https://bugs.kde.org/show_bug.cgi?id=525309
Bug ID: 525309
Summary: UI freeze when importing incompatible backup file
(hangs in PKCS5_PBKDF2_HMAC_SHA1)
Classification: Applications
Product: Keysmith
Version First 26.08.0
Reported In:
Platform: Arch Linux
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: General
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
DESCRIPTION
Keysmith hangs indefinitely on the main thread when attempting to import an
incompatible file (e.g. a .2fas backup file) using the "andOTP encrypted JSON"
option. KWin eventually flags the window as unresponsive ("Not Responding").
Attaching GDB shows the UI thread stuck in OpenSSL's PBKDF2 calculation loop
(PKCS5_PBKDF2_HMAC_SHA1 -> SHA1_Final). The application appears to lack
validation for input file schemas/iteration counts before passing them to the
crypto backend, while also running the decryption routine synchronously on the
Qt GUI thread.
STEPS TO REPRODUCE
1. Open Keysmith and go to Import Accounts.
2. Select format: "andOTP encrypted JSON".
3. Select an incompatible file (such as an encrypted .2fas file) and type any
password.
4. Click Import.
OBSERVED RESULT
The application window immediately freezes. The Qt event loop stops responding
to input/redraw events, requiring SIGTERM/SIGKILL.
EXPECTED RESULT
Keysmith should validate the file format/header before attempting key
derivation and fail gracefully with an error message (e.g., "Invalid file
format or password") without blocking the main event loop.
SOFTWARE/OS VERSIONS
Operating System: Arch Linux
KDE Plasma Version: 6.7.4
KDE Frameworks Version: 6.29.0
Qt Version: 6.11.2
Graphics Platform: Wayland
ADDITIONAL INFORMATION
Backtrace from GDB:
#0 0x00007ffff68810af in SHA1_Final () from /usr/lib/libcrypto.so.3
#1 0x00007ffff69235e3 in ?? () from /usr/lib/libcrypto.so.3
#2 0x00007ffff6795f4c in EVP_DigestFinal_ex () from /usr/lib/libcrypto.so.3
#3 0x00007ffff67ef42a in HMAC_Final () from /usr/lib/libcrypto.so.3
#4 0x00007ffff697acd2 in ?? () from /usr/lib/libcrypto.so.3
#5 0x00007ffff67d05a7 in ?? () from /usr/lib/libcrypto.so.3
#6 0x00007ffff67d0685 in PKCS5_PBKDF2_HMAC_SHA1 () from
/usr/lib/libcrypto.so.3
#7 0x000055555559f8c4 in ?? ()
#8 0x000055555558bc08 in ?? ()
#9 0x00007ffff560f13b in ?? () from /usr/lib/libQt6Core.so.6
#10 0x000055555558b394 in ?? ()
#11 0x00007ffff716c6e4 in ?? () from /usr/lib/libQt6Qml.so.6
#12 0x00007ffff7003870 in ?? () from /usr/lib/libQt6Qml.so.6
#13 0x00007ffff700464f in QV4::QObjectMethod::callPrecise(QQmlObjectOrGadget
const&, QQmlPropertyData const&, QV4::ExecutionEngine*, QV4::CallData*,
QMetaObject::Call) () from /usr/lib/libQt6Qml.so.6
#14 0x00007ffff700fe8b in QV4::QObjectMethod::callInternal(QV4::Value const*,
QV4::Value const*, int) const () from /usr/lib/libQt6Qml.so.6
#24 0x00007ffff4894d05 in QQuickAbstractButtonPrivate::trigger(bool) () from
/usr/lib/libQt6QuickTemplates2.so.6
#26 0x00007ffff48b729c in QQuickControl::mouseReleaseEvent(QMouseEvent*) ()
from /usr/lib/libQt6QuickTemplates2.so.6
--
You are receiving this mail because:
You are watching all bug changes.
