Bug#1108423: debsecan crashes on non-ASCII Maintainer field of libharfbuzz0a in /var/lib/dpkg/status

2025-06-28 Thread Kingsley G. Morse Jr.
Hi Florian,

Thank you very, very much for your

quick,
clear,
generous and
smart

email.

All are fine qualities!

I

am happy to report you helped me stop debsecan
from crashing with

root$ aptitude purge libharfbuzz0a xmovie

think my /var/lib/dpkg/status file had
non-utf-8 data because my computer still had
configuration files for obsolete removed
packages,

found them with

$ grep -B 10 -axv '.*' /var/lib/dpkg/status

learned they're obsolete with

$ apt-cache policy libharfbuzz0a:i386 xmovie

and revealled their configuration files with 

$ dpkg -l libharfbuzz0a xmovie


I wonder if line 137 in __iter__ of
/usr/bin/debsecan could have a nice python "try
block" added around it to

check for errors,

report which package in /var/lib/dpkg/status
crashed it and

make the important package debsecan more
resilient.

Thanks again Florian.

Your help was cool.

Kind regards,
Kingsley

On 06/28/2025 10:27, Florian Weimer wrote:
> * Kingsley G. Morse, Jr.:
> 
> > I happened to notice it crashes when a package's
> > Maintainer field in /var/lib/dpkg/status contains
> > non-Latin characters.
> 
> The control file of the package has valid UTF-8, so something must
> have happened to your version to /var/lib/dpkg/status.
> 
> Do you have anything on your system that depends on libharfbuzz0a?
> Maybe you can just deinstall the package.

-- 
Time is the fire in which we all burn.



Bug#1108423: debsecan crashes on non-ASCII Maintainer field of libharfbuzz0a in /var/lib/dpkg/status

2025-06-28 Thread Florian Weimer
* Kingsley G. Morse, Jr.:

> I happened to notice it crashes when a package's
> Maintainer field in /var/lib/dpkg/status contains
> non-Latin characters.

The control file of the package has valid UTF-8, so something must
have happened to your version to /var/lib/dpkg/status.

Do you have anything on your system that depends on libharfbuzz0a?
Maybe you can just deinstall the package.