Regression in 22.04: segmentation fault when language is spanish

Bug #1988440 reported by JOSE
74
This bug affects 16 people
Affects Status Importance Assigned to Milestone
snap-store-desktop
Fix Released
Critical
Sergio Costas
libxmlb (Ubuntu)
Fix Released
Critical
Sergio Costas
Bionic
Won't Fix
Undecided
Sergio Costas
Focal
Fix Committed
Undecided
Sergio Costas
Jammy
Fix Committed
Undecided
Sergio Costas
Kinetic
Won't Fix
Critical
Sergio Costas

Bug Description

The discussion here describes the issue in full detail: https://forum.snapcraft.io/t/segment-fault-with-snap-store/31547

The bug was caused by a double-free in libxmlb, triggered by some specific data combination.

[Impact] This bug has been in the library since, at least, version 0.1.8, the one used in Bionic. Although the patch attached here fixes the problem in the "snap-store" snap, the bug is still present in the libraries distributed as .deb in Ubuntu, and also in the GNOME-42 extension snap. A patch has been sent both to the libxmlb repository (which has been accepted and merged) and to the Debian SALSA repository.

[Test plan] To test this bug, just download the GIT repository https://github.com/sergio-costas/test_libxmlb2 and follow the instructions. If the bug is there, valgrind will show an access to an already freed memory block and six CRITICAL errors will be shown by GLib.

[Where problems could occur] If another developer adds code that uses the 'xb_builder_xml_lang_prio_cb()' function and forgets to define a destruction function for the passed 'nodes_to_destroy' ptr_array, there would be a memory leak.

Changed in snap-store-desktop:
assignee: nobody → Sergio Costas (rastersoft-gmail)
importance: Undecided → Critical
status: New → In Progress
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

This should be fixed in "edge".

Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :
Changed in snap-store-desktop:
status: In Progress → Fix Committed
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

The fix is currently available in "edge".

Revision history for this message
Treno70 (atgm) wrote :

My language is italian but it's the same story

Changed in libxmlb (Ubuntu):
assignee: nobody → Sergio Costas (rastersoft-gmail)
status: New → Fix Released
importance: Undecided → Critical
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

I checked the GIT repository and the bug in libxmlb has been there since, at least, version 0.1.8, the one used in bionic, as is also in 0.1.15 (focal, impish), 0.3.6 (jammy) and 0.3.8 (kinetic).

Revision history for this message
Jorge Peinado (jpeinado) wrote :

Yes, fixed on the "edge" channel with:

#snap refresh --edge snap-store

Thank you for your work.

Changed in libxmlb (Ubuntu Jammy):
status: New → Triaged
Changed in libxmlb (Ubuntu Focal):
status: New → Triaged
Changed in libxmlb (Ubuntu Bionic):
status: New → Triaged
Changed in libxmlb (Ubuntu Jammy):
assignee: nobody → Sergio Costas (rastersoft-gmail)
Changed in libxmlb (Ubuntu Focal):
assignee: nobody → Sergio Costas (rastersoft-gmail)
Changed in libxmlb (Ubuntu Bionic):
assignee: nobody → Sergio Costas (rastersoft-gmail)
Revision history for this message
Ken VanDine (ken-vandine) wrote (last edit ):

The fix to the snap-store snap has been released to stable/ubuntu-22.04 and stable/ubuntu-22.10 tracks

description: updated
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

debdiff for Jammy.

Changed in libxmlb (Ubuntu Jammy):
status: Triaged → Fix Committed
Changed in libxmlb (Ubuntu Focal):
status: Triaged → In Progress
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

Debdiff for Focal

Changed in libxmlb (Ubuntu Focal):
status: In Progress → Fix Committed
Changed in libxmlb (Ubuntu Bionic):
status: Triaged → In Progress
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

Defdiff for Bionic

Changed in libxmlb (Ubuntu Bionic):
status: In Progress → Fix Committed
Revision history for this message
Sergio Costas (rastersoft-gmail) wrote :

For Kinetic, the patch has already been sent to salsa.debian.org: https://salsa.debian.org/efi-team/libxmlb/-/merge_requests/6

Changed in libxmlb (Ubuntu Jammy):
status: Fix Committed → In Progress
Changed in libxmlb (Ubuntu Focal):
status: Fix Committed → In Progress
Changed in libxmlb (Ubuntu Bionic):
status: Fix Committed → In Progress
Changed in libxmlb (Ubuntu Kinetic):
status: Fix Released → In Progress
Revision history for this message
Steve Langasek (vorlon) wrote :

bionic has reached the end of standard support and now only receives security fixes via the ESM archive. I am therefore marking this wontfix for bionic.

Changed in libxmlb (Ubuntu Bionic):
status: In Progress → Won't Fix
Changed in snap-store-desktop:
status: Fix Committed → Fix Released
Steve Langasek (vorlon)
Changed in libxmlb (Ubuntu):
status: In Progress → Fix Released
Revision history for this message
Steve Langasek (vorlon) wrote :

debdiff did not apply cleanly to kinetic due to whitespace issues, but I've fixed it up and sponsored the upload. Two other changes were necessary:
- bug number needs to be referenced in debian/changelog
- we need to run update-maintainer since this is an Ubuntu-specific upload

Revision history for this message
Steve Langasek (vorlon) wrote :

For jammy, the version number has been changed to 0.3.6-2ubuntu0.1.

Revision history for this message
Steve Langasek (vorlon) wrote :

Since this bug was originally filed, libxmlb in focal has been updated from 0.1.15-2 to 0.3.6-2build1~20.04.1; so we'll use the jammy patch here also.

Revision history for this message
Steve Langasek (vorlon) wrote : Please test proposed package

Hello JOSE, or anyone else affected,

Accepted libxmlb into kinetic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libxmlb/0.3.8-1ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-kinetic to verification-done-kinetic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-kinetic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in libxmlb (Ubuntu Kinetic):
status: In Progress → Fix Committed
tags: added: verification-needed verification-needed-kinetic
Changed in libxmlb (Ubuntu Jammy):
status: In Progress → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello JOSE, or anyone else affected,

Accepted libxmlb into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libxmlb/0.3.6-2ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in libxmlb (Ubuntu Focal):
status: In Progress → Fix Committed
tags: added: verification-needed-focal
Revision history for this message
Steve Langasek (vorlon) wrote :

Hello JOSE, or anyone else affected,

Accepted libxmlb into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/libxmlb/0.3.6-2ubuntu0.1~20.04.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Revision history for this message
Utkarsh Gupta (utkarsh) wrote :

Ubuntu 22.10 (Kinetic Kudu) has reached end of life, so this bug will not be fixed for that specific release.

Changed in libxmlb (Ubuntu Kinetic):
status: Fix Committed → Won't Fix
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.