Bug#951412: proftpd-basic: segfault when logging in through sftp

[Tomas Janousek]

Package: proftpd-basic
Version: 1.3.6-4+deb10u3
Severity: normal

It appears bug #839880 reappeared in current Debian stable:

2020-02-16 09:02:15,218 <hostname> proftpd[114] <hostname>: ProFTPD 1.3.6 (stable) (built Tue Dec 31 2019 11:06:17 UTC) standalone mode STARTUP
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): -----BEGIN STACK TRACE-----
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [0] /lib/x86_64-linux-gnu/libc.so.6(+0xa2458) [0x7ff345701458]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [1] /lib/x86_64-linux-gnu/libc.so.6(+0xa2458) [0x7ff345701458]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [2] proftpd: (authenticating) - (connecting): IDLE(pcalloc+0x24) [0x55bc7f1f6a64]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [3] proftpd: (authenticating) - (connecting): IDLE(pr_response_add+0xe8) [0x55bc7f21a778]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [4] /usr/lib/proftpd/mod_sftp.so(sftp_auth_handle+0xf12) [0x7ff344a9c822]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [5] /usr/lib/proftpd/mod_sftp.so(sftp_ssh2_packet_handle+0x249) [0x7ff344a84e69]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [6] /usr/lib/proftpd/mod_sftp.so(+0x14f12) [0x7ff344a80f12]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [7] proftpd: (authenticating) - (connecting): IDLE(+0x1d222) [0x55bc7f1f3222]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [8] proftpd: (authenticating) - (connecting): IDLE(+0x1dacd) [0x55bc7f1f3acd]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [9] proftpd: (authenticating) - (connecting): IDLE(main+0x59f) [0x55bc7f1f19bf]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [10] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7ff34568309b]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): [11] proftpd: (authenticating) - (connecting): IDLE(_start+0x2a) [0x55bc7f1f1fca]
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): -----END STACK TRACE-----
2020-02-16 09:02:29,812 <hostname> proftpd[373] <hostname> (<client-address>): ProFTPD terminating (signal 11)
2020-02-16 09:19:06,514 <hostname> proftpd[114] <hostname>: ProFTPD killed (signal 15)
2020-02-16 09:19:06,541 <hostname> proftpd[114] <hostname>: ProFTPD 1.3.6 standalone mode SHUTDOWN

I tried upgrading to 1.3.6b-3 from testing/unstable and that version works
like a charm, but I'd prefer not having to use libc and proftpd from unstable
on this particular box. :-/

(the following is edited manually as I'm reporting the bug from my laptop, not
from the LXC container that runs this)

-- System Information:
Debian Release: buster/stable
  APT prefers stable
  APT policy: (990, 'stable'), (500, 'unstable')
Architecture: amd64 (x86_64)

Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

-- 
Tomáš Janoušek, a.k.a. Pivník, a.k.a. Liskni_si, http://work.lisk.in/