Package: libxml2
Version: 2.6.32.dfsg-2+lenny
Severity: grave
Justification: renders package unusable
See the thread "Lenny users: attn about Gnome/libxml2 breakage" on the
debian-user mailing list (at the time of writing this bug report, the
archive didn't index those mails yet so I can't give an url).
Here is the text:
Today I did the usual dist-upgrade for my "testing" install, and
it left me with a badly broken (from user's perspective)
installation, because basically all Gnome applications stopped
working. After a bit over 2 hours worth of investigation, I've
found out how to solve the issue; since I first looked here and
didn't find anything gnome related, I'm sending this to the list
for the casual other victim.
Symptom: Gnome apps just hang, without outputting anything to
stdout/stderr (or .xsession-errors if started through the menu).
Problem: the apps segfault inside libxml2, and thereafter enter a
deadlocked state in a mutex (or in a select call); the former is
apparently a bug in libxml2, the latter seems to be the Gnome
functionality to pop up a windows which seems to have an issue on
it's own (so it's really two bugs happening here, obscuring the
investigation a bit.)
Solution: install libxml2 from unstable; this is actually a
downgrade (from libxml2 2.6.32.dfsg-2+lenny to
2.6.32.dfsg-2). I.e. "apt-get install -t unstable
libxml2/unstable", but you need to have the unstable sources in
apt.sources and use apt pinning (I won't explain that here, check
other sources).
to which I added:
I realize that the suggestion I wrote about undoes a security
fix. So, don't do what I said, do something different (what about
going outside and enjoying a walk?). Well ok, the issue said to be
fixed is only a DoS (of course ironically it introduces another
DoS ;) .
Thanks in advance to the security team for fixing the fixes.
The segfaults happen in libxml2 for both applications (Galeon and
gnome-appearance-properties) which I ran under GDB:
#0 0x00007f6038aa95c8 in _int_free (av=0x7f6038d829e0, mem=0xc9ad10) at
malloc.c:4663
#1 0x00007f6038aa9a76 in *__GI___libc_free (mem=0xc9ad10) at malloc.c:3626
#2 0x00007f603c54f065 in xmlParseEntityDecl__internal_alias (ctxt=0xcb1700) at
parser.c:4809
#3 0x00007f603c54f7e6 in xmlParseMarkupDecl__internal_alias
(ctxt=0x7f6038d829e0) at parser.c:5947
#4 0x00007f603c54f87e in xmlParseInternalSubset (ctxt=0xcb1700) at
parser.c:7310
#5 0x00007f603c550626 in xmlParseChunk__internal_alias (ctxt=0xcb1700,
chunk=<value optimized out>, size=<value optimized out>, terminate=0) at
parser.c:10782
#6 0x00007f602bac4cd0 in ?? () from /usr/lib/librsvg-2.so.2
#7 0x00007f602bcf0d7c in ?? () from
/usr/lib/gtk-2.0/2.10.0/loaders/svg_loader.so
#8 0x00007f603a5d4c99 in IA__gdk_pixbuf_loader_write (loader=0xb28ea0,
buf=0xc94180 "<?xml version=\"1.0\" encoding=\"utf-8\"?>\n<!-- Generator:
Adobe Illustrator 10.0.3, SVG Export Plug-In . SVG Version: 3.0.0 Build 77)
-->\n<!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.0//EN\" \"http://www.w3";...,
count=4082, error=0xcc8528)
at /scratch/build-area/gtk+2.0-2.12.11/gdk-pixbuf/gdk-pixbuf-loader.c:475
#9 0x00007f603ab9c530 in icon_info_ensure_scale_and_pixbuf
(icon_info=0xcc84f0,
scale_only=<value optimized out>)
at /scratch/build-area/gtk+2.0-2.12.11/gtk/gtkicontheme.c:2743
...
(you can see the rest of the backtraces in my mailing list email)
Here I'll also post the top of a "bt full", which indicates that glibc
complains about a double free:
#0 0x00007f4c4ab725c8 in _int_free (av=0x7f4c4ae4b9e0, mem=0xc9b570) at
malloc.c:4663
p = (mchunkptr) 0xc9b560
size = 320
nextchunk = (mchunkptr) 0xc9b6a0
nextsize = 144
prevsize = <value optimized out>
bck = (mchunkptr) 0x11
fwd = (mchunkptr) 0x0
errstr = 0x7f4c4ac1a8d8 "double free or corruption (!prev)"
#1 0x00007f4c4ab72a76 in *__GI___libc_free (mem=0xc9b570) at malloc.c:3626
ar_ptr = (mstate) 0x7f4c4ae4b9e0
p = (mchunkptr) 0x1
hook = <value optimized out>
#2 0x00007f4c4e618065 in xmlParseEntityDecl__internal_alias (ctxt=0xc9a450) at
parser.c:4809
name = (const xmlChar *) 0xc9b053 "ns_flows"
value = (xmlChar *) 0xc9b570 "http://ns.adobe.com/Flows/1.0/";
URI = <value optimized out>
literal = (xmlChar *) 0x0
ndata = <value optimized out>
isParameter = 0
orig = (xmlChar *) 0xc9b500 "http://ns.adobe.com/Flows/1.0/";
skipped = <value optimized out>
oldnbent = 0
#3 0x00007f4c4e6187e6 in xmlParseMarkupDecl__internal_alias
(ctxt=0x7f4c4ae4b9e0) at parser.c:5947
#4 0x00007f4c4e61887e in xmlParseInternalSubset (ctxt=0xc9a450) at
parser.c:7310
No locals.
No locals.
#5 0x00007f4c4e619626 in xmlParseChunk__internal_alias (ctxt=0xc9a450,
chunk=<value optimized out>, size=<value optimized out>, terminate=0) at
parser.c:10782
end_in_lf = 0
#6 0x00007f4c3db8dcd0 in ?? () from /usr/lib/librsvg-2.so.2
No symbol table info available.
#7 0x00007f4c3ddb9d7c in ?? () from
/usr/lib/gtk-2.0/2.10.0/loaders/svg_loader.so
No symbol table info available.
....
(BTW there seem to be no debugging symbols available in any Debian
package for librsvg-2. (Is this a bug of the librsvg-2 package?))
Christian.
-- System Information:
Debian Release: lenny/sid
APT prefers testing
APT policy: (900, 'testing'), (800, 'unstable')
Architecture: amd64 (x86_64)
Kernel: Linux 2.6.26 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
Versions of packages libxml2 depends on:
ii libc6 2.7-13 GNU C Library: Shared libraries
ii zlib1g 1:1.2.3.3.dfsg-12 compression library - runtime
Versions of packages libxml2 recommends:
ii xml-core 0.11 XML infrastructure and XML catalog
libxml2 suggests no packages.
-- no debconf information
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
