Bug 1676481 - libxdg-basedir has out-of-bounds error
Summary: libxdg-basedir has out-of-bounds error
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libxdg-basedir
Version: 29
Hardware: Unspecified
OS: Unspecified
unspecified
high
Target Milestone: ---
Assignee: Gwyn Ciesla
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-02-12 12:19 UTC by Anders Blomdell
Modified: 2019-02-22 03:13 UTC (History)
1 user (show)

Fixed In Version: libxdg-basedir-1.2.0-17.fc29
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-02-22 03:13:13 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Make sure libtoolized tests be properly checked by valgrind (483 bytes, patch)
2019-02-12 12:22 UTC, Anders Blomdell
no flags Details | Diff
Fix bounds error (575 bytes, patch)
2019-02-12 12:24 UTC, Anders Blomdell
no flags Details | Diff
Proposed changes to .spec file (1.15 KB, patch)
2019-02-12 12:25 UTC, Anders Blomdell
no flags Details | Diff
Make sure libtoolized tests be properly checked by valgrind (394 bytes, patch)
2019-02-13 09:51 UTC, Anders Blomdell
no flags Details | Diff
Proposed changes to .spec file (1.15 KB, patch)
2019-02-13 09:52 UTC, Anders Blomdell
no flags Details | Diff

Description Anders Blomdell 2019-02-12 12:19:55 UTC
Description of problem:

  libxdg-basedir has an out of bounds error

Version-Release number of selected component (if applicable):

  libxdg-basedir-1.2.0-14.fc29.x86_64

How reproducible:

  Always

Steps to Reproduce:
1. Compile the program in 'Additional info' 
2. Run it with valgrind

Actual results:

==8658== Invalid write of size 8
==8658==    at 0x489597E: ??? (in /usr/lib64/libxdg-basedir.so.1.2.0)
==8658==    by 0x4895F93: xdgSearchableConfigDirectories (in /usr/lib64/libxdg-basedir.so.1.2.0)
==8658==    by 0x401157: main (foo.c:7)
==8658==  Address 0x4a6304e is 14 bytes inside a block of size 21 alloc'd
==8658==    at 0x483880B: malloc (vg_replace_malloc.c:309)
==8658==    by 0x489594D: ??? (in /usr/lib64/libxdg-basedir.so.1.2.0)
==8658==    by 0x4895F93: xdgSearchableConfigDirectories (in /usr/lib64/libxdg-basedir.so.1.2.0)
==8658==    by 0x401157: main (foo.c:7)
==8658== 
==8658== Invalid read of size 1
==8658==    at 0x483BC94: __strlen_sse2 (vg_replace_strmem.c:463)
==8658==    by 0x490DB85: puts (in /usr/lib64/libc-2.28.so)
==8658==    by 0x401174: main (foo.c:11)
==8658==  Address 0x4a63055 is 0 bytes after a block of size 21 alloc'd
==8658==    at 0x483880B: malloc (vg_replace_malloc.c:309)
==8658==    by 0x489594D: ??? (in /usr/lib64/libxdg-basedir.so.1.2.0)
==8658==    by 0x4895F93: xdgSearchableConfigDirectories (in /usr/lib64/libxdg-basedir.so.1.2.0)
==8658==    by 0x401157: main (foo.c:7)

Expected results:

No errors

Additional info:

/* compile with 'gcc -g -o foo foo.c -lxdg-basedir' */
#include <basedir.h>
#include <stdlib.h>
#include <stdio.h>

int main()
{
        const char * const *config_paths = xdgSearchableConfigDirectories(NULL);
        const char * const *path;

        for (path = config_paths ; *path ; path++) {
          printf("%s\n", *path);
        }
        free((const char **)config_paths);

        return 0;
}

Comment 1 Anders Blomdell 2019-02-12 12:22:56 UTC
Created attachment 1534020 [details]
Make sure libtoolized tests be properly checked by valgrind

Comment 2 Anders Blomdell 2019-02-12 12:24:59 UTC
Created attachment 1534022 [details]
Fix bounds error

Comment 3 Anders Blomdell 2019-02-12 12:25:54 UTC
Created attachment 1534023 [details]
Proposed changes to .spec file

Comment 4 Anders Blomdell 2019-02-12 12:33:09 UTC
The upstream seems to have moved, probably to https://github.com/devnev/libxdg-basedir, where master
contains the bug fix, and a pull-request for the valgrind check has been submitted.

