Bug#990697: unblock: gnome-desktop3/3.38.5-3

[Gunnar Hjalmarsson]

Package: release.debian.org
Severity: normal
User: release.debian.org at packages.debian.org
Usertags: unblock
X-Debbugs-Cc: pkg-gnome-maintainers at lists.alioth.debian.org

Please unblock package gnome-desktop3.

[ Reason ]

Cherry picked upstream commit to fix segfault when adding input sources 
while show-all-sources is "true". The problem was reported in 
<https://bugs.debian.org/989045>.

[ Impact ]

Without the fix, GNOME users can't make use of the so-called "exotic" 
XKB keyboard layouts. Let's not ship Debian 11 with that bug, even if 
only a minor portion of the users are affected.

[ Tests ]

Manually installed the binaries built by version 3.38.5-3 of the 
gnome-desktop3 source, and confirmed that the bug was fixed as expected.

[ Risks ]

The change is a targeted fix to address the issue at hand. It was 
committed upstream on April 22, and no reported regression.

[ Checklist ]
   [x] all changes are documented in the d/changelog
   [x] I reviewed all changes and I approve them
   [x] attach debdiff against the package in testing

-- 
Cheers,
Gunnar Hjalmarsson
-------------- next part --------------
diff --git a/debian/changelog b/debian/changelog
index 80634e36..d39f84fc 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,12 @@
+gnome-desktop3 (3.38.5-3) unstable; urgency=medium
+
+  * Team upload
+  * d/p/xkbinfo-only-insert-new-layouts-skip-over-duplicate-ones.patch:
+    Fix segfault when adding input sources while show-all-sources is
+    "true" (closes: #989045).
+
+ -- Gunnar Hjalmarsson <gunnarhj at debian.org>  Sun, 04 Jul 2021 15:40:52 +0200
+
 gnome-desktop3 (3.38.5-2) unstable; urgency=medium
 
   * Team upload
diff --git a/debian/patches/series b/debian/patches/series
index 6b64c79b..0630c1a8 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -4,3 +4,4 @@ xkbinfo-refactor-some-of-the-rules-parsing.patch
 test-convert-the-xkbinfo-test-to-produce-YAML.patch
 xkbinfo-use-libxkbregistry-to-parse-the-rules-files-for-u.patch
 xkbinfo-Update-iso639Ids-correctly-in-evdev.patch
+xkbinfo-only-insert-new-layouts-skip-over-duplicate-ones.patch
diff --git a/debian/patches/xkbinfo-only-insert-new-layouts-skip-over-duplicate-ones.patch b/debian/patches/xkbinfo-only-insert-new-layouts-skip-over-duplicate-ones.patch
new file mode 100644
index 00000000..1274aae8
--- /dev/null
+++ b/debian/patches/xkbinfo-only-insert-new-layouts-skip-over-duplicate-ones.patch
@@ -0,0 +1,53 @@
+From: Peter Hutterer <peter.hutterer at who-t.net>
+Date: Thu, 22 Apr 2021 01:29:18 +0000
+Subject: xkbinfo: only insert new layouts, skip over duplicate ones
+
+This matches the behavior to the one in the old code path before
+libxkbregistry.
+
+This also fixes a use-after-free bug when a duplicate layout is present. The
+same layout struct is a member of multiple hashtables, specifically
+priv->layouts_table, priv->layouts_by_language and  priv->layouts_by_country.
+
+When the duplicate layout is added, add_layouts calls g_hash_table_replace
+(priv->layouts_table, l->id, l) which frees the original layout - but the
+layouts_by_{country|language} still have that now-freed layout.
+Immediately afterwards, add_layouts calls add_layout_to_locale_tables () which
+calls add_layout_to_table () which triggers a use-after-free.
+
+Avoid all this by simply skipping any duplicate layout.
+
+Reproducible with
+  gsettings set org.gnome.desktop.input-sources show-all-sources true
+  valgrind /usr/libexec/gnome-desktop-debug/test-xkb-info
+
+Requires xkeyboard-config <= 2.32, it has a duplicate cm(mmuock) entry
+(one is marked exotic, hence the need for show-all-sources).
+
+Origin: concatenation of:
+ https://gitlab.gnome.org/GNOME/gnome-desktop/-/commit/a39dd0d2
+ https://gitlab.gnome.org/GNOME/gnome-desktop/-/commit/81c6cd79
+Bug: https://gitlab.gnome.org/GNOME/gnome-desktop/-/issues/190
+Bug-Debian: https://bugs.debian.org/989045
+Bug-Ubuntu: https://launchpad.net/bugs/1933022
+---
+ libgnome-desktop/gnome-xkb-info.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/libgnome-desktop/gnome-xkb-info.c b/libgnome-desktop/gnome-xkb-info.c
+index b2eca699..f2a3214b 100644
+--- a/libgnome-desktop/gnome-xkb-info.c
++++ b/libgnome-desktop/gnome-xkb-info.c
+@@ -268,6 +268,12 @@ add_layouts (GnomeXkbInfo        *self,
+           l->iso3166Ids = g_slist_prepend (l->iso3166Ids, id);
+         }
+ 
++      if (g_hash_table_contains (priv->layouts_table, l->id))
++        {
++          g_clear_pointer (&l, free_layout);
++          continue;
++        }
++
+       g_hash_table_replace (priv->layouts_table, l->id, l);
+       add_layout_to_locale_tables (l,
+                                    priv->layouts_by_language,
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 495 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20210705/d8d7055d/attachment.sig>