Bug 1470400 - Segfault in libcrypto.so.1.1.0f
Summary: Segfault in libcrypto.so.1.1.0f
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: freerdp
Version: 26
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Simone Caronni
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-07-12 23:01 UTC by Wilfried Philips
Modified: 2017-09-30 06:23 UTC (History)
7 users (show)

Fixed In Version: freerdp-2.0.0-34.20170831git3b83526.fc26 freerdp-2.0.0-34.20170831git3b83526.fc25 freerdp-2.0.0-34.20170831git3b83526.fc27
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-09-22 18:51:41 UTC
Type: Bug


Attachments (Terms of Use)

Description Wilfried Philips 2017-07-12 23:01:32 UTC
Description of problem:
winpr-makecert -rdp
Segmentation fault (core dumped)


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1. winpr-makecert -rdp



Actual results:

Result: Segmentation fault (core dumped)
 
winpr-makecert[17593]: segfault at 10 ip 00007f80173ae670 sp 00007ffd21e91520 error 4 in libcrypto.so.1.1.0f[7f8017224000+25f000]



Expected results:
Command should work

Additional info:
THis is after an upgrade from fedora 22 to fedora 26 using 
dnf system-upgrade. 

Other commands cause core dump as well, for example:

freerdp-shadow-cli  +may-interact
Segmentation fault (core dumped)

freerdp-shadow-[18143]: segfault at 10 ip 00007f5bf562a670 sp 00007fff46e46ba0 error 4 in libcrypto.so.1.1.0f[7f5bf54a0000+25f000]


$ldd `which winpr-makecert`
	linux-vdso.so.1 (0x00007ffe9e78e000)
	libwinpr-tools2.so.2 => /lib64/libwinpr-tools2.so.2 (0x00007fbacfc08000)
	libc.so.6 => /lib64/libc.so.6 (0x00007fbacf837000)
	libcrypto.so.1.1 => /lib64/libcrypto.so.1.1 (0x00007fbacf3ac000)
	libwinpr2.so.2 => /lib64/libwinpr2.so.2 (0x00007fbacf0ba000)
	/lib64/ld-linux-x86-64.so.2 (0x0000558c6cf6b000)
	libz.so.1 => /lib64/libz.so.1 (0x00007fbaceea3000)
	libdl.so.2 => /lib64/libdl.so.2 (0x00007fbacec9d000)
	libpthread.so.0 => /lib64/libpthread.so.0 (0x00007fbacea7e000)
	librt.so.1 => /lib64/librt.so.1 (0x00007fbace876000)
	libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fbace60a000)
	libsystemd.so.0 => /lib64/libsystemd.so.0 (0x00007fbace57f000)
	libm.so.6 => /lib64/libm.so.6 (0x00007fbace269000)
	libresolv.so.2 => /lib64/libresolv.so.2 (0x00007fbace04e000)
	libselinux.so.1 => /lib64/libselinux.so.1 (0x00007fbacde26000)
	libcap.so.2 => /lib64/libcap.so.2 (0x00007fbacdc21000)
	liblzma.so.5 => /lib64/liblzma.so.5 (0x00007fbacd9fb000)
	liblz4.so.1 => /lib64/liblz4.so.1 (0x00007fbacd7e7000)
	libgcrypt.so.20 => /lib64/libgcrypt.so.20 (0x00007fbacd4d9000)
	libgpg-error.so.0 => /lib64/libgpg-error.so.0 (0x00007fbacd2c3000)
	libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00007fbacd0ac000)
	libpcre.so.1 => /lib64/libpcre.so.1 (0x00007fbacce3a000)

Comment 1 Tomas Mraz 2017-07-13 06:44:01 UTC
I'd definitely need a good backtrace from gdb to proceed. Also most probably this is some error within freerdp and its use of the OpenSSL 1.1.0 API.

