Bug#1153080: libgweather4: SIGSEGV in libxml2 error path when MET Norway returns malformed XML (kills the gnome-shell session)
Sergey Nuchev
sergey.nuchev at gmail.com
Thu Nov 5 09:19:59 GMT 2026
Package: libgweather4
Version: 4.4.2-1build1
Severity: important
Tags: upstream
[ Observed on Ubuntu 24.04.5 LTS with gnome-shell
46.0-0ubuntu6~24.04.17. Filing here because the crashing code path is
libgweather's MET Norway XML parser, shipped in Debian as libgweather4
4.4.2-1. Please forward upstream if you consider this an upstream bug. ]
Summary
-------
When the MET Norway API (api.met.no) returns a malformed/truncated XML
body, libgweather's parser raises a libxml2 parse error and the process
segfaults, taking down the whole gnome-shell session. The session then
crash-loops back to the display manager: a pure network-side data
problem makes the desktop unusable.
Environment
-----------
Ubuntu 24.04.5 LTS (noble), X11 session, GNOME 46 / mutter 46.2
gnome-shell 46.0-0ubuntu6~24.04.17
libgweather-4-0t64 4.4.2-1build1
libxml2 2.9.14+dfsg-1.3ubuntu3.10
libsoup-3.0-0 3.4.4-5ubuntu0.10
libxkbregistry0 1.6.0-1build1
kernel 7.0.0-42-generic
Steps to reproduce
------------------
1. Shell weather enabled (org.gnome.shell.weather automatic-location
true, or a fixed location; here Saint Petersburg/ULLI, 59.9666N 30.3E).
2. api.met.no serves a truncated body for
/weatherapi/locationforecast/2.0/classic (observed 2026-11-05,
07:30-08:51 UTC): HTTP/2 200, content-type application/xml,
content-length 57018, server nginx/1.18.0, via Varnish (dalton-a),
x-backend-host b_157_249_79_168_loc. The body ends mid-attribute at
57018 bytes (exactly the declared length): "...<windSpeed id=\"ff\" mps"
with no closing </weatherdata>; 94 x "<location" vs 93 x "</location>".
xmllint: "-:270: parser error : expected '>'" / "Premature end of data
in tag location line 264". At the same time
/weatherapi/locationforecast/2.0/complete returned HTTP 502.
3. Log in. gnome-shell starts and dies about 2 seconds later: "Running
GNOME Shell (using mutter 46.2) as a X11 window and compositing manager"
then "GNOME Shell crashed with signal 11"; systemd reports
"org.gnome.Shell at x11.service: Main process exited, code=dumped,
status=11/SEGV". The unit restarts the shell 2-3 times, every attempt
crashing, then "Start request repeated too quickly" and the user is back
at the greeter.
Expected behaviour
------------------
A malformed or unavailable weather response must be handled as a normal
error: no weather data, shell keeps running.
Actual behaviour
----------------
SIGSEGV in the libxml2 error-reporting path (gdb, no debug symbols
installed):
#5 <signal handler called>
#6 ??? at libxkbregistry.so.0
#7 ??? at libxkbregistry.so.0
#8 ??? at libxml2.so.2
#9 __xmlRaiseError at libxml2.so.2
#10 ??? at libxml2.so.2
...
#14 xmlParseElement at libxml2.so.2
#15 xmlParseDocument at libxml2.so.2
#16 xmlParseMemory at libxml2.so.2
#17 ??? at libgweather-4.so.0
#18 ??? at libgio-2.0.so.0
#20 ??? at libsoup-3.0.so.0
The gnome-shell (gjs) side prints only one JS frame, ui/init.js:21, i.e.
the JS context is idle in the main loop: this is a native crash, not an
extension or script error. Full backtrace attached.
Analysis
--------
libgweather 4.4 links libxml2 (imports xmlParseMemory, xmlXPathEval,
...) and parses the MET Norway document with it. libxml2 2.9's
xmlSetStructuredErrorFunc() is process-global and is not thread-safe. In
this process libxkbregistry also parses XML with libxml2 (XKB rules via
xkb_context). The frames above __xmlRaiseError resolve into
libxkbregistry -- an unrelated module -- which is consistent with the
parse-error callback being invoked with another context's closure/user
data and then dereferencing it.
Suggested fixes (hypothesis, not verified):
* libgweather: parse with a context-local error handler
(xmlCtxtReadMemory() / xmlCtxtSetErrorHandler() where available), or use
GMarkup for MET Norway XML, and treat a parse failure as an ordinary error;
* libxkbregistry 1.6.0: do not install a process-global structured
error handler.
