https://bugs.kde.org/show_bug.cgi?id=482819
--- Comment #13 from Matt Fagnani <matt.fagn...@bell.net> --- I built qca 2.3.8 with your patch added. I reproduced the crash first without using valgrind. The crash happened on the line with static_cast<PKeyContext *>(context())->key() Since context() looked to be run with out a pointer to an object, I guess the pointer this might've been used which had the null d pointer. Core was generated by `/usr/bin/kwalletd6 --pam-login 13 14'. Program terminated with signal SIGSEGV, Segmentation fault. #0 0x00007efd2af813fc in QCA::PrivateKey::deriveKey (this=this@entry=0x7ffdccf553f0, theirs=...) at /usr/src/debug/qca-2.3.8-2.fc40.x86_64/src/qca_publickey.cpp:1033 1033 qDebug() << static_cast<PKeyContext *>(context())->key(); [Current thread is 1 (Thread 0x7efd2b28f9c0 (LWP 76549))] (gdb) l 1028 SymmetricKey PrivateKey::deriveKey(const PublicKey &theirs) 1029 { 1030 const PKeyContext *theirContext = static_cast<const PKeyContext *>(theirs.context()); 1031 qDebug() << context(); 1032 qDebug() << theirContext; 1033 qDebug() << static_cast<PKeyContext *>(context())->key(); 1034 qDebug() << theirContext->key(); 1035 return static_cast<PKeyContext *>(context())->key()->deriveKey(*(theirContext->key())); 1036 } 1037 (gdb) bt #0 0x00007efd2af813fc in QCA::PrivateKey::deriveKey (this=this@entry=0x7ffdccf553f0, theirs=...) at /usr/src/debug/qca-2.3.8-2.fc40.x86_64/src/qca_publickey.cpp:1033 #1 0x00005592e8316992 in KWalletFreedesktopService::createSessionAlgorithmDhAes (this=0x7efd1000a540, clientKey=...) at /usr/src/debug/kf6-kwallet-6.0.0-1.fc40.x86_64/src/runtime/kwalletd/kwalletfreedesktopservice.cpp:424 #2 KWalletFreedesktopService::OpenSession (this=0x7efd1000a540, algorithm=<optimized out>, input=<optimized out>, result=...) at /usr/src/debug/kf6-kwallet-6.0.0-1.fc40.x86_64/src/runtime/kwalletd/kwalletfreedesktopservice.cpp:266 #3 0x00005592e833bf43 in KWalletFreedesktopServiceAdaptor::OpenSession (this=0x5592e90d2eb0, algorithm=<optimized out>, input=<optimized out>, result=<optimized out>) at /usr/src/debug/kf6-kwallet-6.0.0-1.fc40.x86_64/redhat-linux-build/src/runtime/kwalletd/kwalletfreedesktopserviceadaptor.cpp:63 #4 KWalletFreedesktopServiceAdaptor::qt_static_metacall (_o=0x5592e90d2eb0, _c=<optimized out>, _id=<optimized out>, _a=0x7ffdccf55728) at /usr/src/debug/kf6-kwallet-6.0.0-1.fc40.x86_64/redhat-linux-build/src/runtime/kwalletd/moc_kwalletfreedesktopserviceadaptor.cpp:410 #5 0x00005592e833c254 in KWalletFreedesktopServiceAdaptor::qt_metacall (this=0x5592e90d2eb0, _c=QMetaObject::InvokeMetaMethod, _id=6, _a=0x7ffdccf55728) at /usr/src/debug/kf6-kwallet-6.0.0-1.fc40.x86_64/redhat-linux-build/src/runtime/kwalletd/moc_kwalletfreedesktopserviceadaptor.cpp:489 #6 0x00007efd2a57bb11 in QDBusConnectionPrivate::deliverCall (this=this@entry=0x7efd10001690, object=object@entry=0x5592e90d2eb0, msg=..., metaTypes=..., slotIdx=11) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/dbus/qdbusintegrator.cpp:977 #7 0x00007efd2a57f675 in QDBusConnectionPrivate::activateCall (this=this@entry=0x7efd10001690, object=0x5592e90d2eb0, flags=flags@entry=273, msg=...) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/dbus/qdbusintegrator.cpp:879 #8 0x00007efd2a5802c6 in QDBusConnectionPrivate::activateCall (this=0x7efd10001690, object=<optimized out>, flags=273, msg=...) --Type <RET> for more, q to quit, c to continue without paging--c at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/dbus/qdbusintegrator.cpp:825 #9 QDBusConnectionPrivate::activateObject (this=0x7efd10001690, node=..., msg=..., pathStartPos=<optimized out>) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/dbus/qdbusintegrator.cpp:1460 #10 0x00007efd2a58295a in QDBusActivateObjectEvent::placeMetaCall (this=0x7efd1000afe0) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/dbus/qdbusintegrator.cpp:1580 #11 0x00007efd293e25a5 in QObject::event (this=0x7efd1000a540, e=0x7efd1000afe0) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qobject.cpp:1437 #12 0x00007efd2a787f68 in QApplicationPrivate::notify_helper (this=<optimized out>, receiver=0x7efd1000a540, e=0x7efd1000afe0) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/widgets/kernel/qapplication.cpp:3296 #13 0x00007efd2938f218 in QCoreApplication::notifyInternal2 (receiver=0x7efd1000a540, event=0x7efd1000afe0) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qcoreapplication.cpp:1121 #14 0x00007efd2938f42d in QCoreApplication::sendEvent (receiver=<optimized out>, event=<optimized out>) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qcoreapplication.cpp:1539 #15 0x00007efd29393147 in QCoreApplicationPrivate::sendPostedEvents (receiver=0x0, event_type=0, data=0x5592e8d7e390) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qcoreapplication.cpp:1901 #16 0x00007efd2939340d in QCoreApplication::sendPostedEvents (receiver=<optimized out>, event_type=<optimized out>) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qcoreapplication.cpp:1760 #17 0x00007efd2966751f in postEventSourceDispatch (s=0x5592e8d80450) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:243 #18 0x00007efd289be68c in g_main_dispatch (context=0x7efd10000f00) at ../glib/gmain.c:3344 #19 g_main_context_dispatch_unlocked (context=0x7efd10000f00) at ../glib/gmain.c:4152 #20 0x00007efd28a1f788 in g_main_context_iterate_unlocked.isra.0 (context=context@entry=0x7efd10000f00, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../glib/gmain.c:4217 #21 0x00007efd289bfb03 in g_main_context_iteration (context=0x7efd10000f00, may_block=1) at ../glib/gmain.c:4282 #22 0x00007efd29666de3 in QEventDispatcherGlib::processEvents (this=0x5592e8d980d0, flags=...) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/kernel/qeventdispatcher_glib.cpp:393 #23 0x00007efd2939c053 in QEventLoop::exec (this=this@entry=0x7ffdccf56000, flags=..., flags@entry=...) at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/global/qflags.h:34 #24 0x00007efd29397ffc in QCoreApplication::exec () at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/corelib/global/qflags.h:74 #25 0x00007efd29bd37cd in QGuiApplication::exec () at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/gui/kernel/qguiapplication.cpp:1925 #26 0x00007efd2a787ed9 in QApplication::exec () at /usr/src/debug/qt6-qtbase-6.6.2-6.fc40.x86_64/src/widgets/kernel/qapplication.cpp:2574 #27 0x00005592e82fcd95 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/kf6-kwallet-6.0.0-1.fc40.x86_64/src/runtime/kwalletd/main.cpp:221 I ran the steps you gave with kwalletd6 under valgrind. The crash was at a null address in QCA::PrivateKey::deriveKey at qca_publickey.cpp:1033. ==83336== Memcheck, a memory error detector ==83336== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al. ==83336== Using Valgrind-3.22.0 and LibVEX; rerun with -h for copyright info ==83336== Command: /usr/bin/kwalletd6 ==83336== Parent PID: 83306 ==83336== ==83336== Invalid read of size 16 ==83336== at 0x6210B77: UnknownInlinedFun (emmintrin.h:706) ==83336== by 0x6210B77: aeshash128_lt16 (qhash.cpp:630) ==83336== by 0x6210B77: aeshash128(unsigned char const*, unsigned long, unsigned long, unsigned long) (qhash.cpp:771) ==83336== by 