certificate tab, I
got a segfault.

#0  X509V3_EXT_get (ext=ext@entry=0x0) at v3_lib.c:115
#1  0x0000003940525b92 in X509V3_EXT_print (out=0xd4b8c0, ext=0x0, flag=0, indent=0) at v3_prn.c:117
#2  0x000000000047b472 in x509v3ext::getValue (this=this@entry=0xd4a910, html=html@entry=true) at x509v3ext.cpp:103
#3  0x000000000047c92d in x509v3ext::getHtml (this=0xd4a910) at x509v3ext.cpp:737
#4  0x000000000047f000 in extList::getHtml (this=this@entry=0x7fffffffc5e0, sep=...) at x509v3ext.cpp:803
#5  0x00000000004cb0ca in CertDetail::setX509super (this=this@entry=0xcd7f00, x=x@entry=0xc25f20) at CertDetail.cpp:69
#6  0x00000000004cb366 in CertDetail::setCert (this=this@entry=0xcd7f00, cert=cert@entry=0xc25f20) at CertDetail.cpp:83
#7  0x000000000042c2ad in db_x509::showPki (this=0xc0fd60, pki=0xc25f20) at db_x509.cpp:590
#8  0x00000000004f8529 in MainWindow::on_certView_doubleClicked (this=this@entry=0x94fc70, m=...) at MW_database.cpp:453
#9  0x00000000004989ab in MainWindow::qt_static_metacall (_o=_o@entry=0x94fc70, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=_id@entry=29, _a=_a@entry=0x7fffffffca40)
    at moc_MainWindow.cpp:242
#10 0x0000000000498d13 in MainWindow::qt_metacall (this=0x94fc70, _c=QMetaObject::InvokeMetaMethod, _id=29, _a=0x7fffffffca40) at moc_MainWindow.cpp:313
#11 0x00000031d459b594 in QMetaObject::activate (sender=sender@entry=0x955a10, m=m@entry=0x38eaebcf20 <QAbstractItemView::staticMetaObject>, local_signal_index=local_signal_index@entry=2, 
    argv=argv@entry=0x7fffffffca40) at kernel/qobject.cpp:3597
#12 0x00000038ea8e7275 in QAbstractItemView::doubleClicked (this=this@entry=0x955a10, _t1=...) at .moc/release-shared/moc_qabstractitemview.cpp:354
#13 0x00000038ea92fcb3 in QTreeView::mouseDoubleClickEvent (this=0x955a10, event=0x7fffffffd220) at itemviews/qtreeview.cpp:1867
#14 0x00000038ea41dcaf in QWidget::event (this=this@entry=0x955a10, event=event@entry=0x7fffffffd220) at kernel/qwidget.cpp:8393
#15 0x00000038ea7d444e in QFrame::event (this=0x955a10, e=0x7fffffffd220) at widgets/qframe.cpp:557
#16 0x00000038ea8f0ca3 in QAbstractItemView::viewportEvent (this=this@entry=0x955a10, event=event@entry=0x7fffffffd220) at itemviews/qabstractitemview.cpp:1644
#17 0x00000038ea931b90 in QTreeView::viewportEvent (this=0x955a10, event=0x7fffffffd220) at itemviews/qtreeview.cpp:1252
#18 0x00000031d4586a66 in QCoreApplicationPrivate::sendThroughObjectEventFilters (this=<optimized out>, receiver=0x97b030, event=0x7fffffffd220) at kernel/qcoreapplication.cpp:1063
#19 0x00000038ea3cae3c in QApplicationPrivate::notify_helper (this=0x779520, receiver=0x97b030, e=0x7fffffffd220) at kernel/qapplication.cpp:4561
#20 0x00000038ea3d18f1 in QApplication::notify (this=<optimized out>, receiver=0x97b030, e=0x7fffffffd220) at kernel/qapplication.cpp:4108
#21 0x00000031d45868fd in QCoreApplication::notifyInternal (this=0x7fffffffd9e0, receiver=0x97b030, event=0x7fffffffd220) at kernel/qcoreapplication.cpp:953
#22 0x00000038ea3d1067 in QApplicationPrivate::sendMouseEvent (receiver=0x97b030, event=0x7fffffffd220, alienWidget=0x97b030, nativeWidget=0x94fc70, buttonDown=<optimized out>, 
    lastMouseReceiver=..., spontaneous=true) at ../../src/corelib/kernel/qcoreapplication.h:231
#23 0x00000038ea44663b in QETWidget::translateMouseEvent (this=0x94fc70, event=<optimized out>) at kernel/qapplication_x11.cpp:4540
#24 0x00000038ea4450ac in QApplication::x11ProcessEvent (this=0x7fffffffd9e0, event=event@entry=0x7fffffffd590) at kernel/qapplication_x11.cpp:3663
#25 0x00000038ea46cac4 in x11EventSourceDispatch (s=0x77beb0, callback=0x0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:148
#26 0x00000031c9c492a6 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#27 0x00000031c9c49628 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#28 0x00000031c9c496dc in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#29 0x00000031d45b541e in QEventDispatcherGlib::processEvents (this=0x77a970, flags=...) at kernel/qeventdispatcher_glib.cpp:450
#30 0x00000038ea46cc46 in QGuiEventDispatcherGlib::processEvents (this=<optimized out>, flags=...) at kernel/qguieventdispatcher_glib.cpp:207
#31 0x00000031d458538f in QEventLoop::processEvents (this=this@entry=0x7fffffffd980, flags=...) at kernel/qeventloop.cpp:149
#32 0x00000031d45856dd in QEventLoop::exec (this=this@entry=0x7fffffffd980, flags=...) at kernel/qeventloop.cpp:204
#33 0x00000031d458ada9 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1225
#34 0x00000038ea3c94dc in QApplication::exec () at kernel/qapplication.cpp:3823
#35 0x00000000004221eb in main (argc=1, argv=<optimized out>) at main.cpp:86


