Bug#869391: gnome-control-center: Add input source dialog crashes when "Show All input sources" is enabled

[Jason Crain]

On Sat, Jul 22, 2017 at 08:00:00PM -0400, Felipe Sateler wrote:
> I enabled all input sources in the tweak tool. Now I can't add input
> sources. g-c-c crashes with the following backtrace below.

I would like to fix this in stretch, but I don't have upload
capabilities.  If I get approval from a SRM, is a gnome team member
willing to upload it?  Debdiff for the proposed change is attached.
diff -Nru gnome-desktop3-3.22.2/debian/changelog 
gnome-desktop3-3.22.2/debian/changelog
--- gnome-desktop3-3.22.2/debian/changelog  2016-11-08 08:14:44.0 
-0600
+++ gnome-desktop3-3.22.2/debian/changelog  2017-12-15 18:44:50.0 
-0600
@@ -1,3 +1,12 @@
+gnome-desktop3 (3.22.2-1+deb9u1) stretch; urgency=medium
+
+  [ Jason Crain ]
+  * d/p/Fix-heap-use-after-free-with-duplicate-xkb-layouts.patch: Fixes crash
+in gnome-control-center when adding an input source with "Show All Input
+Sources" enabled. (Closes: #869391)
+
+ -- Jason Crain   Fri, 15 Dec 2017 18:44:50 -0600
+
 gnome-desktop3 (3.22.2-1) unstable; urgency=medium
 
   * New upstream release.
diff -Nru 
gnome-desktop3-3.22.2/debian/patches/Fix-heap-use-after-free-with-duplicate-xkb-layouts.patch
 
gnome-desktop3-3.22.2/debian/patches/Fix-heap-use-after-free-with-duplicate-xkb-layouts.patch
--- 
gnome-desktop3-3.22.2/debian/patches/Fix-heap-use-after-free-with-duplicate-xkb-layouts.patch
   1969-12-31 18:00:00.0 -0600
+++ 
gnome-desktop3-3.22.2/debian/patches/Fix-heap-use-after-free-with-duplicate-xkb-layouts.patch
   2017-12-15 18:44:50.0 -0600
@@ -0,0 +1,32 @@
+From: Jason Crain 
+Date: Mon, 24 Jul 2017 22:32:01 -0500
+Subject: Fix heap-use-after-free with duplicate xkb layouts
+
+Debian's gnome-control-center can crash when show-all-sources is
+enabled.  When parse_end_element in gnome-xkb-info.c encounters
+duplicate layouts, it will free the memory for the first layout while it
+is still in a hash table.
+
+Bug: https://bugzilla.gnome.org/show_bug.cgi?id=785320
+Bug-Debian: https://bugs.debian.org/869391
+Origin: upstream, 
https://git.gnome.org/browse/gnome-desktop/commit/?id=dda675941777a876c1e9b08f922de72d32e73273
+Last-Update: 2017-12-15
+---
+ libgnome-desktop/gnome-xkb-info.c | 6 ++
+ 1 file changed, 6 insertions(+)
+
+--- a/libgnome-desktop/gnome-xkb-info.c
 b/libgnome-desktop/gnome-xkb-info.c
+@@ -405,6 +405,12 @@
+ 
priv->current_parser_variant->xkb_name,
+ NULL);
+ 
++  if (g_hash_table_contains (priv->layouts_table, 
priv->current_parser_variant->id))
++{
++  g_clear_pointer (>current_parser_variant, free_layout);
++  return;
++}
++
+   g_hash_table_replace (priv->layouts_table,
+ priv->current_parser_variant->id,
+ priv->current_parser_variant);
diff -Nru gnome-desktop3-3.22.2/debian/patches/series 
gnome-desktop3-3.22.2/debian/patches/series
--- gnome-desktop3-3.22.2/debian/patches/series 2015-10-14 11:42:32.0 
-0500
+++ gnome-desktop3-3.22.2/debian/patches/series 2017-12-15 18:44:50.0 
-0600
@@ -0,0 +1 @@
+Fix-heap-use-after-free-with-duplicate-xkb-layouts.patch

