ubuntu 22.10 buffer overflow detected

Submitted by nkk on Thu, 2022-11-17 15:13

Forums:

MOC version: 
2.6-alpha3

After upgrading to xubuntu 22.10 moc does not start. Output is:

*** buffer overflow detected ***: terminated
Aborted (core dumped)

It happens on both my PC-s after upgrade. The last lines in mocp_client_log file are:

Nov 17 19:05:58.560799: interface.c:3496 init_interface(): Starting MOC Interface
Nov 17 19:05:58.560864: log.c:233 log_init_stream(): Writing log to: mocp_client_log
Nov 17 19:05:58.561040: utf8.c:328 utf8_init(): Using UTF8 output

Was a foolish thing to upgrade from 22.04 Lts, was not it? :D

Regards,
Nick

jcf

Thu, 2022-11-17 19:50

This is a known bug introduced in a recent release of GCC's libc.

A full description is available here along with a circumventing patch for MOC.

This has not yet made it into the MOC repository, but you can apply it locally or refer it upstream to Ubuntu. Alternately, have them upgrade the distributed libc library (this bug affects several applications).

(Thanks to Joan Bruguera for the patch.)

nkk

Thu, 2022-12-01 06:07

Thanks for replies.
Uninstalled 2.6-alpha3, downloaded and compiled ver. 2.5.2 and it works OK.
If "this bug affects several applications", hope some day they'll fix libc.

jcf

Thu, 2022-12-01 08:41

If "this bug affects several applications", hope some day they'll fix libc.

Yes, they have with commit 61af4bbb which is included in glibc 2.32.

tomaszg

Thu, 2022-11-17 19:53

I managed to replicate it in Virtualbox with live image of Xubuntu 22.10. I managed to get the backtrace:

#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff74f9c46 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff74e07fc in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff75430be in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7677393 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:155
#6 0x00007ffff75ed66a in __GI___fortify_fail (msg=msg@entry=0x7ffff7677339 "buffer overflow detected") at ./debug/fortify_fail.c:26
#7 0x00007ffff75ebfd6 in __GI___chk_fail () at ./debug/chk_fail.c:28
#8 0x00007ffff75ed0c9 in __mbsrtowcs_chk (dst=dst@entry=0x0, src=src@entry=0x7fffffffdc78, len=len@entry=18446744073709551615, ps=ps@entry=0x7fffffffdc80,
dstlen=dstlen@entry=4611686018427387903) at ./debug/mbsrtowcs_chk.c:27
#9 0x0000555555595ce3 in mbsrtowcs (__ps=0x7fffffffdc80, __len=<optimized out>, __src=0x7fffffffdc78, __dst=<optimized out>) at /usr/include/x86_64-linux-gnu/bits/wchar2.h:428
#10 xmbstowcs (dest=<optimized out>, dest@entry=0x0, src=<optimized out>, src@entry=0x55555568dde0 "Playlist", len=<optimized out>, len@entry=18446744073709551615,
invalid_char=invalid_char@entry=0x0) at ./utf8.c:170
#11 0x00005555555972d4 in strwidth (s=0x55555568dde0 "Playlist") at ./utf8.c:372
#12 0x0000555555586c8d in side_menu_draw_frame (m=0x5555555d2648 <main_win.lto_priv+104>) at ./interface_elements.c:1205
#13 side_menu_draw (m=0x5555555d2648 <main_win.lto_priv+104>, active=0) at ./interface_elements.c:1279
#14 0x00005555555a906a in main_win_draw (w=<optimized out>) at ./interface_elements.c:1805
#15 main_win_draw.constprop.0 (w=<optimized out>) at ./interface_elements.c:1789
#16 0x0000555555588201 in windows_init () at ./interface_elements.c:3635
#17 0x000055555557cab7 in init_interface (sock=3, logging=<optimized out>, args=0x555555683d30) at ./interface.c:3517
#18 0x0000555555565f1f in start_moc (params=0x5555555d1160 <params>, args=0x555555683d30) at ./main.c:221
#19 main (argc=<optimized out>, argv=<optimized out>) at ./main.c:1254

It seems to be related to https://sourceware.org/bugzilla/show_bug.cgi?id=29030 but that appears to be fixed both in glibc 2.34 and 2.35. Xubuntu in question ships with glibc 2.36. The test case from the bug report compiles and works correctly. It seems to be similar but slightly different bug. I'll try to apply the patch for MOC and see if it fixes this issue.