Bug 1780628 - free(): double free detected in tcache 2
Summary: free(): double free detected in tcache 2
Keywords:
Status: CLOSED DUPLICATE of bug 1780057
Alias: None
Product: Fedora
Classification: Fedora
Component: gnupg2
Version: 31
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: ---
Assignee: Red Hat Crypto Team
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2019-12-06 14:57 UTC by Dave Cantrell
Modified: 2019-12-06 16:09 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2019-12-06 15:02:44 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)

Description Dave Cantrell 2019-12-06 14:57:28 UTC
I updated my F31 system yesterday and the pass(1) program stopped working.  I use pass for my password manager and it's basically just a huge bash script to make managing gpg-encrypted passwords in git easier.

After updating, I started getting this every time I would run pass (this is just an example):

[dcantrel@awvr ~]$ pass app-passwords/david.l.cantrell
free(): double free detected in tcache 2

Running valgrind pointed to bash, so that's where I have concentrated my debugging.  I first updated to the bash from rawhide (checked out from dist-git and built locally with mock for F31).  That produced the same error.  Likewise I saw bash on the f30 branch is the same version in rawhide and f31.

Next I downgraded to bash-4.4.23 from F29 and that still gave me the same error.  I'm beginning to think the error is elsewhere.

Digging in further, it looks like gpg2 is the source.  I tried this, which is sort of what pass(1) would do:

[dcantrel@awvr ~]$ gpg2 -d -o - .password-store/app-passwords/david.l.cantrell.gpg
gpg: using "62977BB9C841B965" as default secret key for signing
gpg: anonymous recipient; trying secret key 0x877D767041632AEA ...
gpg: okay, we are the anonymous recipient.
free(): double free detected in tcache 2
zsh: abort      gpg2 -d -o - .password-store/app-passwords/david.l.cantrell.gpg

OK, now I feel like I'm getting somewhere.  I see that package was updated on 03-Dec, so I tried the previous build to see if behavior restored.  And that's when I found commit d7747268e4afbcd9576101d8a13162caa4917304 in gnupg2 in dist-git and it looks like the problem was fixed yesterday via bug #1780057.

I'm going to give that a try.... [approx 10 minutes later] and it fixes it.  Hooray!

Can you do an F31 update for gnupg2 that includes the fix?

Comment 1 Tomas Mraz 2019-12-06 15:02:44 UTC

*** This bug has been marked as a duplicate of bug 1780057 ***

Comment 2 Tomas Mraz 2019-12-06 15:04:46 UTC
The update in testing is linked in the bug 1780057 already.

Comment 3 Dave Cantrell 2019-12-06 16:09:26 UTC
My mistake.  Thanks!


Note You need to log in before you can comment on or make changes to this bug.