[From nobody Tue Oct 20 19:51:05 2026
Received: (at submit) by bugs.debian.org; 21 Oct 2025 15:50:40 +0000
X-Spam-Checker-Version: SpamAssassin 4.0.1-bugs.debian.org_2005_01_02
 (2024-03-25) on buxtehude.debian.org
X-Spam-Level: 
X-Spam-Status: No, score=0.3 required=4.0 tests=AC_FROM_MANY_DOTS,BAYES_00,
 MD5_SHA1_SUM,MEDS2,RCVD_IN_PBL,RDNS_NONE,SPF_SOFTFAIL,
 XMAILER_REPORTBUG autolearn=no autolearn_force=no
 version=4.0.1-bugs.debian.org_2005_01_02
X-Spam-Bayes: score:0.0000 Tokens: new, 35; hammy, 149; neutral, 57; spammy,
 1. spammytokens:0.961-+--tips hammytokens:0.000-+--XDebbugsCc,
 0.000-+--X-Debbugs-Cc, 0.000-+--H*x:12.0.0, 0.000-+--H*UA:12.0.0,
 0.000-+--H*Ad:N*Bug
Return-path: <tj.iam.tj@proton.me>
Received: from [2a0d:3344:379:31f0::ff] (port=46768 helo=[127.0.0.1])
 by buxtehude.debian.org with esmtp (Exim 4.96)
 (envelope-from <tj.iam.tj@proton.me>) id 1vBEdC-00By75-11
 for submit@bugs.debian.org; Tue, 21 Oct 2025 15:50:40 +0000
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Tj <tj.iam.tj@proton.me>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: tests: kallistro: corrupted size vs. prev_size
Message-ID: <176106183135.1542354.7257011284613640349.reportbug@sunny>
X-Mailer: reportbug 12.0.0
Date: Tue, 21 Oct 2025 15:50:31 +0000
Delivered-To: submit@bugs.debian.org

Source: kallisto
Version: 0.48.0+dfsg-3
Severity: serious
Tags: ftbfs
Justification: fails to build from source (but built successfully in the past)
X-Debbugs-Cc: tj.iam.tj@proton.me

Following up with analysis after the test failure was mentioned by
Andreas in Matrix "Debian Tiny Tasks".

I do not have time to attack it and not familiar with the code-base but
this analysis should help.

Referring to the failed build log:

https://salsa.debian.org/med-team/kallisto/-/jobs/8480324#L2345

"corrupted size vs. prev_size" :- The direct cause is out-of-bounds writes into malloc control structure fields.

E.g: given `A = calloc(1, 16); B = calloc(1,16)` and A contiguous with B.
If `struct *S = A` and `sizeof(A) == sizeof(*S)` then S[0] is valid but S[1] is out-of-bounds and a 
write may trample on the control structure preamble of B.

>From what I can deduce it occurs in `ext/bifrost/src/CompactDBG.tcc::CompactDBG::construct()` template after line 3323 and before line 3331.
Most likely the reference to `size()` in line 3329.

if (opt.verbose) cout << "CompactedDBG::construct(): After join tips using mercy k-mers: " << size() << " unitigs" << endl;

https://salsa.debian.org/med-team/kallisto/-/blob/72ff60faebbab43eba75e55fe393d88de42116a5/ext/bifrost/src/CompactedDBG.tcc#L3323

Disabling `opt.verbose` would be an easy way to (dis)prove that.
]