Version-Release number of selected component (if applicable):
[~]$ rpm -q xca qt openssl glibc 
xca-1.0.0-1.fc20.x86_64
qt-4.8.6-10.fc20.x86_64
openssl-1.0.1e-40.fc20.x86_64
glibc-2.18-16.fc20.x86_64


How reproducible:
Always with that cert. 


I'll see if I can reproduce with a sharable entitlement certificate, but a few things to note about that cert. It's a client cert, it's big (~55k), there is a big blob at the 1.3.6.1.4.1.2312.9.7 ext).

Comment 1 Adrian Likins 2014-11-14 17:46:46 UTC
another stack trace, I'll attach the cert/db

(gdb) where
#0  X509V3_EXT_get (ext=ext@entry=0x0) at v3_lib.c:115
#1  0x0000003940525b92 in X509V3_EXT_print (out=0xd66400, ext=0x0, flag=0, indent=0) at v3_prn.c:117
#2  0x000000000047b472 in x509v3ext::getValue (this=this@entry=0xd63f20, html=html@entry=true) at x509v3ext.cpp:103
#3  0x000000000047c92d in x509v3ext::getHtml (this=0xd63f20) at x509v3ext.cpp:737
#4  0x000000000047f000 in extList::getHtml (this=this@entry=0x7fffffffc840, sep=...) at x509v3ext.cpp:803
#5  0x00000000004cb0ca in CertDetail::setX509super (this=this@entry=0xcd8430, x=x@entry=0x9a0310) at CertDetail.cpp:69
#6  0x00000000004cb366 in CertDetail::setCert (this=this@entry=0xcd8430, cert=cert@entry=0x9a0310) at CertDetail.cpp:83
#7  0x000000000042c2ad in db_x509::showPki (this=0xbfa3f0, pki=0x9a0310) at db_x509.cpp:590
#8  0x0000000000440c1e in db_base::showSelectedItems (this=0xbfa3f0, view=<optimized out>) at db_base.cpp:325
#9  0x00000000004f878b in MainWindow::on_BNdetailsCert_clicked (this=this@entry=0x94fbf0) at MW_database.cpp:515
#10 0x0000000000498aad in MainWindow::qt_static_metacall (_o=_o@entry=0x94fbf0, _c=_c@entry=QMetaObject::InvokeMetaMethod, _id=_id@entry=45, _a=_a@entry=0x7fffffffccf0)
    at moc_MainWindow.cpp:258
#11 0x0000000000498d13 in MainWindow::qt_metacall (this=0x94fbf0, _c=QMetaObject::InvokeMetaMethod, _id=45, _a=0x7fffffffccf0) at moc_MainWindow.cpp:313
#12 0x00000031d459b594 in QMetaObject::activate (sender=sender@entry=0x95cf30, m=m@entry=0x38eaecabc0 <QAbstractButton::staticMetaObject>, local_signal_index=local_signal_index@entry=2, 
    argv=argv@entry=0x7fffffffccf0) at kernel/qobject.cpp:3597
#13 0x00000038eaa4d6d2 in QAbstractButton::clicked (this=this@entry=0x95cf30, _t1=false) at .moc/release-shared/moc_qabstractbutton.cpp:219
#14 0x00000038ea790d73 in QAbstractButtonPrivate::emitClicked (this=this@entry=0x962440) at widgets/qabstractbutton.cpp:548