0x56B8F4F: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56BAB4A: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56BE694: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56ABA04: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56C6EE5: KSharedConfig::openConfig(QString const&, QFlags<KConfig::OpenFlag>, QStandardPaths::StandardLocation) (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x2BD42CA8: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x2BD72EAD: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x50AB9CD: qLoadPlugin<QStyle, QStylePlugin> (qfactoryloader_p.h:99) ==83336== by 0x50AB9CD: QStyleFactory::create(QString const&) (qstylefactory.cpp:77) ==83336== by 0x5007BCF: QApplication::style() (qapplication.cpp:919) ==83336== by 0x50081C0: QApplicationPrivate::initialize() (qapplication.cpp:539) ==83336== by 0x50083E4: QApplicationPrivate::init() (qapplication.cpp:486) ==83336== Address 0x2be195e1 is 113 bytes inside a block of size 128 alloc'd ==83336== at 0x484280F: malloc (vg_replace_malloc.c:442) ==83336== by 0x63C3BB0: UnknownInlinedFun (qarraydata.cpp:139) ==83336== by 0x63C3BB0: QArrayData::allocate(QArrayData**, long long, long long, long long, QArrayData::AllocationOption) (qarraydata.cpp:189) ==83336== by 0x63593CC: allocate (qarraydata.h:106) ==83336== by 0x63593CC: QByteArray::reallocData(long long, QArrayData::AllocationOption) (qbytearray.cpp:1927) ==83336== by 0x635958A: QByteArray::resize(long long) (qbytearray.cpp:1866) ==83336== by 0x62576FF: QIODevice::readAll() (qiodevice.cpp:1262) ==83336== by 0x56BD852: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56ABA04: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56C6EE5: KSharedConfig::openConfig(QString const&, QFlags<KConfig::OpenFlag>, QStandardPaths::StandardLocation) (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x2BD42CA8: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x2BD72EAD: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x50AB9CD: qLoadPlugin<QStyle, QStylePlugin> (qfactoryloader_p.h:99) ==83336== by 0x50AB9CD: QStyleFactory::create(QString const&) (qstylefactory.cpp:77) ==83336== by 0x5007BCF: QApplication::style() (qapplication.cpp:919) ==83336== ==83336== Invalid read of size 16 ==83336== at 0x6210B77: UnknownInlinedFun (emmintrin.h:706) ==83336== by 0x6210B77: aeshash128_lt16 (qhash.cpp:630) ==83336== by 0x6210B77: aeshash128(unsigned char const*, unsigned long, unsigned long, unsigned long) (qhash.cpp:771) ==83336== by 0x56B8F4F: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56B95F1: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56BB01F: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56BE694: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56ABA04: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56C6EE5: KSharedConfig::openConfig(QString const&, QFlags<KConfig::OpenFlag>, QStandardPaths::StandardLocation) (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x2BD42CA8: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x2BD72EAD: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x50AB9CD: qLoadPlugin<QStyle, QStylePlugin> (qfactoryloader_p.h:99) ==83336== by 0x50AB9CD: QStyleFactory::create(QString const&) (qstylefactory.cpp:77) ==83336== by 0x5007BCF: QApplication::style() (qapplication.cpp:919) ==83336== by 0x50081C0: QApplicationPrivate::initialize() (qapplication.cpp:539) ==83336== Address 0x2be195e1 is 113 bytes inside a block of size 128 alloc'd ==83336== at 0x484280F: malloc (vg_replace_malloc.c:442) ==83336== by 0x63C3BB0: UnknownInlinedFun (qarraydata.cpp:139) ==83336== by 0x63C3BB0: QArrayData::allocate(QArrayData**, long long, long long, long