Invalid read, DBstats crashes with glibc 2.32

[Balint Reczey]

While testing glibc 2.32 we discovered dazzdb crasing in Ubuntu CI:
https://autopkgtest.ubuntu.com/packages/d/dazzdb/groovy/amd64

The root cause seems to be an invalid read, which can be detected even with glibc 2.31, but for some reason it does not end up in a crash.
I've replaced the crashing command with valgrind ...:

==2386== Memcheck, a memory error detector
==2386== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==2386== Using Valgrind-3.16.1 and LibVEX; rerun with -h for copyright info
==2386== Command: DBstats -mdust G
==2386==
==2386== Invalid read of size 8
==2386== at 0x10B146: main (DBstats.c:269)
==2386== Address 0x4ba9e20 is 0 bytes inside a block of size 64 free'd
==2386== at 0x483DA3F: free (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==2386== by 0x10B140: main (DBstats.c:350)
==2386== Block was alloc'd at
==2386== at 0x483C7F3: malloc (in /usr/lib/x86_64-linux-gnu/valgrind/vgpreload_memcheck-amd64-linux.so)
==2386== by 0x1108C5: UnknownInlinedFun (DB.c:67)
==2386== by 0x1108C5: Open_Track (DB.c:1952)
==2386== by 0x10B19E: main (DBstats.c:108)
==2386==
==2386==
==2386== HEAP SUMMARY:
==2386== in use at exit: 196 bytes in 3 blocks
==2386== total heap usage: 30 allocs, 27 frees, 153,650 bytes allocated
==2386==
==2386== LEAK SUMMARY:
==2386== definitely lost: 80 bytes in 1 blocks
==2386== indirectly lost: 0 bytes in 0 blocks
==2386== possibly lost: 0 bytes in 0 blocks
==2386== still reachable: 116 bytes in 2 blocks
==2386== suppressed: 0 bytes in 0 blocks
==2386== Rerun with --leak-check=full to see details of leaked memory
==2386==
==2386== For lists of detected and suppressed errors, rerun with: -s
==2386== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

I'm tagging the package with block-proposed because I'll ask for demoting it to groovy-proposed or removing it and if the demotion takes place first it should not migrate to release before glibc 2.32.

[Balint Reczey (rbalint)]

https://github.com/thegenemyers/DAZZ_DB/issues/41

[Steve Langasek (vorlon)]

Removing packages from groovy:
 dazzdb 1.0+git20200727.d22ae58-1 in groovy
  dazzdb 1.0+git20200727.d22ae58-1 in groovy amd64
  dazzdb 1.0+git20200727.d22ae58-1 in groovy arm64
  dazzdb 1.0+git20200727.d22ae58-1 in groovy armhf
  dazzdb 1.0+git20200727.d22ae58-1 in groovy ppc64el
  dazzdb 1.0+git20200727.d22ae58-1 in groovy riscv64
  dazzdb 1.0+git20200727.d22ae58-1 in groovy s390x
Comment: Broken with glibc 2.32 due to latent bug; LP: #1895685
1 package successfully removed.

Removing packages from groovy:
 hinge 0.5.0-6build1 in groovy
  hinge 0.5.0-6build1 in groovy amd64
  hinge 0.5.0-6build1 in groovy arm64
  hinge 0.5.0-6build1 in groovy armhf
  hinge 0.5.0-6build1 in groovy ppc64el
Comment: Depends on removed dazzdb; LP: #1895685
1 package successfully removed.

[Graham Inggs (ginggs)]

This bug was fixed in the package dazzdb - 1.0+git20201103.8d98c37-1.1

---------------
dazzdb (1.0+git20201103.8d98c37-1.1) unstable; urgency=medium

  * Non-maintainer upload.
  * Fix a use-after-free in DBstats (Closes: #993770)

 -- Aurelien Jarno <email address hidden> Tue, 14 Sep 2021 20:53:44 +0200