gtkpod segfaults when attempting to display songs

[Matthew Ruffell]

Open gtkpod, and select your ipod from the list. If it has more than one screenfull of songs to display in the list, gtkpod will immediately segfault.

I haven't found a workaround yet.

Broken on Mantic, works on Lunar.

Thread 1 "gtkpod" received signal SIGSEGV, Segmentation fault.
__GI___wcsxfrm_l (dest=0x0, src=0x0, n=0, l=0x7ffff6fff5a0 <_nl_global_locale>) at ../string/strxfrm_l.c:685
685 ../string/strxfrm_l.c: No such file or directory.
(gdb) bt
#0 __GI___wcsxfrm_l (dest=0x0, src=0x0, n=0, l=0x7ffff6fff5a0 <_nl_global_locale>) at ../string/strxfrm_l.c:685
#1 0x00007ffff70c5a5e in g_utf8_collate_key () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 0x00007ffff7f852ec in fuzzy_skip_prefix () at /lib/x86_64-linux-gnu/libgtkpod.so.1
#3 0x00007fffa80980ca in ??? () at /usr/lib/x86_64-linux-gnu/gtkpod/libsorttab_display.so
#4 0x00007fffa80997fd in normal_sort_tab_page_add_track () at /usr/lib/x86_64-linux-gnu/gtkpod/libsorttab_display.so
#5 0x00007fffa8099526 in normal_sort_tab_page_add_track () at /usr/lib/x86_64-linux-gnu/gtkpod/libsorttab_display.so
#6 0x00007fffa809f196 in sorttab_display_select_playlist_cb () at /usr/lib/x86_64-linux-gnu/gtkpod/libsorttab_display.so
#7 0x00007ffff718d130 in g_closure_invoke () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#8 0x00007ffff71ba4ac in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#9 0x00007ffff71ab9b1 in ??? () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#10 0x00007ffff71abbd6 in g_signal_emit_valist () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#11 0x00007ffff71abc93 in g_signal_emit () at /lib/x86_64-linux-gnu/libgobject-2.0.so.0
#12 0x00007ffff7f67e4b in gtkpod_set_current_playlist () at /lib/x86_64-linux-gnu/libgtkpod.so.1
#13 0x00007fffa807cce0 in ??? () at /usr/lib/x86_64-linux-gnu/gtkpod/libplaylist_display.so
#14 0x00007ffff708ba11 in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#15 0x00007ffff70e746f in ??? () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#16 0x00007ffff708c46f in g_main_loop_run () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#17 0x00007ffff77f61ed in gtk_main () at /lib/x86_64-linux-gnu/libgtk-3.so.0
#18 0x000055555555ea1f in main ()

[Matthew Ruffell (mruffell)]

Okay, so fuzzy_skip_prefix() in libgtkpod calls g_utf8_collate_key() twice in a loop, once with len=3 and then once with len=2.

I found this by patching fuzzy_skip_prefix() like so:

libgtkpod/misc.c

 458 const gchar *
 459 fuzzy_skip_prefix(const gchar *name) {
 460 const gchar *result = name;
 461 const GList *gl;
 462 gchar *cleanStr;
...
 470 cleanStr = g_utf8_casefold(name, -1);
 471 for (gl = csfk_list; gl; gl = g_list_next(gl)) {
 472 struct csfk *csfk = gl->data;
 473 gchar *tempStr;
 474
 475 g_return_val_if_fail (csfk, 0);
+476 fprintf(stderr, "Song name: %s length: %d\n", cleanStr, csfk->length);
 477 tempStr = g_utf8_collate_key(cleanStr, csfk->length);
...

I get output like this:

...
Song name: fórmula, vol. 2 (deluxe edition) length: 3
Song name: fórmula, vol. 2 (deluxe edition) length: 2
Thread 1 "gtkpod" received signal SIGSEGV, Segmentation fault.
__GI___wcsxfrm_l (dest=0x0, src=0x0, n=0, l=0x7ffff6fff5a0 <_nl_global_locale>) at ../string/strxfrm_l.c:685
685 ../string/strxfrm_l.c: No such file or directory.
(gdb) bt
#0 __GI___wcsxfrm_l (dest=0x0, src=0x0, n=0, l=0x7ffff6fff5a0 <_nl_global_locale>) at ../string/strxfrm_l.c:685
#1 0x00007ffff70c5a5e in g_utf8_collate_key () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#2 0x00007ffff7f82c5a in fuzzy_skip_prefix () at /lib/x86_64-linux-gnu/libgtkpod.so.1

It seems to not like special characters, in this case, the ó.

I also looked on the Arch Linux AUR page, and it seems others have also noticed that special characters are breaking them too.

https://aur.archlinux.org/packages/gtkpod#comment-936852

[Matthew Ruffell (mruffell)]

I have managed to write a minimal reproducer program:

#include <glib.h>
int main(int argc, char **argv) {
 const gchar* badstring = "fórmula, vol. 2 (deluxe edition)";
 gsize len = 2;
 gchar* ret;

 ret = g_utf8_collate_key(badstring, len);
 g_free(ret);

 return 0;
}

With the following Makefile:

all:
 cc `pkg-config --cflags glib-2.0` hello.c -g -o hello `pkg-config --libs glib-2.0`

