Bug#1094197: libfolia: FTBFS almost everywhere: ../test-driver: line 112: 3579 Segmentation fault "$@" >> "$log_file" 2>&1

[Chris Hofstaedtler]

On Sun, Jan 26, 2025 at 10:16:29PM +0100, Chris Hofstaedtler wrote:
> On Sun, Jan 26, 2025 at 08:14:19PM +0100, Maarten van Gompel wrote:
> > Thanks for the report. I don't really know how to go about solving this.
> > I've tried to reproduce this inside a debian:testing container on an
> > actual arm64 system but it doesn't reproduce. The libfolia package builds fine
> > on my arm64 system (I don't have access to any of the other
> > architectures). I wonder if it stumbles on something specific on the
> > builder systems... If you can get a gdb backtrace we might be able to
> > dive deeper.
> > 
> > Example of successful run on ARM64:
> [..]
> 
> For me it also segfaults on amd64:
> 
> $ sbuild -d unstable libfolia_2.21-1.dsc
> ...
> make[3]: Entering directory '/build/reproducible-path/libfolia-2.21/src'
> g++ -DHAVE_CONFIG_H -I. -I..  -I../include -Wdate-time -D_FORTIFY_SOURCE=2 -std=c++17 -g -O0 -W -Wall -pedantic -g -O2 -ffile-prefix-map=/build/reproducible-path/libfolia-2.21=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -pthread -I/usr/include/libxml2  -fopenmp   -c -o simpletest.o simpletest.cxx
> /bin/bash ../libtool  --tag=CXX   --mode=link g++ -std=c++17 -g -O0 -W -Wall -pedantic -g -O2 -ffile-prefix-map=/build/reproducible-path/libfolia-2.21=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -pthread -I/usr/include/libxml2  -fopenmp    -Wl,-z,relro -o simpletest simpletest.o libfolia.la -licuio -licui18n -licuuc -licudata  -lticcutils  -lxml2  -lpthread
> libtool: link: g++ -std=c++17 -g -O0 -W -Wall -pedantic -g -O2 -ffile-prefix-map=/build/reproducible-path/libfolia-2.21=. -fstack-protector-strong -fstack-clash-protection -Wformat -Werror=format-security -fcf-protection -I/usr/include/libxml2 -fopenmp -Wl,-z -Wl,relro -o .libs/simpletest simpletest.o  ./.libs/libfolia.so -licuio -licui18n -licuuc -licudata -lticcutils -lxml2 -lpthread -fopenmp -pthread
> make[3]: Leaving directory '/build/reproducible-path/libfolia-2.21/src'
> make  check-TESTS
> make[3]: Entering directory '/build/reproducible-path/libfolia-2.21/src'
> make[4]: Entering directory '/build/reproducible-path/libfolia-2.21/src'
> ../test-driver: line 112:  3591 Segmentation fault      (core dumped) "$@" >> "$log_file" 2>&1
> FAIL: simpletest
> 
> This being inside a quite default sbuild+unshare setup.

>From what I can tell libfolio crashes in its static initializer
because getaddrinfo fails, and then it tries to deallocate the
results of getaddrinfo, but there were no results, so it frees an
invalid pointer.


Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
Core was generated by `/build/reproducible-path/libfolia-2.21/src/.libs/simpletest'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000ffffa12fcae4 in __GI_freeaddrinfo (ai=0xffff00000001) at ./nss/getaddrinfo.c:2626

warning: 2626   ./nss/getaddrinfo.c: No such file or directory
(gdb) bt full
#0  0x0000ffffa12fcae4 in __GI_freeaddrinfo (ai=0xffff00000001) at ./nss/getaddrinfo.c:2626
        p = 0xffff00000001
#1  0x0000ffffa1ac9758 [PAC] in folia::get_fqdn[abi:cxx11]() () at ./src/folia_utils.cxx:709
        result = "unknown"
        hints = {ai_flags = 2, ai_family = 0, ai_socktype = 1, ai_protocol = 0, ai_addrlen = 0, ai_addr = 0x0, ai_canonname = 0x0, ai_next = 0x0}
        info = 0xffff00000001
        gai_result = <optimized out>
        hostname = "sbuild\000\000\020", '\000' <repeats 15 times>, "*\001:\001%\000\000\000\220\205<\241\377\377\000\000\001", '\000' <repeats 15 times>, "\001", '\000' <repeats 15 times>, "\001\000\000\000\377\377\000\000\220\027\370\241\377\377\000\000\360A\205\310\377\377\000\000\\e\365\241\377\377w\000PA\205\310\377\377\000\000\370\v\365\241\377\377e\000:\242c\241\377\377\000\000\000\200\370\241\377\377\000\000\214Ia\241\377\377\000\0000Za\241\377\377\000\0000\022\370\241\377\377\000\000ȝ\263\241\377\377\000\0000\022\370\241\377\377\000\000(B\205\310\377\377\000\000$B\205\310\377\377\000\000\260A\205\310\377\377\000\000P"...
        p = <optimized out>
#2  0x0000ffffa1a6acf4 [PAC] in folia::(anonymous namespace)::initializer::initializer (this=0xffffa1f31a70 <folia::(anonymous namespace)::i>) at ./src/folia_properties.cxx:2387
No locals.
#3  __static_initialization_and_destruction_0 () at ./src/folia_properties.cxx:2395
No locals.
#4  0x0000ffffa1f4cbac [PAC] in call_init (l=<optimized out>, argc=1, argv=0xffffc8857d58, env=0xffffc8857d68) at ./elf/dl-init.c:74
        j = 0
        jm = <optimized out>
        addrs = <optimized out>
        init_array = <optimized out>
        __PRETTY_FUNCTION__ = "call_init"
        init_array = <optimized out>
        j = <optimized out>
        jm = <optimized out>
        addrs = <optimized out>
#5  call_init (l=<optimized out>, argc=1, argv=0xffffc8857d58, env=0xffffc8857d68) at ./elf/dl-init.c:26
        init_array = <optimized out>
        __PRETTY_FUNCTION__ = "call_init"
        j = <optimized out>
        jm = <optimized out>
        addrs = <optimized out>
#6  0x0000ffffa1f4ccc0 [PAC] in _dl_init (main_map=0xffffa1f8a350, argc=1, argv=0xffffc8857d58, env=0xffffc8857d68) at ./elf/dl-init.c:121
        preinit_array = 0x0
        preinit_array_size = <optimized out>
        i = <optimized out>
#7  0x0000ffffa1f63038 [PAC] in _start () at ../sysdeps/aarch64/dl-start.S:46
No locals.


So what gets called is:

1) Static initializer in folia_properties.cxx: static initializer i;
2) Constructor of that calls get_fqdn()
3) get_fqdn in folia_utils.cxx calls gethostname, which probably fails, and falls back to hostname "unknown"
4) get_fqdn calls getaddrinfo for the hostname "unknown" and service "http"
4) This getaddrinfo call predictably fails
5) Line 709 calls freeaddrinfo on res, but I highly doubt res can be valid here
6) you get a crash inside glibc

Don't know why it built on x86-conova-02 for i386.

Chris