*** This bug is a security vulnerability ***
Public security bug reported:
localsearch-extractor-3 3.11.2-1 segfaults in a loop (every ~2s) on one file.
Started after upgrading glib 2.88 -> 2.90.0-1 and libc6 2.43 -> 2.44 on
2026-09-24 (Ubuntu 26.10 dev branch)
Trigger: a gzip file with a .abw extension (from a Bazel/TensorFlow cache):
.../third_party/icu/data/icu_conversion_data.c.gz.abw
The AbiWord extractor fails on it. The extractor then crashes while logging:
#9 g_log (log_domain="Tracker", G_LOG_LEVEL_WARNING,
format="Task for '%s' finished with error: %s\n")
#10 tracker_decorator_info_complete_error (info=..., error=0x7f144c00a6b0)
at ../src/extractor/tracker-decorator.c:203
#11 get_metadata_cb (...) at ../src/extractor/tracker-decorator.c:811
#12 g_task_return_now (...) at ../../../gio/gtask.c:1367
The URI argument is valid, but the Error struct is garbage:
(gdb) p *error
{domain = 3175376602, code = 32531, message = 0x80ad02f874749c8c}
Reproduce: rename any gzip file to test.abw somewhere under an indexed
directory.
ProblemType: Crash
DistroRelease: Ubuntu 26.10
Package: localsearch 3.11.2-1
ProcVersionSignature: Ubuntu 7.3.0-5.5-generic 7.3.0-rc3
Uname: Linux 7.3.0-5-generic x86_64
ApportVersion: 2.36.0-0ubuntu1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: KDE
Date: Fri Sep 25 11:23:25 2026
ExecutablePath: /usr/libexec/localsearch-extractor-3
InstallationDate: Installed on 2026-01-21 (247 days ago)
InstallationMedia: Kubuntu 25.10 "Questing Quokka" - Release amd64 (20251007)
ProcCmdline: /usr/libexec/localsearch-extractor-3 --socket-fd 3
SegvAnalysis:
Segfault happened at: 0x725de39c1fdc <__strlen_evex512+28>: vpcmpeqb
(%rdi),%zmm16,%k0
PC (0x725de39c1fdc) ok
source "(%rdi)" (0xca8c7882ee2dd6e) not located in a known VMA region (needed
readable region)!
destination "%zmm16" ok
SegvReason: reading unknown VMA
Signal: 11
SignalName: SIGSEGV
SourcePackage: localsearch
StacktraceTop:
??? ()
??? ()
??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
Title: localsearch-extractor-3 crashed with SIGSEGV in ???()
UpgradeStatus: Upgraded to stonking on 2026-09-24 (1 days ago)
UserGroups: adm cdrom dip docker libvirt lpadmin pcscd plugdev render
sambashare sudo video
separator:
** Affects: localsearch (Ubuntu)
Importance: Undecided
Status: New
** Tags: amd64 apport-crash need-amd64-retrace stonking third-party-packages
wayland-session
** Attachment added: "backtrace of the error"
https://bugs.launchpad.net/bugs/2168518/+attachment/6002502/+files/backtrace.txt
** Information type changed from Private to Public
** Information type changed from Public to Public Security
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168518
Title:
localsearch-extractor-3 crashes on use-after-free of GError in
tracker_decorator_info_complete_error()
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/localsearch/+bug/2168518/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