Reproducing without waiting for an outage
-----------------------------------------
Point the host at a local server that returns a truncated document and
then log in, e.g. echo "127.0.0.1 api.met.no" >> /etc/hosts plus a
TLS-terminating stub, or truncate a real response after N bytes with
mitmproxy / iptables length matching.
Additional data
---------------
* 8 crashes in a single boot while the server returned the truncated
document; none after their cache was refreshed to a valid document at
08:51:42 UTC.
* The cached bad response is attached
(libgweather-cache-truncated.xml.gz); it decompresses to 16138 bytes and
ends with "<windSpeed id=\"ff\" mps".
* Reproduces with all GNOME Shell extensions disabled (the shell sets
org.gnome.shell disable-user-extensions=true after repeated crashes) and
with all 31 extensions enabled -- extensions are not involved.
* A standalone gnome-shell on a scratch Xvfb display (same binary,
same dconf) does not crash: the failure needs the shell's weather
client, i.e. the network data, not the graphics stack. GPU (amdgpu / RX
580), OOM (62 GB RAM, swap untouched) and kernel (no amdgpu errors, no
oops) are excluded.
* Local workaround: disable the shell weather
(org.gnome.shell.weather automatic-location false, locations []).
Regards,
Sergey Nuchev
-------------- next part --------------
Core was generated by `/usr/bin/gnome-shell'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#0 __pthread_kill_implementation (no_tid=0, signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=11, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo at entry=11) at ./nptl/pthread_kill.c:89
#3 0x000071a8b644527e in __GI_raise (sig=11) at ../sysdeps/posix/raise.c:26
#4 0x00005d5ab48c6c16 in ??? ()
#5 0x000071a8b6445330 in <signal handler called> () at /lib/x86_64-linux-gnu/libc.so.6
#6 0x0000000000000001 in ??? ()
#7 0x000071a8b2b65572 in ??? () at /lib/x86_64-linux-gnu/libxkbregistry.so.0
#8 0x000071a8b2b659aa in ??? () at /lib/x86_64-linux-gnu/libxkbregistry.so.0
#9 0x000071a8b23b1881 in ??? () at /lib/x86_64-linux-gnu/libxml2.so.2
#10 0x000071a8b23ba1ed in __xmlRaiseError () at /lib/x86_64-linux-gnu/libxml2.so.2
#11 0x000071a8b23c1442 in ??? () at /lib/x86_64-linux-gnu/libxml2.so.2
#12 0x000071a8b23d5d0b in ??? () at /lib/x86_64-linux-gnu/libxml2.so.2
#13 0x000071a8b23d60e5 in ??? () at /lib/x86_64-linux-gnu/libxml2.so.2
#14 0x000071a8b23d6a73 in ??? () at /lib/x86_64-linux-gnu/libxml2.so.2
#15 0x000071a8b23d6ce8 in xmlParseElement () at /lib/x86_64-linux-gnu/libxml2.so.2
#16 0x000071a8b23dae54 in xmlParseDocument () at /lib/x86_64-linux-gnu/libxml2.so.2
#17 0x000071a8b23e005d in xmlParseMemory () at /lib/x86_64-linux-gnu/libxml2.so.2
#18 0x000071a83789c185 in ??? () at /lib/x86_64-linux-gnu/libgweather-4.so.0
#19 0x000071a8b6ee17bb in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#20 0x000071a8b6ee5713 in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#21 0x000071a864666064 in ??? () at /lib/x86_64-linux-gnu/libsoup-3.0.so.0
#22 0x000071a8b6ee17bb in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#23 0x000071a8b6ee5713 in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#24 0x000071a864663061 in ??? () at /lib/x86_64-linux-gnu/libsoup-3.0.so.0
#25 0x000071a8b6ee17bb in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#26 0x000071a8b6ee5713 in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#27 0x000071a8b6ebf993 in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#28 0x000071a8b6ee17bb in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#29 0x000071a8b6ee5713 in ??? () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
-------------- next part --------------
A non-text attachment was scrubbed...
Name: libgweather-cache-truncated.xml.gz
Type: application/gzip
Size: 1394 bytes
Desc: not available
URL: <http://alioth-lists.debian.net/pipermail/pkg-gnome-maintainers/attachments/20261105/6702b8ef/attachment.gz>
More information about the pkg-gnome-maintainers
mailing list