[pkg-gnupg-maint] Bug#824901: Bug#824901: gnupg: gpg segfaults

[Christoph Egger]

Werner Koch <wk at gnupg.org> writes:
> On Sat, 21 May 2016 19:48, christoph at christoph-egger.org said:
>> % gdb --args gpg --debug-all --list-sigs 0x3B78A32D98BAD5B0
>
>> Program received signal SIGSEGV, Segmentation fault.
>> _gcry_log_printmpi (text=text at entry=0x555555606606 "pkey[0]", mpi=0x3e67726f2e) at ../../src/misc.c:337
>
> According to this it seems to bail out at 
>
>          (mpi && (mpi->flags & 4))
>
> but optimization may gave us a wrong line number
>
>> (gdb) bt full
>
> Can you try a 
>
>   p mpi

(gdb) p mpi
$1 = (gcry_mpi_t) 0x3e67726f2e

> and send me your copy of the key 0x3B78A32D98BAD5B0 by PM because I
> can't replicate it with the copy taken from a keyserver (or if possible
> the entire keyring).  I would also suggest to run valgrind.

==5511== Invalid read of size 1
==5511==    at 0x5568484: _gcry_log_printmpi (in /lib/x86_64-linux-gnu/libgcrypt.so.20.1.0)
==5511==    by 0x1393C6: encode_md_value (in /usr/bin/gpg)
==5511==    by 0x14FCD5: check_signature_end_simple (in /usr/bin/gpg)
==5511==    by 0x1508BE: check_signature_over_key_or_uid (in /usr/bin/gpg)
==5511==    by 0x150FE1: check_key_signature2 (in /usr/bin/gpg)
==5511==    by 0x151084: check_key_signature (in /usr/bin/gpg)
==5511==    by 0x138B91: keyring_rebuild_cache (in /usr/bin/gpg)
==5511==    by 0x1355BB: keydb_rebuild_caches (in /usr/bin/gpg)
==5511==    by 0x182B4E: validate_keys (in /usr/bin/gpg)
==5511==    by 0x155897: public_key_list (in /usr/bin/gpg)
==5511==    by 0x119858: main (in /usr/bin/gpg)
==5511==  Address 0x3e67726f3a is not stack'd, malloc'd or (recently) free'd
==5511== 

gpg: signal Segmentation fault caught ... exiting
==5511== 
==5511== Process terminating with default action of signal 11 (SIGSEGV)
==5511==    at 0x5F0D478: raise (in /lib/x86_64-linux-gnu/libc-2.22.so)
==5511==    by 0x5F0D4FF: ??? (in /lib/x86_64-linux-gnu/libc-2.22.so)
==5511==    by 0x5568483: _gcry_log_printmpi (in /lib/x86_64-linux-gnu/libgcrypt.so.20.1.0)
==5511==    by 0x1393C6: encode_md_value (in /usr/bin/gpg)
==5511==    by 0x14FCD5: check_signature_end_simple (in /usr/bin/gpg)
==5511==    by 0x1508BE: check_signature_over_key_or_uid (in /usr/bin/gpg)
==5511==    by 0x150FE1: check_key_signature2 (in /usr/bin/gpg)
==5511==    by 0x151084: check_key_signature (in /usr/bin/gpg)
==5511==    by 0x138B91: keyring_rebuild_cache (in /usr/bin/gpg)
==5511==    by 0x1355BB: keydb_rebuild_caches (in /usr/bin/gpg)
==5511==    by 0x182B4E: validate_keys (in /usr/bin/gpg)
==5511==    by 0x155897: public_key_list (in /usr/bin/gpg)
==5511== 
==5511== HEAP SUMMARY:
==5511==     in use at exit: 1,955,713 bytes in 38,345 blocks
==5511==   total heap usage: 545,770 allocs, 507,425 frees, 255,247,453 bytes allocated
==5511== 
==5511== LEAK SUMMARY:
==5511==    definitely lost: 1,792 bytes in 19 blocks
==5511==    indirectly lost: 4,112 bytes in 70 blocks
==5511==      possibly lost: 48 bytes in 2 blocks
==5511==    still reachable: 1,949,761 bytes in 38,254 blocks
==5511==         suppressed: 0 bytes in 0 blocks
==5511== Rerun with --leak-check=full to see details of leaked memory
==5511== 
==5511== For counts of detected and suppressed errors, rerun with: -v
==5511== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

-- 
9FED 5C6C E206 B70A 5857  70CA 9655 22B9 D49A E731
Debian Developer | Lisp Hacker | CaCert Assurer