Comment 2 Wilfried Philips 2017-07-13 09:34:27 UTC
stacktrace for echo "run -rdp" |gdb winpr-makecert
Note that debuginfo is installed properly but is 
not uptodate (unfortinately this is quite common)
 rpm -q -f /usr/lib/debug//usr/lib64/libwinpr-tools2.so.2.0.0.debug; echo $?
freerdp-debuginfo-2.0.0-27.20170512gitb1df835.fc26.x86_64
0
echo "run -rdp" |gdb winpr-makecert



GNU gdb (GDB) Fedora 8.0-13.fc26
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from winpr-makecert...
warning: the debug information found in "/usr/lib/debug//usr/bin/winpr-makecert.debug" does not match "/usr/bin/winpr-makecert" (CRC mismatch).
Reading symbols from /home/philips/winpr-makecert...(no debugging symbols found)...done.
(no debugging symbols found)...done.
Missing separate debuginfos, use: dnf debuginfo-install freerdp-2.0.0-28.20170623git9904c32.fc26.x86_64
(gdb) Starting program: /usr/bin/winpr-makecert -rdp
warning: the debug information found in "/usr/lib/debug//usr/lib64/libwinpr-tools2.so.2.0.0.debug" does not match "/lib64/libwinpr-tools2.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//usr/lib64/libwinpr2.so.2.0.0.debug" does not match "/lib64/libwinpr2.so.2" (CRC mismatch).

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff74fd670 in RSA_generate_key_ex (rsa=0x0, bits=2048, 
    e_value=0x5555557567e0, cb=0x0) at crypto/rsa/rsa_gen.c:104
104	    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
(gdb) quit
A debugging session is active.

	Inferior 1 [process 8485] will be killed.

Quit anyway? (y or n) [answered Y; input not from terminal]

Comment 3 Wilfried Philips 2017-07-13 09:36:05 UTC
valgrind  winpr-makecert -rdp

==8777== Memcheck, a memory error detector
==8777== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==8777== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==8777== Command: winpr-makecert -rdp
==8777== 
==8777== Invalid read of size 8
==8777==    at 0x559D670: RSA_generate_key_ex (rsa_gen.c:104)
==8777==    by 0x4E3E113: makecert_context_process (in /usr/lib64/libwinpr-tools2.so.2.0.0)
==8777==    by 0x10886F: ??? (in /usr/bin/winpr-makecert)
==8777==    by 0x50624D9: (below main) (libc-start.c:295)
==8777==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==8777== 
==8777== 
==8777== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==8777==  Access not within mapped region at address 0x10
==8777==    at 0x559D670: RSA_generate_key_ex (rsa_gen.c:104)
==8777==    by 0x4E3E113: makecert_context_process (in /usr/lib64/libwinpr-tools2.so.2.0.0)
==8777==    by 0x10886F: ??? (in /usr/bin/winpr-makecert)
==8777==    by 0x50624D9: (below main) (libc-start.c:295)
==8777==  If you believe this happened as a result of a stack
==8777==  overflow in your program's main thread (unlikely but
==8777==  possible), you can try to increase the size of the
==8777==  main thread stack using the --main-stacksize= flag.
==8777==  The main thread stack size used in this run was 8388608.
==8777== 
==8777== HEAP SUMMARY:
==8777==     in use at exit: 1,724 bytes in 25 blocks
==8777==   total heap usage: 29 allocs, 4 frees, 3,457 bytes allocated
==8777== 
==8777== LEAK SUMMARY:
==8777==    definitely lost: 0 bytes in 0 blocks
==8777==    indirectly lost: 0 bytes in 0 blocks
==8777==      possibly lost: 0 bytes in 0 blocks
==8777==    still reachable: 1,724 bytes in 25 blocks
==8777==         suppressed: 0 bytes in 0 blocks
==8777== Rerun with --leak-check=full to see details of leaked memory
==8777== 
==8777== For counts of detected and suppressed errors, rerun with: -v
==8777== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault

Comment 4 Wilfried Philips 2017-07-13 09:38:09 UTC
echo "run +may-interact" |gdb freerdp-shadow-cli 
Copyright (C) 2017 Free Software Foundation, Inc.

...
(gdb) Starting program: /usr/bin/freerdp-shadow-cli +may-interact
warning: the debug information found in "/usr/lib/debug//usr/lib64/libfreerdp-shadow-subsystem2.so.2.0.0.debug" does not match "/lib64/libfreerdp-shadow-subsystem2.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//usr/lib64/libfreerdp-shadow2.so.2.0.0.debug" does not match "/lib64/libfreerdp-shadow2.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//usr/lib64/libwinpr2.so.2.0.0.debug" does not match "/lib64/libwinpr2.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//usr/lib64/libfreerdp2.so.2.0.0.debug" does not match "/lib64/libfreerdp2.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//usr/lib64/libfreerdp-server2.so.2.0.0.debug" does not match "/lib64/libfreerdp-server2.so.2" (CRC mismatch).

warning: the debug information found in "/usr/lib/debug//usr/lib64/libwinpr-tools2.so.2.0.0.debug" does not match "/lib64/libwinpr-tools2.so.2" (CRC mismatch).

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff58bc670 in RSA_generate_key_ex (rsa=0x0, bits=2048, 
    e_value=0x555555783ad0, cb=0x0) at crypto/rsa/rsa_gen.c:104
104	    if (FIPS_mode() && !(rsa->meth->flags & RSA_FLAG_FIPS_METHOD)
Missing separate debuginfos, use: dnf debuginfo-install freerdp-libs-2.0.0-28.20170623git9904c32.fc26.x86_64 keyutils-libs-1.5.10-1.fc26.x86_64 krb5-libs-1.15.1-8.fc26.x86_64 libX11-1.6.5-2.fc26.x86_64 libXau-1.0.8-7.fc26.x86_64 libXdamage-1.1.4-9.fc26.x86_64 libXext-1.3.3-5.fc26.x86_64 libXfixes-5.0.3-2.fc26.x86_64 libXinerama-1.1.3-7.fc26.x86_64 libcap-2.25-5.fc26.x86_64 libcom_err-1.43.4-2.fc26.x86_64 libgcc-7.1.1-3.fc26.x86_64 libgcrypt-1.7.8-1.fc26.x86_64 libgpg-error-1.25-2.fc26.x86_64 libjpeg-turbo-1.5.1-0.fc26.x86_64 libselinux-2.6-6.fc26.x86_64 libwinpr-2.0.0-28.20170623git9904c32.fc26.x86_64 libxcb-1.12-3.fc26.x86_64 libxkbfile-1.0.9-4.fc26.x86_64 lz4-libs-1.7.5-3.fc26.x86_64 pcre-8.40-7.fc26.x86_64 systemd-libs-233-6.fc26.x86_64 xz-libs-5.2.3-2.fc26.x86_64 zlib-1.2.11-2.fc26.x86_64
(gdb) quit
A debugging session is active.

	Inferior 1 [process 9285] will be killed.

Quit anyway? (y or n) [answered Y; input not from terminal]
-bash-4.4$

Comment 5 Wilfried Philips 2017-07-13 09:38:52 UTC
valgrind freerdp-shadow-cli +may-interact

==9757== Memcheck, a memory error detector
==9757== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==9757== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==9757== Command: freerdp-shadow-cli +may-interact
==9757== 
==9757== Invalid read of size 8
==9757==    at 0x71DE670: RSA_generate_key_ex (rsa_gen.c:104)
==9757==    by 0x69DC113: makecert_context_process (in /usr/lib64/libwinpr-tools2.so.2.0.0)
==9757==    by 0x504CF3A: shadow_server_init (in /usr/lib64/libfreerdp-shadow2.so.2.0.0)
==9757==    by 0x108D6E: main (shadow.c:79)
==9757==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==9757== 
==9757== 
==9757== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==9757==  Access not within mapped region at address 0x10
==9757==    at 0x71DE670: RSA_generate_key_ex (rsa_gen.c:104)
==9757==    by 0x69DC113: makecert_context_process (in /usr/lib64/libwinpr-tools2.so.2.0.0)
==9757==    by 0x504CF3A: shadow_server_init (in /usr/lib64/libfreerdp-shadow2.so.2.0.0)
==9757==    by 0x108D6E: main (shadow.c:79)
==9757==  If you believe this happened as a result of a stack
==9757==  overflow in your program's main thread (unlikely but
==9757==  possible), you can try to increase the size of the
==9757==  main thread stack using the --main-stacksize= flag.
==9757==  The main thread stack size used in this run was 8388608.
==9757== 
==9757== HEAP SUMMARY:
==9757==     in use at exit: 155,639 bytes in 3,315 blocks
==9757==   total heap usage: 3,422 allocs, 107 frees, 180,881 bytes allocated
==9757== 
==9757== LEAK SUMMARY:
==9757==    definitely lost: 0 bytes in 0 blocks
==9757==    indirectly lost: 0 bytes in 0 blocks
==9757==      possibly lost: 0 bytes in 0 blocks
==9757==    still reachable: 155,639 bytes in 3,315 blocks
==9757==         suppressed: 0 bytes in 0 blocks
==9757== Rerun with --leak-check=full to see details of leaked memory
==9757== 
==9757== For counts of detected and suppressed errors, rerun with: -v
==9757== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault
-bash-4.4$

Comment 6 Simone Caronni 2017-07-13 11:45:06 UTC
(In reply to Wilfried Philips from comment #0)
> Additional info:
> THis is after an upgrade from fedora 22 to fedora 26 using 
> dnf system-upgrade.

Nice. Quite a jump.


Can you try to see if it happens again with the latest build?

https://koji.fedoraproject.org/koji/buildinfo?buildID=918166
https://koji.fedoraproject.org/koji/buildinfo?buildID=918272

Thanks.

Comment 7 Wilfried Philips 2017-07-13 20:24:58 UTC
(In reply to Simone Caronni from comment #6)
> (In reply to Wilfried Philips from comment #0)
> > Additional info:
> > THis is after an upgrade from fedora 22 to fedora 26 using 
> > dnf system-upgrade.
> 
> Nice. Quite a jump.
Yes, and surprisingly few problems in the process (but needed to install
some keys; jumping more than 2 releases in one go does not seem to be encouraged) and a (too) slow process.

> 
> 
> Can you try to see if it happens again with the latest build?
> 
> https://koji.fedoraproject.org/koji/buildinfo?buildID=918166
> https://koji.fedoraproject.org/koji/buildinfo?buildID=918272
> 
> Thanks.
Same problem.

sudo dnf install https://kojipkgs.fedoraproject.org//packages/freerdp/2.0.0/29.20170710gitf580bea.fc26/x86_64/freerdp-server-2.0.0-29.20170710gitf580bea.fc26.x86_64.rpm  https://kojipkgs.fedoraproject.org//packages/freerdp/2.0.0/29.20170710gitf580bea.fc26/x86_64/freerdp-libs-2.0.0-29.20170710gitf580bea.fc26.x86_64.rpm https://kojipkgs.fedoraproject.org//packages/freerdp/2.0.0/29.20170710gitf580bea.fc26/x86_64/freerdp-2.0.0-29.20170710gitf580bea.fc26.x86_64.rpm https://kojipkgs.fedoraproject.org//packages/freerdp/2.0.0/29.20170710gitf580bea.fc26/x86_64/freerdp-debuginfo-2.0.0-29.20170710gitf580bea.fc26.x86_64.rpm https://kojipkgs.fedoraproject.org//packages/freerdp/2.0.0/29.20170710gitf580bea.fc26/x86_64/libwinpr-2.0.0-29.20170710gitf580bea.fc26.x86_64.rpm


winpr-makecert -rdp
Segmentation fault (core dumped)
 rpm -q -f `which winpr-makecert`
freerdp-2.0.0-29.20170710gitf580bea.fc26.x86_64