long, QArrayData::AllocationOption) (qarraydata.cpp:189) ==83336== by 0x63593CC: allocate (qarraydata.h:106) ==83336== by 0x63593CC: QByteArray::reallocData(long long, QArrayData::AllocationOption) (qbytearray.cpp:1927) ==83336== by 0x635958A: QByteArray::resize(long long) (qbytearray.cpp:1866) ==83336== by 0x62576FF: QIODevice::readAll() (qiodevice.cpp:1262) ==83336== by 0x56BD852: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56ABA04: ??? (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x56C6EE5: KSharedConfig::openConfig(QString const&, QFlags<KConfig::OpenFlag>, QStandardPaths::StandardLocation) (in /usr/lib64/libKF6ConfigCore.so.6.0.0) ==83336== by 0x2BD42CA8: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x2BD72EAD: ??? (in /usr/lib64/qt6/plugins/styles/breeze6.so) ==83336== by 0x50AB9CD: qLoadPlugin<QStyle, QStylePlugin> (qfactoryloader_p.h:99) ==83336== by 0x50AB9CD: QStyleFactory::create(QString const&) (qstylefactory.cpp:77) ==83336== by 0x5007BCF: QApplication::style() (qapplication.cpp:919) ==83336== ==83336== Conditional jump or move depends on uninitialised value(s) ==83336== at 0x2BDA8B18: ??? ==83336== by 0x2C05E8DF: ??? ==83336== ==83336== Conditional jump or move depends on uninitialised value(s) ==83336== at 0x82E63F1: QtWaylandClient::QWaylandInputDevice::Keyboard::keyboard_key(unsigned int, unsigned int, unsigned int, unsigned int) (qwaylandinputdevice.cpp:1356) ==83336== by 0xA488055: ffi_call_unix64 (unix64.S:104) ==83336== by 0xA48469F: ffi_call_int.lto_priv.0 (ffi64.c:673) ==83336== by 0xA4874ED: ffi_call (ffi64.c:710) ==83336== by 0x8354F2D: wl_closure_invoke.constprop.0 (connection.c:1025) ==83336== by 0x83557A2: dispatch_event.isra.0 (wayland-client.c:1631) ==83336== by 0x8355A4B: UnknownInlinedFun (wayland-client.c:1777) ==83336== by 0x8355A4B: wl_display_dispatch_queue_pending (wayland-client.c:2019) ==83336== by 0x82CCCD1: QtWaylandClient::QWaylandDisplay::flushRequests() (qwaylanddisplay.cpp:229) ==83336== by 0x62E45A4: QObject::event(QEvent*) (qobject.cpp:1437) ==83336== by 0x5001F67: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3296) ==83336== by 0x6291217: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1121) ==83336== by 0x6295146: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1901) ==83336== ==83336== Invalid read of size 8 ==83336== at 0x4D983FC: QCA::PrivateKey::deriveKey(QCA::PublicKey const&) (qca_publickey.cpp:1033) ==83336== by 0x141991: UnknownInlinedFun (kwalletfreedesktopservice.cpp:424) ==83336== by 0x141991: KWalletFreedesktopService::OpenSession(QString const&, QDBusVariant const&, QDBusObjectPath&) (kwalletfreedesktopservice.cpp:266) ==83336== by 0x166F42: UnknownInlinedFun (kwalletfreedesktopserviceadaptor.cpp:63) ==83336== by 0x166F42: KWalletFreedesktopServiceAdaptor::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (moc_kwalletfreedesktopserviceadaptor.cpp:410) ==83336== by 0x167253: KWalletFreedesktopServiceAdaptor::qt_metacall(QMetaObject::Call, int, void**) (moc_kwalletfreedesktopserviceadaptor.cpp:489) ==83336== by 0x5744B10: QDBusConnectionPrivate::deliverCall(QObject*, int, QDBusMessage const&, QList<QMetaType> const&, int) (qdbusintegrator.cpp:977) ==83336== by 0x5748674: QDBusConnectionPrivate::activateCall(QObject*, int, QDBusMessage const&) [clone .part.0] (qdbusintegrator.cpp:879) ==83336== by 0x57492C5: activateCall (qdbusintegrator.cpp:825) ==83336== by 0x57492C5: QDBusConnectionPrivate::activateObject(QDBusConnectionPrivate::ObjectTreeNode&, QDBusMessage const&, int) (qdbusintegrator.cpp:1460) ==83336== by 0x574B959: QDBusActivateObjectEvent::placeMetaCall(QObject*) (qdbusintegrator.cpp:1580) ==83336== by 