Bug 25355

Summary:	idevice* commands segfault
Product:	Mageia	Reporter:	Herbert Poetzl <herbert>
Component:	RPM Packages	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	critical
Priority:	Normal	CC:	andrewsfarm, geiger.david68210, herbert, marja11, sysadmin-bugs, tmb
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK
Source RPM:	libimobiledevice-1.2.0-7.mga7.src.rpm	CVE:
Status comment:

Description Herbert Poetzl 2019-08-25 17:56:26 CEST

Description of problem:
When running any of the idevice* commands, they segfault after a free() with invalid size

Version-Release number of selected component (if applicable):
libimobiledevice-1.2.0-7.mga7

How reproducible:
always

Steps to Reproduce:
1. ideviceinfo

ERROR: Could not connect to lockdownd, error code -3
free(): invalid size
Aborted (core dumped)


[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
ERROR: Could not connect to lockdownd, error code -3
free(): invalid size

Program received signal SIGABRT, Aborted.
0x00007ffff7df9a7a in raise () from /lib64/libc.so.6
(gdb) where
#0  0x00007ffff7df9a7a in raise () from /lib64/libc.so.6
#1  0x00007ffff7de2524 in abort () from /lib64/libc.so.6
#2  0x00007ffff7e3c008 in __libc_message () from /lib64/libc.so.6
#3  0x00007ffff7e4287a in malloc_printerr () from /lib64/libc.so.6
#4  0x00007ffff7e43f3c in _int_free () from /lib64/libc.so.6
#5  0x00007ffff7c68640 in OPENSSL_sk_pop_free (st=0x40b7f0, func=0x7ffff7d72b60 <cmeth_free>) at crypto/stack/stack.c:265
#6  0x00007ffff7d75026 in sk_SSL_COMP_pop_free (freefunc=0x7ffff7d72b60 <cmeth_free>, sk=<optimized out>) at include/openssl/ssl.h:851
#7  ssl_comp_free_compression_methods_int () at ssl/ssl_ciph.c:1859
#8  0x00007ffff7d7713d in ssl_library_stop () at ssl/ssl_init.c:154
#9  ssl_library_stop () at ssl/ssl_init.c:141
#10 0x00007ffff7c07c3a in OPENSSL_cleanup () at crypto/init.c:459
#11 OPENSSL_cleanup () at crypto/init.c:437
#12 0x00007ffff7dfc4c7 in __cxa_finalize () from /lib64/libc.so.6
#13 0x00007ffff7b01093 in __do_global_dtors_aux () from /lib64/libcrypto.so.1.1
#14 0x00007fffffffdf40 in ?? ()
#15 0x00007ffff7fe5496 in _dl_fini () from /lib64/ld-linux-x86-64.so.2
Backtrace stopped: frame did not save the PC

Comment 1 David GEIGER 2019-08-26 20:06:21 CEST

For now I have updated to the latest git snapshot on Cauldron the 4 following packages:

libimobiledevice-1.2.1-0.git20190818.1.mga8
libusbmuxd-1.1.0-0.git20190802.1.mga8
usbmuxd-1.1.1-0.git20190716.1.mga8
libplist-2.0.0-4.git20190813.1.mga8

CC: (none) => geiger.david68210

Comment 2 Marja Van Waes 2019-08-31 16:42:02 CEST

(In reply to David GEIGER from comment #1)
> For now I have updated to the latest git snapshot on Cauldron the 4
> following packages:
> 
> libimobiledevice-1.2.1-0.git20190818.1.mga8
> libusbmuxd-1.1.0-0.git20190802.1.mga8
> usbmuxd-1.1.1-0.git20190716.1.mga8
> libplist-2.0.0-4.git20190813.1.mga8

Thanks :-)

The segfault was in Mga7 and there is no registered maintainer, so assigning to all packagers collectively

Assignee: bugsquad => pkg-bugs
CC: (none) => marja11

Comment 3 David GEIGER 2019-09-01 11:09:09 CEST

Assigning to QA now,


Advisory:
========================

Our libimobiledevice stack is a quite old and doesn't work properly
anymore, it segfault when running any of the idevice* commands.
So this updates libimobiledevice stack to a more recent and maintained
release.