 valgrind  winpr-makecert -rdp
==14366== Memcheck, a memory error detector
==14366== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==14366== Using Valgrind-3.13.0 and LibVEX; rerun with -h for copyright info
==14366== Command: winpr-makecert -rdp
==14366== 
==14366== Invalid read of size 8
==14366==    at 0x559D670: RSA_generate_key_ex (rsa_gen.c:104)
==14366==    by 0x4E3E113: makecert_context_process (makecert.c:1022)
==14366==    by 0x10886F: main (main.c:39)
==14366==  Address 0x10 is not stack'd, malloc'd or (recently) free'd
==14366== 
==14366== 
==14366== Process terminating with default action of signal 11 (SIGSEGV): dumping core
==14366==  Access not within mapped region at address 0x10
==14366==    at 0x559D670: RSA_generate_key_ex (rsa_gen.c:104)
==14366==    by 0x4E3E113: makecert_context_process (makecert.c:1022)
==14366==    by 0x10886F: main (main.c:39)
==14366==  If you believe this happened as a result of a stack
==14366==  overflow in your program's main thread (unlikely but
==14366==  possible), you can try to increase the size of the
==14366==  main thread stack using the --main-stacksize= flag.
==14366==  The main thread stack size used in this run was 8388608.
==14366== 
==14366== HEAP SUMMARY:
==14366==     in use at exit: 1,724 bytes in 25 blocks
==14366==   total heap usage: 29 allocs, 4 frees, 3,457 bytes allocated
==14366== 
==14366== LEAK SUMMARY:
==14366==    definitely lost: 0 bytes in 0 blocks
==14366==    indirectly lost: 0 bytes in 0 blocks
==14366==      possibly lost: 0 bytes in 0 blocks
==14366==    still reachable: 1,724 bytes in 25 blocks
==14366==         suppressed: 0 bytes in 0 blocks
==14366== Rerun with --leak-check=full to see details of leaked memory
==14366== 
==14366== For counts of detected and suppressed errors, rerun with: -v
==14366== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)
Segmentation fault
-bash-4.4$

Comment 8 Simone Caronni 2017-07-14 06:44:25 UTC
There are tons of changes in the SSL part in these two pull requests (directly in those, or linked to other pull requests with other changes:

https://github.com/FreeRDP/FreeRDP/pull/3877
https://github.com/FreeRDP/FreeRDP/pull/3904

I think it's better to wait a bit. As always, no guarantee of the daily status of FreeRDP for the past 3 years.

Comment 9 Fedora Update System 2017-09-11 13:58:42 UTC
remmina-1.2.0-0.42.20170908git205df66.fc26 freerdp-2.0.0-34.20170831git3b83526.fc26 has been submitted as an update to Fedora 26. https://bodhi.fedoraproject.org/updates/FEDORA-2017-04e118f7b7

Comment 10 Fedora Update System 2017-09-11 13:59:04 UTC
remmina-1.2.0-0.42.20170908git205df66.fc25 freerdp-2.0.0-34.20170831git3b83526.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2017-4c8150d90d

Comment 11 Fedora Update System 2017-09-11 21:56:17 UTC
freerdp-2.0.0-34.20170831git3b83526.fc27, remmina-1.2.0-0.42.20170908git205df66.fc27 has been pushed to the Fedora 27 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-269afc3a9a

Comment 12 Fedora Update System 2017-09-12 01:23:27 UTC
freerdp-2.0.0-34.20170831git3b83526.fc26, remmina-1.2.0-0.42.20170908git205df66.fc26 has been pushed to the Fedora 26 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-04e118f7b7

Comment 13 Fedora Update System 2017-09-12 02:20:56 UTC
freerdp-2.0.0-34.20170831git3b83526.fc25, remmina-1.2.0-0.42.20170908git205df66.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2017-4c8150d90d

Comment 14 Fedora Update System 2017-09-22 18:51:41 UTC
freerdp-2.0.0-34.20170831git3b83526.fc26, remmina-1.2.0-0.42.20170908git205df66.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2017-09-22 23:23:13 UTC
freerdp-2.0.0-34.20170831git3b83526.fc25, remmina-1.2.0-0.42.20170908git205df66.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2017-09-30 06:23:25 UTC
freerdp-2.0.0-34.20170831git3b83526.fc27, remmina-1.2.0-0.42.20170908git205df66.fc27 has been pushed to the Fedora 27 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.