0x62E45A4: QObject::event(QEvent*) (qobject.cpp:1437) ==83336== by 0x5001F67: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3296) ==83336== by 0x6291217: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1121) ==83336== by 0x6295146: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1901) ==83336== Address 0x0 is not stack'd, malloc'd or (recently) free'd ==83336== ==83336== ==83336== Process terminating with default action of signal 11 (SIGSEGV): dumping core ==83336== Access not within mapped region at address 0x0 ==83336== at 0x4D983FC: QCA::PrivateKey::deriveKey(QCA::PublicKey const&) (qca_publickey.cpp:1033) ==83336== by 0x141991: UnknownInlinedFun (kwalletfreedesktopservice.cpp:424) ==83336== by 0x141991: KWalletFreedesktopService::OpenSession(QString const&, QDBusVariant const&, QDBusObjectPath&) (kwalletfreedesktopservice.cpp:266) ==83336== by 0x166F42: UnknownInlinedFun (kwalletfreedesktopserviceadaptor.cpp:63) ==83336== by 0x166F42: KWalletFreedesktopServiceAdaptor::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (moc_kwalletfreedesktopserviceadaptor.cpp:410) ==83336== by 0x167253: KWalletFreedesktopServiceAdaptor::qt_metacall(QMetaObject::Call, int, void**) (moc_kwalletfreedesktopserviceadaptor.cpp:489) ==83336== by 0x5744B10: QDBusConnectionPrivate::deliverCall(QObject*, int, QDBusMessage const&, QList<QMetaType> const&, int) (qdbusintegrator.cpp:977) ==83336== by 0x5748674: QDBusConnectionPrivate::activateCall(QObject*, int, QDBusMessage const&) [clone .part.0] (qdbusintegrator.cpp:879) ==83336== by 0x57492C5: activateCall (qdbusintegrator.cpp:825) ==83336== by 0x57492C5: QDBusConnectionPrivate::activateObject(QDBusConnectionPrivate::ObjectTreeNode&, QDBusMessage const&, int) (qdbusintegrator.cpp:1460) ==83336== by 0x574B959: QDBusActivateObjectEvent::placeMetaCall(QObject*) (qdbusintegrator.cpp:1580) ==83336== by 0x62E45A4: QObject::event(QEvent*) (qobject.cpp:1437) ==83336== by 0x5001F67: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3296) ==83336== by 0x6291217: QCoreApplication::notifyInternal2(QObject*, QEvent*) (qcoreapplication.cpp:1121) ==83336== by 0x6295146: QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (qcoreapplication.cpp:1901) ==83336== If you believe this happened as a result of a stack ==83336== overflow in your program's main thread (unlikely but ==83336== possible), you can try to increase the size of the ==83336== main thread stack using the --main-stacksize= flag. ==83336== The main thread stack size used in this run was 8388608. ==83336== ==83336== HEAP SUMMARY: ==83336== in use at exit: 6,225,266 bytes in 40,139 blocks ==83336== total heap usage: 277,987 allocs, 237,848 frees, 37,477,388 bytes allocated ==83336== ==83336== LEAK SUMMARY: ==83336== definitely lost: 512 bytes in 1 blocks ==83336== indirectly lost: 1,357 bytes in 41 blocks ==83336== possibly lost: 550,976 bytes in 65 blocks ==83336== still reachable: 5,670,405 bytes in 40,011 blocks ==83336== of which reachable via heuristic: ==83336== newarray : 10,000 bytes in 60 blocks ==83336== multipleinheritance: 2,080 bytes in 6 blocks ==83336== suppressed: 0 bytes in 0 blocks ==83336== Rerun with --leak-check=full to see details of leaked memory ==83336== ==83336== Use --track-origins=yes to see where uninitialised values come from ==83336== For lists of detected and suppressed errors, rerun with: -s ==83336== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 0 from 0) plasmashell crashed when I ran protonvpn-app in Konsole with kwalletd6 under valgrind which I hadn't seen before. -- You are receiving this mail because: You are watching all bug changes.