========================

Packages in 7/core/updates_testing:
========================
libplist-2.0.0-3.git20190813.1.mga7.i586.rpm
libplist3-2.0.0-3.git20190813.1.mga7.i586.rpm
libplist-devel-2.0.0-3.git20190813.1.mga7.i586.rpm
libplist++3-2.0.0-3.git20190813.1.mga7.i586.rpm
libplist++-devel-2.0.0-3.git20190813.1.mga7.i586.rpm
python3-plist-2.0.0-3.git20190813.1.mga7.i586.rpm
libplist-2.0.0-3.git20190813.1.mga7.x86_64.rpm
lib64plist3-2.0.0-3.git20190813.1.mga7.x86_64.rpm
lib64plist-devel-2.0.0-3.git20190813.1.mga7.x86_64.rpm
lib64plist++3-2.0.0-3.git20190813.1.mga7.x86_64.rpm
lib64plist++-devel-2.0.0-3.git20190813.1.mga7.x86_64.rpm
python3-plist-2.0.0-3.git20190813.1.mga7.x86_64.rpm

libusbmuxd-1.1.0-0.git20190802.1.mga7.i586.rpm
libusbmuxd4-1.1.0-0.git20190802.1.mga7.i586.rpm
libusbmuxd-devel-1.1.0-0.git20190802.1.mga7.i586.rpm
libusbmuxd-1.1.0-0.git20190802.1.mga7.x86_64.rpm
lib64usbmuxd4-1.1.0-0.git20190802.1.mga7.x86_64.rpm
lib64usbmuxd-devel-1.1.0-0.git20190802.1.mga7.x86_64.rpm

libimobiledevice-1.2.1-0.git20190818.1.mga7.i586.rpm
libimobiledevice6-1.2.1-0.git20190818.1.mga7.i586.rpm
libimobiledevice-devel-1.2.1-0.git20190818.1.mga7.i586.rpm
python3-imobiledevice-1.2.1-0.git20190818.1.mga7.i586.rpm
libimobiledevice-1.2.1-0.git20190818.1.mga7.x86_64.rpm
lib64imobiledevice6-1.2.1-0.git20190818.1.mga7.x86_64.rpm
lib64imobiledevice-devel-1.2.1-0.git20190818.1.mga7.x86_64.rpm
python3-imobiledevice-1.2.1-0.git20190818.1.mga7.x86_64.rpm

usbmuxd-1.1.1-0.git20190716.1.mga7.i586.rpm
usbmuxd-1.1.1-0.git20190716.1.mga7.x86_64.rpm

Source RPM: 
========================
libplist-2.0.0-3.git20190813.1.mga7.src.rpm
libusbmuxd-1.1.0-0.git20190802.1.mga7.src.rpm
libimobiledevice-1.2.1-0.git20190818.1.mga7.src.rpm
usbmuxd-1.1.1-0.git20190716.1.mga7.src.rpm

Assignee: pkg-bugs => qa-bugs

Comment 4 Herbert Poetzl 2019-09-01 20:45:30 CEST

I can confirm, the new version doesn't segfault anymore and actually works as intended.

Thanks for the quick update and please make sure it gets into main mga7 soon.

Best,
Herbert

CC: (none) => herbert

Comment 5 David GEIGER 2019-09-02 19:28:31 CEST

Tested here on my mga7 for x86_64 all seems working fine! no more segfault and no regression found!

David GEIGER 2019-09-03 07:32:08 CEST

Whiteboard: (none) => MGA7-64-OK

Comment 6 Thomas Andrews 2019-09-05 14:28:36 CEST

Validating. Advisory in Comment 3.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Thomas Backlund 2019-09-06 19:01:58 CEST

Keywords: (none) => advisory
CC: (none) => tmb

Comment 7 Mageia Robot 2019-09-06 23:10:49 CEST

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGAA-2019-0116.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED