Bug#874727: libcoin80v5: Program using libcoin80v5 and any other library that uses lebexpat1 segfaults.

[mlampert]

Hi,

it breaks FreeCAD, the current version in Debian testing (0.16) and the next version (0.17) which is currently under development.

Steps to reproduce in FreeCAD 0.16:
* open new file
* create a box (or some other part)
* switch to Path workbench and create a project
* edit tool table
* if you don't already have a tool table xml file add a tool and "Export" the tool table
* "Import" the tool table -> segfault

HTH,
Markus


On Sat, 9 Sep 2017 22:11:47 +0200
Anton Gladky <gladk at debian.org> wrote:

> tags 874727 +moreinfo
> severity 874727 important
> thanks
> 
> Hi,
> 
> thank you for the bugreport. Please provide some more information,
> what packages in Debian are affected.
> 
> Thanks
> 
> Anton
> 
> 
> 2017-09-09 11:33 GMT+02:00 markus <mlampert at telus.net>:
> > Package: libcoin80v5
> > Version: 3.1.4~abc9f50+dfsg1-2
> > Severity: critical
> > Justification: breaks unrelated software
> >
> > Dear Maintainer,
> >
> > Due to the change in libexpat1 (since 2.2.0, currently at 2.2.3)
> > the included copy of it in libcoin results in segfaults of any
> > program that uses libexpat1. Specifically any program that uses xml
> > from python and links against libcoin will segfault.
> >
> > The stacktrace looks like it is a problem with libexpat1 leading to
> > a segfault in XML_SetHashSalt - however looking at that function
> > there is no way it could possibly segfault - unless of course the
> > provided XMLParser pointer does not actually point to what expat
> > expects to be an XMLParser - which is indeed the case because the
> > XMLParser instance was created by a call into lobcoin which is
> > still on libexpat 2.2.0.