Bug#869391: gnome-control-center: Add input source dialog crashes when "Show All input sources" is enabled

[Jeremy Bicha]

Control: reassign -1 gnome-desktop3 3.22.2-1
Control: fixed -1 gnome-desktop3/3.25.91.1-1

This was fixed upstream in gnome-desktop3 3.25.90.

https://git.gnome.org/browse/gnome-desktop/commit/?id=dda6759

Thanks,
Jeremy Bicha

Bug#869391: gnome-control-center: Add input source dialog crashes when "Show All input sources" is enabled

[Felipe Sateler]

On Sun, Jul 23, 2017 at 2:35 AM, Jason Crain  wrote:
> On Sat, Jul 22, 2017 at 08:00:00PM -0400, Felipe Sateler wrote:
>> I enabled all input sources in the tweak tool. Now I can't add input
>> sources. g-c-c crashes with the following backtrace below.
>>
>> Inspecting with gdb suggests that the GList returned by
>> gnome_xkb_info_get_layouts_for_language is invalid, as the data pointed
>> by one of the entries is not readable:
>
> This seems to be related to a recent update to xkb-data.
> gnome-control-center really doesn't like the new evdev.xml.

Indeed. Downgrading xkb-data to 2.18 fixes the crash. Upgrading back
to 2.19 makes g-c-c crash again.

-- 

Saludos,
Felipe Sateler

Bug#869391: gnome-control-center: Add input source dialog crashes when "Show All input sources" is enabled

[Jason Crain]

On Sat, Jul 22, 2017 at 08:00:00PM -0400, Felipe Sateler wrote:
> I enabled all input sources in the tweak tool. Now I can't add input
> sources. g-c-c crashes with the following backtrace below.
> 
> Inspecting with gdb suggests that the GList returned by 
> gnome_xkb_info_get_layouts_for_language is invalid, as the data pointed
> by one of the entries is not readable:

This seems to be related to a recent update to xkb-data.
gnome-control-center really doesn't like the new evdev.xml.

Bug#869391: gnome-control-center: Add input source dialog crashes when "Show All input sources" is enabled

[Felipe Sateler]

Package: gnome-control-center
Version: 1:3.22.2-3
Severity: normal

Hi,

I enabled all input sources in the tweak tool. Now I can't add input
sources. g-c-c crashes with the following backtrace below.

Inspecting with gdb suggests that the GList returned by 
gnome_xkb_info_get_layouts_for_language is invalid, as the data pointed
by one of the entries is not readable:

