Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
There can happen use-after-free when summary is changed for component which contains any reminders directly ("inline") in the Day View. If it doesn't crash strait away, then catch this under valgrind:
$ G_SLICE=always-malloc valgrind evolution -c calendar
Steps:
a) run evolution in the Calendar view with selected Day View
b) have there shown an event which has set at least one reminder (alarm)
c) click once into the event body, thus a cursor appears to change the summary
d) do change the summary to anything else, like adding an 'a' letter
e) click away from the event summary, thus the changes are saved
Actual results:
Either crash due to use-after-free or a valgrind notice about it.
Expected results:
Do not use memory after it had been freed.
Part of ASAN report (lines differ for sure):
>==28909==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000bf4310 at pc 0x7fdebcd00fd1 bp 0x7ffde14eb9f0 sp 0x7ffde14eb198
>READ of size 1 at 0x602000bf4310 thread T0
> #0 0x7fdebcd00fd0 (/usr/lib64/libasan.so.3+0x45fd0)
> #1 0x7fdea5ac467f in set_alarm_description_cb .../evolution-data-server/src/calendar/libecal/e-cal-component.c:4519
> #2 0x7fdeb808535c in g_hash_table_foreach .../glib-2.50.2/glib/ghash.c:1608
> #3 0x7fdea5ac53fd in e_cal_component_set_summary .../evolution-data-server/src/calendar/libecal/e-cal-component.c:4592
> #4 0x7fde831546e3 in e_day_view_on_editing_stopped .../evolution/src/calendar/gui/e-day-view.c:7901
> #5 0x7fde83150052 in e_day_view_on_text_item_event .../evolution/src/calendar/gui/e-day-view.c:7380
> #6 0x7fdeadd82c57 in ffi_call_unix64 (/lib64/libffi.so.6+0x5c57)
> #7 0x7fdeadd826b9 in ffi_call (/lib64/libffi.so.6+0x56b9)
>
>0x602000bf4310 is located 0 bytes inside of 7-byte region [0x602000bf4310,0x602000bf4317)
>freed by thread T0 here:
> #0 0x7fdebcd81b00 in free (/usr/lib64/libasan.so.3+0xc6b00)
> #1 0x7fdeba99aa17 in icalvalue_free .../libical/src/libical/icalvalue.c:791
> #2 0x7fdeba96ebd2 in icalproperty_set_value .../libical/src/libical/icalproperty.c:786
> #3 0x7fdeba93de01 in icalproperty_set_summary .../libical/_build/src/libical/icalderivedproperty.c:5162
> #4 0x7fdea5ac4db1 in e_cal_component_set_summary .../evolution-data-server/src/calendar/libecal/e-cal-component.c:4564
> #5 0x7fde831546e3 in e_day_view_on_editing_stopped .../evolution/src/calendar/gui/e-day-view.c:7901
> #6 0x7fde83150052 in e_day_view_on_text_item_event .../evolution/src/calendar/gui/e-day-view.c:7380
> #7 0x7fdeadd82c57 in ffi_call_unix64 (/lib64/libffi.so.6+0x5c57)
> #8 0x7ffde14ec1cf (<unknown module>)
>
>previously allocated by thread T0 here:
> #0 0x7fdebcd15160 in strdup (/usr/lib64/libasan.so.3+0x5a160)
> #1 0x7fdeba962788 in icalmemory_strdup .../libical/src/libical/icalmemory.c:241
> #2 0x7fdeba997683 in icalvalue_new_clone .../libical/src/libical/icalvalue.c:102
> #3 0x7fdeba96c452 in icalproperty_new_clone .../libical/src/libical/icalproperty.c:104
> #4 0x7fdeba9571e4 in icalcomponent_new_clone .../libical/src/libical/icalcomponent.c:165
> #5 0x7fde83154387 in e_day_view_on_editing_stopped .../evolution/src/calendar/gui/e-day-view.c:7869
> #6 0x7fde83150052 in e_day_view_on_text_item_event .../evolution/src/calendar/gui/e-day-view.c:7380
> #7 0x7fdeadd82c57 in ffi_call_unix64 (/lib64/libffi.so.6+0x5c57)
> #8 0x7ffde14ec1cf (<unknown module>)
Corresponding upstream bug report:
https://bugzilla.gnome.org/show_bug.cgi?id=656635