Comment 5 Gwyn Ciesla 2019-02-12 15:36:05 UTC
Looks like the tests fail on f29 for ppc64 but pass on rawhide. Disable checks or leave it in rawhide only?

Comment 6 Anders Blomdell 2019-02-12 18:23:44 UTC
Don´t have access to ppc64 system, but failure logs might give some insight?

Comment 7 Gwyn Ciesla 2019-02-12 19:06:23 UTC
This is the log. It's actually ppc64le, but no, I don't have one either. :)

https://kojipkgs.fedoraproject.org//work/tasks/3884/32763884/build.log

Comment 8 Anders Blomdell 2019-02-12 19:26:42 UTC
Looks like a bug in libc, triggered by /bin/bash (probably the libtool script that calls the executable in the .libs subdirectory in tests/). To verify this, I think the query-harness could be hacked to call the .libs test directly with LD_LIBRARY_PATH set to the location of the .so file.

What do I have to do to run builds in kojipkgs.fedoraproject.org?

Comment 9 Gwyn Ciesla 2019-02-12 19:44:59 UTC
You'd need a valid FAS login. If you have what I'd need to run, I can test it.

Comment 10 Anders Blomdell 2019-02-12 20:00:50 UTC
First try might be to do a 

export LC_ALL=C

in query-harness.sh, and hope that set_locale skips the call to nl_find_locale (or takes a different code path), 
will try to come up with something tomorrow.

Comment 11 Anders Blomdell 2019-02-13 09:51:14 UTC
Created attachment 1534336 [details]
Make sure libtoolized tests be properly checked by valgrind

Comment 12 Anders Blomdell 2019-02-13 09:52:41 UTC
Created attachment 1534337 [details]
Proposed changes to .spec file

Comment 13 Anders Blomdell 2019-02-13 09:54:01 UTC
Google is my friend, libtool is now used to avoid checking sanity of libtool generated bash script.

Comment 14 Gwyn Ciesla 2019-02-13 14:25:01 UTC
Failed scratch build log: https://kojipkgs.fedoraproject.org//work/tasks/9157/32779157/build.log

Comment 15 Anders Blomdell 2019-02-13 16:25:19 UTC
Patch 1 & 2 not applied!

Comment 17 Anders Blomdell 2019-02-13 16:52:57 UTC
Hmm, libtool is used in %build, but comes from ../libtool, so it´s either that or libtool-devel, I guess...

Comment 18 Gwyn Ciesla 2019-02-13 17:32:43 UTC
I BuildRequired libtool, and it worked. I'll commit and get builds out. Thanks!

Comment 19 Anders Blomdell 2019-02-13 19:39:47 UTC
Thank you!

Comment 20 Fedora Update System 2019-02-13 19:44:26 UTC
libxdg-basedir-1.2.0-17.fc29 has been submitted as an update to Fedora 29. https://bodhi.fedoraproject.org/updates/FEDORA-2019-ccbdc3cb5b

Comment 21 Fedora Update System 2019-02-14 02:34:59 UTC
libxdg-basedir-1.2.0-17.fc29 has been pushed to the Fedora 29 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2019-ccbdc3cb5b

Comment 22 Fedora Update System 2019-02-22 03:13:13 UTC
libxdg-basedir-1.2.0-17.fc29 has been pushed to the Fedora 29 stable repository. If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.