(gdb) p (char*)list->data
$2 = 0x938 


#0  0x7fab69ddc50a in __strcmp_sse2_unaligned () at 
../sysdeps/x86_64/multiarch/strcmp-sse2-unaligned.S:31
#1  0x00b9644f8a57 in add_rows_to_table (chooser=chooser@entry=0xb96614e870 
[GtkDialog], info=info@entry=0xb9662e50d0, list=0xb965b80c00, 
list@entry=0xb965b826a0, type=type@entry=0xb9645a971b "xkb", 
default_id=0x7fab6e6de2f2 "us") at cc-input-chooser.c:730
#2  0x00b9644f9cbe in get_locale_infos (chooser=0xb96614e870 [GtkDialog]) 
at cc-input-chooser.c:972
#3  0x00b9644f9cbe in cc_input_chooser_new (main_window=0xb965e922a0 
[CcWindow], is_login=is_login@entry=0, xkb_info=xkb_info@entry=0xb9660edb60 
[GnomeXkbInfo], ibus_engines=ibus_engines@entry=0x0) at cc-input-chooser.c:1088
#4  0x00b9644f4f58 in show_input_chooser (self=0xb965d00950 
[CcRegionPanel]) at cc-region-panel.c:1146
#5  0x7fab6a9311a4 in _g_closure_invoke_va 
(closure=closure@entry=0xb9660f30a0, return_value=return_value@entry=0x0, 
instance=instance@entry=0xb965eb0dc0, args=args@entry=0x7fffaa0c0ff0, 
n_params=, param_types=0x0) at ././gobject/gclosure.c:867
#6  0x7fab6a94b8cd in g_signal_emit_valist (instance=0xb965eb0dc0, 
signal_id=, detail=0, var_args=var_args@entry=0x7fffaa0c0ff0) at 
././gobject/gsignal.c:3300
#7  0x7fab6a94bfbf in g_signal_emit (instance=, 
signal_id=, detail=)
at ././gobject/gsignal.c:3447
#8  0x7fab6c0f3e7d in  () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#9  0x7fab6c0f3ee5 in  () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#13 0x7fab6a94bfbf in  (instance=, signal_id=, 
detail=) at ././gobject/gsignal.c:3447
#10 0x7fab6a930f75 in g_closure_invoke 
(closure=closure@entry=0xb965a4d390, return_value=return_value@entry=0x0, 
n_param_values=1, param_values=param_values@entry=0x7fffaa0c12e0, 
invocation_hint=invocation_hint@entry=0x7fffaa0c1260)
at ././gobject/gclosure.c:804
#11 0x7fab6a94295c in signal_emit_unlocked_R 
(node=node@entry=0xb965ad0a10, detail=detail@entry=0, 
instance=instance@entry=0xb965eb0dc0, 
emission_return=emission_return@entry=0x0, 
instance_and_params=instance_and_params@entry=0x7fffaa0c12e0)
at ././gobject/gsignal.c:3565
#12 0x7fab6a94bbdc in g_signal_emit_valist (instance=, 
signal_id=, detail=, 
var_args=var_args@entry=0x7fffaa0c1490) at ././gobject/gsignal.c:3391
#14 0x7fab6c0f22e0 in  () at /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#15 0x7fab56da6038 in ffi_call_unix64 () at 
/usr/lib/x86_64-linux-gnu/libffi.so.6
#16 0x7fab56da5a9a in ffi_call () at /usr/lib/x86_64-linux-gnu/libffi.so.6
#17 0x7fab6a931c8a in g_cclosure_marshal_generic_va (closure=0xb9660cfb70, 
return_value=0x0, instance=, args_list=, 
marshal_data=, n_params=3, param_types=0xb965a01df0) at 
././gobject/gclosure.c:1604
#18 0x7fab6a9311a4 in _g_closure_invoke_va 
(closure=closure@entry=0xb9660cfb70, return_value=return_value@entry=0x0, 
instance=instance@entry=0xb9660d11b0, args=args@entry=0x7fffaa0c1a80, 
n_params=, param_types=0xb965a01df0)


-- System Information:
Debian Release: buster/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.11.0-2-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), 
LANGUAGE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages gnome-control-center depends on:
ii  accountsservice0.6.43-1
ii  apg2.2.3.dfsg.1-4+b1
ii  colord 1.3.3-2
ii  desktop-file-utils 0.23-2
ii  gnome-control-center-data  1:3.22.2-3
ii  gnome-desktop3-data3.22.2-1
ii  gnome-settings-daemon  3.22.2-5
ii  gsettings-desktop-schemas  3.22.0-1
ii  libaccountsservice00.6.43-1
ii  libatk1.0-02.24.0-1
ii  libc6  2.24-12
ii  libcairo-gobject2  1.14.10-1
ii  libcairo2  1.14.10-1
ii  libcanberra-gtk3-0 0.30-3
ii  libcanberra0   0.30-3
ii  libcheese-gtk253.22.1-1+b1
ii  libcheese8 3.22.1-1+b1
ii  libclutter-1.0-0   1.26.2+dfsg-1
ii  libclutter-gtk-1.0-0   1.8.2-2
ii  libcolord-gtk1 0.1.26-1.1
ii  libcolord2 1.3.3-2
ii  libcups2   2.2.4-3
ii  libfontconfig1 2.12.3-0.2
ii  libgdk-pixbuf2.0-0 2.36.5-2
ii  libglib2.0-0   2.52.3-1
ii  libgnome-bluetooth13   3.20.1-1
ii  libgnome-desktop-3-12  3.22.2-1
ii  libgoa-1.0-0b  3.22.5-1
ii