Package: libgnutls30 Version: 3.5.4-2 Severity: grave File: gnutls Justification: renders package unusable
The bug is caused by GNUTLS being compiled with the headers of and old version of Nettle, but the package depending on (or failing to account for a breaking change to) a newer version of Nettle. In the newer version of Nettle, in the struct "yarrow256_ctx", the type of the "key" member has changed from "aes256_ctx" to "aes_ctx". "aes_ctx" is like "aes256_ctx", except it has an extra integer, which makes the whole yarrow256_ctx type one integer bigger as well. GNUTLS contains a yarrow256_ctx in one of its structs, followed immediately by a buffer, but it's compiled with the old yarrow256_ctx, which is too small. Both the struct and the buffer are passed as arguments to yarrow256_init, but in Nettle's code, yarrow256_ctx is bigger, so the buffer is treated as being within the yarrow256_ctx object's address space. As a result, initializing the buffer overwrites a pointer in the yarrow256_ctx object, leading to a NULL pointer dereference. A quick fix to this problem is to simply edit /usr/include/nettle/yarrow.h and add a padding integer (of type "unsigned") to its definition of "yarrow256_ctx" right after the "key" object, and then recompiling GNUTLS. This is good enough, since GNUTLS doesn't look at the internal structure of yarrow256_ctx, so only the size needs to be corrected. By doing this, I was able to get Chromium 53.0.2785.92 working, which was previously crashing because of this problem. -- System Information: Debian Release: jessie/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable') Architecture: i386 (i686) Kernel: Linux 3.16.0-4-686-pae (SMP w/4 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/bash Versions of packages libgnutls30:i386 depends on: ii libc6 2.24-2 ii libgmp10 2:6.0.0+dfsg-6 ii libhogweed4 3.2-1 ii libidn11 1.28-1 ii libnettle6 3.2-1 ii libp11-kit0 0.23.2-5 ii libtasn1-6 4.8-1 ii zlib1g 1:1.2.8.dfsg-1 libgnutls30:i386 recommends no packages. Versions of packages libgnutls30:i386 suggests: pn gnutls-bin <none> -- no debconf information
