Bug#837700: gnutls: GNUTLS segfaults on initialization

[J Phelps]

Package: libgnutls30
Version: 3.5.4-2
Severity: grave
File: gnutls
Justification: renders package unusable

The bug is caused by GNUTLS being compiled with the headers of and old
version of Nettle, but the package depending on (or failing to account
for a breaking change to) a newer version of Nettle.

In the newer version of Nettle, in the struct "yarrow256_ctx", the type
of the "key" member has changed from "aes256_ctx" to "aes_ctx".

"aes_ctx" is like "aes256_ctx", except it has an extra integer, which
makes the whole yarrow256_ctx type one integer bigger as well.

GNUTLS contains a yarrow256_ctx in one of its structs, followed
immediately by a buffer, but it's compiled with the old yarrow256_ctx,
which is too small. Both the struct and the buffer are passed
as arguments to yarrow256_init, but in Nettle's code, yarrow256_ctx
is bigger, so the buffer is treated as being within the yarrow256_ctx
object's address space. As a result, initializing the buffer overwrites
a pointer in the yarrow256_ctx object, leading to a NULL pointer
dereference.

A quick fix to this problem is to simply edit /usr/include/nettle/yarrow.h
and add a padding integer (of type "unsigned") to its definition of
"yarrow256_ctx" right after the "key" object, and then recompiling
GNUTLS. This is good enough, since GNUTLS doesn't look at the internal
structure of yarrow256_ctx, so only the size needs to be corrected.

By doing this, I was able to get Chromium 53.0.2785.92 working, which was
previously crashing because of this problem.


-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable')
Architecture: i386 (i686)

Kernel: Linux 3.16.0-4-686-pae (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages libgnutls30:i386 depends on:
ii  libc6        2.24-2
ii  libgmp10     2:6.0.0+dfsg-6
ii  libhogweed4  3.2-1
ii  libidn11     1.28-1
ii  libnettle6   3.2-1
ii  libp11-kit0  0.23.2-5
ii  libtasn1-6   4.8-1
ii  zlib1g       1:1.2.8.dfsg-1

libgnutls30:i386 recommends no packages.

Versions of packages libgnutls30:i386 suggests:
pn  gnutls-bin  <none>

-- no debconf information