#15 0x00000038ea792127 in QAbstractButtonPrivate::click (this=this@entry=0x962440) at widgets/qabstractbutton.cpp:541
#16 0x00000038ea79222c in QAbstractButton::mouseReleaseEvent (this=0x95cf30, e=0x7fffffffd210) at widgets/qabstractbutton.cpp:1123
#17 0x00000038ea41dcc8 in QWidget::event (this=0x95cf30, event=0x7fffffffd210) at kernel/qwidget.cpp:8389
#18 0x00000038ea3cae5c in QApplicationPrivate::notify_helper (this=0x779520, receiver=0x95cf30, e=0x7fffffffd210) at kernel/qapplication.cpp:4565
#19 0x00000038ea3d18f1 in QApplication::notify (this=<optimized out>, receiver=0x95cf30, e=0x7fffffffd210) at kernel/qapplication.cpp:4108
#20 0x00000031d45868fd in QCoreApplication::notifyInternal (this=0x7fffffffd9d0, receiver=0x95cf30, event=0x7fffffffd210) at kernel/qcoreapplication.cpp:953
#21 0x00000038ea3d1067 in QApplicationPrivate::sendMouseEvent (receiver=0x95cf30, event=0x7fffffffd210, alienWidget=0x95cf30, nativeWidget=0x94fbf0, buttonDown=<optimized out>, 
    lastMouseReceiver=..., spontaneous=true) at ../../src/corelib/kernel/qcoreapplication.h:231
#22 0x00000038ea44663b in QETWidget::translateMouseEvent (this=0x94fbf0, event=<optimized out>) at kernel/qapplication_x11.cpp:4540
#23 0x00000038ea4450ac in QApplication::x11ProcessEvent (this=0x7fffffffd9d0, event=event@entry=0x7fffffffd580) at kernel/qapplication_x11.cpp:3663
#24 0x00000038ea46cac4 in x11EventSourceDispatch (s=0x77beb0, callback=0x0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:148
#25 0x00000031c9c492a6 in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
#26 0x00000031c9c49628 in g_main_context_iterate.isra () from /lib64/libglib-2.0.so.0
#27 0x00000031c9c496dc in g_main_context_iteration () from /lib64/libglib-2.0.so.0
#28 0x00000031d45b541e in QEventDispatcherGlib::processEvents (this=0x77a970, flags=...) at kernel/qeventdispatcher_glib.cpp:450
#29 0x00000038ea46cc46 in QGuiEventDispatcherGlib::processEvents (this=<optimized out>, flags=...) at kernel/qguieventdispatcher_glib.cpp:207
#30 0x00000031d458538f in QEventLoop::processEvents (this=this@entry=0x7fffffffd970, flags=...) at kernel/qeventloop.cpp:149
#31 0x00000031d45856dd in QEventLoop::exec (this=this@entry=0x7fffffffd970, flags=...) at kernel/qeventloop.cpp:204
#32 0x00000031d458ada9 in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1225
#33 0x00000038ea3c94dc in QApplication::exec () at kernel/qapplication.cpp:3823
#34 0x00000000004221eb in main (argc=1, argv=<optimized out>) at main.cpp:86
(gdb) quit
A debugging session is active.

