Package: python3-apt
Version: 3.0.0
Severity: important
Tags: upstream
X-Debbugs-Cc: [email protected]
Dear Maintainer,
apt_pkg.config.value_list() segfaults when an apt configuration list
contains a non-ASCII byte.
Minimal reproducer:
import apt_pkg
import tempfile
apt_pkg.init_config()
with tempfile.NamedTemporaryFile("wb", delete=False) as f:
f.write(b'Test {\x80};\n')
p = f.name
apt_pkg.read_config_file(apt_pkg.config, p)
apt_pkg.config.value_list(“Test")
Actual result:
Segmentation fault inside apt_pkg.cpython-313-aarch64-linux-gnu.so
Expected result:
The malformed configuration should be rejected with an exception or
parse error instead of crashing the Python interpreter.
I originally hit this through unattended-upgrades after an invalid byte
was accidentally inserted in /etc/apt/apt.conf.d/50unattended-upgrades.
I reduced it to the python3-apt reproducer above.
This appears related to #995118, but affects
apt_pkg.config.value_list() rather than apt_pkg.TagSection.keys().
I also reproduced the issue on x86, so it does not appear to be
arm64-specific.
-- System Information:
Debian Release: 13.5
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: arm64 (aarch64)
Kernel: Linux 6.12.76-linuxkit (SMP w/12 CPU threads)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: unable to detect
Versions of packages python3-apt depends on:
ii distro-info-data 0.66+deb13u2
ii libapt-pkg7.0 3.0.3
ii libc6 2.41-12+deb13u3
ii libgcc-s1 14.2.0-19
ii libstdc++6 14.2.0-19
ii python-apt-common 3.0.0
ii python3 3.13.5-1
Versions of packages python3-apt recommends:
ii iso-codes 4.18.0-1
ii lsb-release 12.1-1
Versions of packages python3-apt suggests:
ii apt 3.0.3
pn python-apt-doc <none>
-- no debconf information
