Your message dated Sun, 13 Nov 2022 18:57:29 +0000 with message-id <[email protected]> and subject line Bug#998897: fixed in sip4 4.19.25+dfsg-5 has caused the Debian Bug report #998897, regarding python3-sip: Thread 1 "python" received signal SIGSEGV, Segmentation fault. to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 998897: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=998897 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---Package: python3-sip Version: 4.19.14+dfsg-2 Severity: important Tags: upstream Dear Maintainer, Sometimes during startup (depend on python code, comment line can affect this) my software crashes with segmentation fault in python-sip. Gdb backtrace: Thread 1 "python" received signal SIGSEGV, Segmentation fault. add_object (om=0x7ffff6cfafa0 <cppPyMap>, addr=<optimized out>, val=0x7fffb97eff28) at ./siplib/objmap.c:286 286 ./siplib/objmap.c: Нет такого файла или каталога. (gdb) bt #0 0x00007ffff6ced648 in add_object (om=0x7ffff6cfafa0 <cppPyMap>, addr=<optimized out>, val=0x7fffb97eff28) at ./siplib/objmap.c:286 #1 0x00007ffff6cedb1b in sipOMAddObject (om=om@entry=0x7ffff6cfafa0 <cppPyMap>, val=val@entry=0x7fffb97eff28) at ./siplib/objmap.c:162 #2 0x00007ffff6ceb562 in sipSimpleWrapper_init (self=0x7fffb97eff28, args= (<Grid(_layout=<QGridLayout at remote 0x7fffb97ef640>, ncol=3, n=10) at remote 0x7fffb97ef5a8>,), kwds=0x0) at ./siplib/siplib.c:10646 #3 0x00005555556bf148 in wrap_init (kwds=<optimized out>, wrapped=0x7ffff6ceb300 <sipSimpleWrapper_init>, args=(<Grid(_layout=<QGridLayout at remote 0x7fffb97ef640>, ncol=3, n=10) at remote 0x7fffb97ef5a8>,), self=<optimized out>) at ../Objects/typeobject.c:4928 #4 0x00005555556bf148 in wrapper_call (wp=wp@entry=<method-wrapper '__init__' of Label object at 0x7fffb97eff28>, args=args@entry=(<Grid(_layout=<QGridLayout at remote 0x7fffb97ef640>, ncol=3, n=10) at remote 0x7fffb97ef5a8>,), kwds=<optimized out>) at ../Objects/descrobject.c:1035 #5 0x000055555564ebf7 in PyObject_Call (kw=0x0, arg=(<Grid(_layout=<QGridLayout at remote 0x7fffb97ef640>, ncol=3, n=10) at remote 0x7fffb97ef5a8>,), func=<method-wrapper '__init__' of Label object at 0x7fffb97eff28>) at ../Objects/abstract.c:2544 #6 0x000055555564ebf7 in PyEval_CallObjectWithKeywords (func=<method-wrapper '__init__' of Label object at 0x7fffb97eff28>, arg=(<Grid(_layout=<QGridLayout at remote 0x7fffb97ef640>, ncol=3, n=10) at remote 0x7fffb97ef5a8>,), kw=<optimized out>) at ../Python/ceval.c:4245 #7 0x00005555556f1ffb in wrapperdescr_call (descr=descr@entry=0x7ffff7585d20, args=(<Grid(_layout=<QGridLayout at remote 0x7fffb97ef640>, ncol=3, n=10) at remote 0x7fffb97ef5a8>,), kwds=<optimized out>) at ../Objects/descrobject.c:343 #8 0x0000555555626883 in PyObject_Call (func=<wrapper_descriptor at remote 0x7ffff7585d20>, arg=<optimized out>, kw=<optimized out>) at ../Objects/abstract.c:2544 #9 0x0000555555647212 in ext_do_call (nk=<optimized out>, na=<optimized out>, flags=<optimized out>, pp_stack=0x7fffffffb750, func=<wrapper_descriptor at remote 0x7ffff7585d20>) at ../Python/ceval.c:4690 #10 0x0000555555647212 in PyEval_EvalFrameEx (f=<optimized out>, throwflag=<optimized out>) at ../Python/ceval.c:3052 Looks the problem in add_object in siplib/objmap.cpp There two lines: /* * We are removing it from the map here. However, note * that we first have to call the destructor before marking * it as not being in the map, as the destructor itself * might end up trying to remove the wrapper and its * aliases from the map. In that case, if the wrapper is * already marked as not in the map, the removal will just * return early, leaving any potential aliases as stale * entries in the map. If we later try to wrap a different * object at the same address, we end up retrieving the * stale alias entry from the object map, triggering a * use-after-free when accessing its C++ object. */ sip_api_instance_destroyed(sw); sipSetNotInMap(sw); It seems first line frees sw, and second line can't write memory by sw. python-sip 4.16.4+dfsg-1 (debian 8), was ok, but in 4.19.14+dfsg-2 source changes: - /* We are removing it from the map here. */ + /* + * We are removing it from the map here. However, note + * that we first have to call the destructor before marking + * it as not being in the map, as the destructor itself + * might end up trying to remove the wrapper and its + * aliases from the map. In that case, if the wrapper is + * already marked as not in the map, the removal will just + * return early, leaving any potential aliases as stale + * entries in the map. If we later try to wrap a different + * object at the same address, we end up retrieving the + * stale alias entry from the object map, triggering a + * use-after-free when accessing its C++ object. + */ + sip_api_instance_destroyed(sw); sipSetNotInMap(sw); - sip_api_common_dtor(sw); May be it was not so good change ? Latest source is same as 4.19.14+dfsg-2, so I expect the bug exists until now. -- System Information: Debian Release: 10.11 APT prefers oldstable-updates APT policy: (500, 'oldstable-updates'), (500, 'oldstable-debug'), (500, 'oldstable') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.19.0-18-amd64 (SMP w/4 CPU cores) Kernel taint flags: TAINT_WARN, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8), LANGUAGE=ru_RU.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages python3-sip depends on: ii libc6 2.28-10 ii libgcc1 1:8.3.0-6 ii libstdc++6 8.3.0-6 ii python3 3.7.3-1 python3-sip recommends no packages. python3-sip suggests no packages. -- no debconf information
--- End Message ---
--- Begin Message ---Source: sip4 Source-Version: 4.19.25+dfsg-5 Done: Scott Talbert <[email protected]> We believe that the bug you reported is fixed in the latest version of sip4, which is due to be installed in the Debian FTP archive. A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [email protected], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Scott Talbert <[email protected]> (supplier of updated sip4 package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [email protected]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 13 Nov 2022 13:36:22 -0500 Source: sip4 Architecture: source Version: 4.19.25+dfsg-5 Distribution: unstable Urgency: medium Maintainer: Debian Python Team <[email protected]> Changed-By: Scott Talbert <[email protected]> Closes: 998897 1023913 Changes: sip4 (4.19.25+dfsg-5) unstable; urgency=medium . * Team upload. * Fix FTBFS with Python 3.11 (Closes: #1023913) * Fix use-after-free bug in siplib (Closes: #998897) Checksums-Sha1: 804ae24a510b76a94c74a7b0808f9fc9a247584e 2294 sip4_4.19.25+dfsg-5.dsc 510c7103b2dd324c4263d432de7d5f16111a5d2f 17900 sip4_4.19.25+dfsg-5.debian.tar.xz a53efeae96883c9105dd425ece8eadad46852b2b 9886 sip4_4.19.25+dfsg-5_amd64.buildinfo Checksums-Sha256: 8bf9eaf6b01e6df46ed3d64cb40adff273a66a79242f3ddfb062628c5dc2c4c6 2294 sip4_4.19.25+dfsg-5.dsc d051ece955c390205b67b156bbfb05da48c6688d200e94aecdc91994b2ebaf73 17900 sip4_4.19.25+dfsg-5.debian.tar.xz 3ec51e323f60befc3aa3bd21011d1b3fa23c049f4a1e88bb86aacf464f7063b6 9886 sip4_4.19.25+dfsg-5_amd64.buildinfo Files: d7816d393489da7fcc672f510e912fbd 2294 devel optional sip4_4.19.25+dfsg-5.dsc ee733fcc73e181413a953f3dacd6f713 17900 devel optional sip4_4.19.25+dfsg-5.debian.tar.xz 1e524b8ab72df382bf80855ae25e57f2 9886 devel optional sip4_4.19.25+dfsg-5_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQJDBAEBCgAtFiEEbnQ09Yl9Q7F/zVe3U9W8ZLUjeKIFAmNxOfYPHHN3dEB0ZWNo aWUubmV0AAoJEFPVvGS1I3iidXgQALJuAETmPE5KFGnRP2ncJLY6jyzCDrKOfLQL jzvnIcYmgz9wOXluwYKxWvsVxAA5C4XmRSOu6TR0v+Gz9HkXZBI4RhfHJekhXhxo WCUr76W7cysghDv4GR53k4a8rfixYplZb6g8v4ebdbocYeOZmq+ochL5ScHQW6n7 Htpex1cGMG1UMm52HgelIpUdiN5gCmPRyFyY1L3vp/NnYWJEqx+t0Dnk5yGIuD/5 8lrvrn/hKfUNB+P5ZeS2Mlhg78FxHQqSlNKZ3mCMywH0gy2FGL42LQlLEiK1BQJL 322rb1XEZ3GdXl5Y7YAX090Cd6V2Kj0pGrJwfR2qTGa0JljtaLjy9pMHRqr19m0c 9RPnMghVlHg//a8GQ8N/PRdFWRrAmcK78j/S4rO4ZXNk7kkPwibruRVSbwGu++AD JrZtYI5OwH7ZNONAqb9gqO0WpGJkqr8mXZw4GeJC2Nc9BqoX3Kdknw3ASQfA70SV HsykhtK8lFiH8IPzAN+y9LwAcmL9cglcPIKfjNZIfNTSURdvOjIH2ec1j9W3B6GX 0oDC10BxrVVUNdNPMsMGgeWRtcdrpNcRnFyzt3EoPAWT1V6nb5jBtTxCX2obvi62 qntAWwr8V7dNuI+kOleGd31w5PfOezp+yaMbgLVYrfKnb8oLVyrIgDotRgfbN4DF wmXlVIiC =AjX6 -----END PGP SIGNATURE-----
--- End Message ---