	Inferior 1 [process 8479] will be killed.

Quit anyway? (y or n) n
Not confirmed.
(gdb) up
#1  0x0000003940525b92 in X509V3_EXT_print (out=0xd66400, ext=0x0, flag=0, indent=0) at v3_prn.c:117
117		if(!(method = X509V3_EXT_get(ext)))
(gdb) up
#2  0x000000000047b472 in x509v3ext::getValue (this=this@entry=0xd63f20, html=html@entry=true) at x509v3ext.cpp:103
103		ret = X509V3_EXT_print(bio, ext, X509V3_EXT_DEFAULT, 0);
(gdb) info locals
text = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 1}, alloc = 0, size = 0, data = 0x76c1da <QString::shared_null+26>, clean = 0, simpletext = 0, 
    righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 67}, alloc = 0, size = 0, 
    data = 0x31d48ec8fa <QString::shared_empty+26>, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, 
  d = 0x31d48ec8e0 <QString::shared_empty>, static codecForCStrings = 0x0}
ret = <optimized out>
p = 0x0
bio = 0xd66400
(gdb) up
#3  0x000000000047c92d in x509v3ext::getHtml (this=0xd63f20) at x509v3ext.cpp:737
737		html += ":</u></b><br><tt>" + getValue(true) + "</tt>";
(gdb) info locals
html = {static null = {<No data fields>}, static shared_null = {ref = {_q_value = 1}, alloc = 0, size = 0, data = 0x76c1da <QString::shared_null+26>, clean = 0, simpletext = 0, 
    righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, static shared_empty = {ref = {_q_value = 67}, alloc = 0, size = 0, 
    data = 0x31d48ec8fa <QString::shared_empty+26>, clean = 0, simpletext = 0, righttoleft = 0, asciiCache = 0, capacity = 0, reserved = 0, array = {0}}, d = 0xd64a90, 
  static codecForCStrings = 0x0}
(gdb) p data
$1 = (struct here_cg_arc_record *) 0x0

Comment 2 Adrian Likins 2014-11-14 17:47:45 UTC
Created attachment 957689 [details]
example rhel entitlement cert that crashes xca cert "show details"

Comment 3 Adrian Likins 2014-11-14 17:51:19 UTC
Created attachment 957690 [details]
targz of 'dump db" output with cert that shows crash

Comment 4 Patrick Monnerat 2014-11-17 14:31:47 UTC
Confirmed.
Segfaults when trying to print a non-standard extension (2 of them in this certificate).
Working with upstream for a fix.
Thanks for reporting.

Comment 5 Fedora Update System 2014-11-17 16:59:09 UTC
xca-1.0.0-2.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/xca-1.0.0-2.fc20

Comment 6 Fedora Update System 2014-11-17 16:59:19 UTC
xca-1.0.0-2.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/xca-1.0.0-2.fc21

Comment 7 Fedora Update System 2014-11-18 12:11:45 UTC
Package xca-1.0.0-2.fc20:
* should fix your issue,
* was pushed to the Fedora 20 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing xca-1.0.0-2.fc20'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2014-15260/xca-1.0.0-2.fc20
then log in and leave karma (feedback).

Comment 8 Fedora Update System 2014-11-24 14:51:39 UTC
xca-1.1.0-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/xca-1.1.0-1.fc20

Comment 9 Fedora Update System 2014-11-24 14:51:46 UTC
xca-1.1.0-1.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/xca-1.1.0-1.fc21

Comment 10 Fedora Update System 2015-01-14 07:26:22 UTC
xca-1.1.0-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2015-01-14 07:28:58 UTC
xca-1.1.0-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.