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:2066
There can happen use-after-free when summary is changed for component which contains any reminders directly ("inline") in the Day View. If it doesn't crash strait away, then catch this under valgrind: $ G_SLICE=always-malloc valgrind evolution -c calendar Steps: a) run evolution in the Calendar view with selected Day View b) have there shown an event which has set at least one reminder (alarm) c) click once into the event body, thus a cursor appears to change the summary d) do change the summary to anything else, like adding an 'a' letter e) click away from the event summary, thus the changes are saved Actual results: Either crash due to use-after-free or a valgrind notice about it. Expected results: Do not use memory after it had been freed. Part of ASAN report (lines differ for sure): >==28909==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000bf4310 at pc 0x7fdebcd00fd1 bp 0x7ffde14eb9f0 sp 0x7ffde14eb198 >READ of size 1 at 0x602000bf4310 thread T0 > #0 0x7fdebcd00fd0 (/usr/lib64/libasan.so.3+0x45fd0) > #1 0x7fdea5ac467f in set_alarm_description_cb .../evolution-data-server/src/calendar/libecal/e-cal-component.c:4519 > #2 0x7fdeb808535c in g_hash_table_foreach .../glib-2.50.2/glib/ghash.c:1608 > #3 0x7fdea5ac53fd in e_cal_component_set_summary .../evolution-data-server/src/calendar/libecal/e-cal-component.c:4592 > #4 0x7fde831546e3 in e_day_view_on_editing_stopped .../evolution/src/calendar/gui/e-day-view.c:7901 > #5 0x7fde83150052 in e_day_view_on_text_item_event .../evolution/src/calendar/gui/e-day-view.c:7380 > #6 0x7fdeadd82c57 in ffi_call_unix64 (/lib64/libffi.so.6+0x5c57) > #7 0x7fdeadd826b9 in ffi_call (/lib64/libffi.so.6+0x56b9) > >0x602000bf4310 is located 0 bytes inside of 7-byte region [0x602000bf4310,0x602000bf4317) >freed by thread T0 here: > #0 0x7fdebcd81b00 in free (/usr/lib64/libasan.so.3+0xc6b00) > #1 0x7fdeba99aa17 in icalvalue_free .../libical/src/libical/icalvalue.c:791 > #2 0x7fdeba96ebd2 in icalproperty_set_value .../libical/src/libical/icalproperty.c:786 > #3 0x7fdeba93de01 in icalproperty_set_summary .../libical/_build/src/libical/icalderivedproperty.c:5162 > #4 0x7fdea5ac4db1 in e_cal_component_set_summary .../evolution-data-server/src/calendar/libecal/e-cal-component.c:4564 > #5 0x7fde831546e3 in e_day_view_on_editing_stopped .../evolution/src/calendar/gui/e-day-view.c:7901 > #6 0x7fde83150052 in e_day_view_on_text_item_event .../evolution/src/calendar/gui/e-day-view.c:7380 > #7 0x7fdeadd82c57 in ffi_call_unix64 (/lib64/libffi.so.6+0x5c57) > #8 0x7ffde14ec1cf (<unknown module>) > >previously allocated by thread T0 here: > #0 0x7fdebcd15160 in strdup (/usr/lib64/libasan.so.3+0x5a160) > #1 0x7fdeba962788 in icalmemory_strdup .../libical/src/libical/icalmemory.c:241 > #2 0x7fdeba997683 in icalvalue_new_clone .../libical/src/libical/icalvalue.c:102 > #3 0x7fdeba96c452 in icalproperty_new_clone .../libical/src/libical/icalproperty.c:104 > #4 0x7fdeba9571e4 in icalcomponent_new_clone .../libical/src/libical/icalcomponent.c:165 > #5 0x7fde83154387 in e_day_view_on_editing_stopped .../evolution/src/calendar/gui/e-day-view.c:7869 > #6 0x7fde83150052 in e_day_view_on_text_item_event .../evolution/src/calendar/gui/e-day-view.c:7380 > #7 0x7fdeadd82c57 in ffi_call_unix64 (/lib64/libffi.so.6+0x5c57) > #8 0x7ffde14ec1cf (<unknown module>) Corresponding upstream bug report: https://bugzilla.gnome.org/show_bug.cgi?id=656635