On mantic, with:
$ apt-cache policy libglib2.0-0 | grep Installed
  Installed: 2.78.0-2
$ apt-cache policy libc6 | grep Installed
  Installed: 2.38-1ubuntu6
$ make
cc `pkg-config --cflags glib-2.0` hello.c -g -o hello `pkg-config --libs glib-2.0`
$ gdb hello
Program received signal SIGSEGV, Segmentation fault.
__wcslen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
76 ../sysdeps/x86_64/multiarch/strlen-avx2.S: No such file or directory.
(gdb) bt
#0 __wcslen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1 0x00007ffff7cd0ace in __GI___wcsxfrm_l (dest=0x0, src=0x0, n=0, l=<optimised out>) at ../string/strxfrm_l.c:676
#2 0x00007ffff7ef1a5e in g_utf8_collate_key () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
#3 0x00005555555551a2 in main (argc=1, argv=0x7fffffffe118) at hello.c:8

and now on Lunar, with:
$ apt-cache policy libglib2.0-0 | grep Installed
  Installed: 2.76.1-1
$ apt-cache policy libc6 | grep Installed
  Installed: 2.37-0ubuntu2.1
$ make
cc `pkg-config --cflags glib-2.0` hello.c -o hello `pkg-config --libs glib-2.0`
$ gdb hello
[Inferior 1 (process 3593) exited normally]

This seems to be a glib or glibc bug, and not gtkpod. Introduced in mantic and later.

[Matthew Ruffell (mruffell)]

The bug is in glib. I built 2.76.4-0ubuntu1 from lunar-proposed and installed it on noble.

$ ./hello
Segmentation fault (core dumped)
$ sudo dpkg -i ./libglib2.0-0_2.76.4-0ubuntu1_amd64.deb ./libglib2.0-bin_2.76.4-0ubuntu1_amd64.deb ./libglib2.0-data_2.76.4-0ubuntu1_all.deb ./libglib2.0-dev_2.76.4-0ubuntu1_amd64.deb ./libglib2.0-dev-bin_2.76.4-0ubuntu1_amd64.deb
dpkg: warning: downgrading libglib2.0-0:amd64 from 2.78.1-4 to 2.76.4-0ubuntu1
(Reading database ... 85128 files and directories currently installed.)
Preparing to unpack .../libglib2.0-0_2.76.4-0ubuntu1_amd64.deb ...
Unpacking libglib2.0-0:amd64 (2.76.4-0ubuntu1) over (2.78.1-4) ...
dpkg: warning: downgrading libglib2.0-bin from 2.78.1-4 to 2.76.4-0ubuntu1
Preparing to unpack .../libglib2.0-bin_2.76.4-0ubuntu1_amd64.deb ...
Unpacking libglib2.0-bin (2.76.4-0ubuntu1) over (2.78.1-4) ...
dpkg: warning: downgrading libglib2.0-data from 2.78.1-4 to 2.76.4-0ubuntu1
Preparing to unpack .../libglib2.0-data_2.76.4-0ubuntu1_all.deb ...
Unpacking libglib2.0-data (2.76.4-0ubuntu1) over (2.78.1-4) ...
dpkg: warning: downgrading libglib2.0-dev:amd64 from 2.78.1-4 to 2.76.4-0ubuntu1
Preparing to unpack .../libglib2.0-dev_2.76.4-0ubuntu1_amd64.deb ...
Unpacking libglib2.0-dev:amd64 (2.76.4-0ubuntu1) over (2.78.1-4) ...
dpkg: warning: downgrading libglib2.0-dev-bin from 2.78.1-4 to 2.76.4-0ubuntu1
Preparing to unpack .../libglib2.0-dev-bin_2.76.4-0ubuntu1_amd64.deb ...
Unpacking libglib2.0-dev-bin (2.76.4-0ubuntu1) over (2.78.1-4) ...
Setting up libglib2.0-0:amd64 (2.76.4-0ubuntu1) ...
No schema files found: doing nothing.
Setting up libglib2.0-data (2.76.4-0ubuntu1) ...
Setting up libglib2.0-dev-bin (2.76.4-0ubuntu1) ...
Setting up libglib2.0-bin (2.76.4-0ubuntu1) ...
Setting up libglib2.0-dev:amd64 (2.76.4-0ubuntu1) ...
Processing triggers for libc-bin (2.38-3ubuntu1) ...
Processing triggers for man-db (2.11.2-3) ...
$ ./hello
$ gdb hello
[Inferior 1 (process 45996) exited normally]

[Phil Wyett (kathenas)]

This is likely to see little attention for the following reasons:

* Not maintained/No viable upstream.
* Remove Request (RM) is active in Debian. [1]

This package is likely to be soon removed and I would advise looking for an alternative to it.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1018855

[Matthew Ruffell (mruffell)]

Upstream bug: https://gitlab.gnome.org/GNOME/glib/-/issues/3185

[Matthew Ruffell (mruffell)]

Attached is a debdiff for mantic which fixes this issue.

[Matthew Ruffell (mruffell)]

gtkpod has been removed from debian, and thus removed from noble, so no need to fix there.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Debdiff for gtkpod on mantic" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Jeremy Bícha (jbicha)]

Please update the bug description to use the SRU Template in order for this to be sponsored for Ubuntu 23.10.

https://wiki.ubuntu.com/StableReleaseUpdates#SRU_Bug_Template

Does this fix require a fix for glib in Ubuntu 23.10 first?

I am setting this bug to Incomplete and unsubscribing ubuntu-sponsors. Please set it back to New and resubscribe ubuntu-sponsors when these items have been dealt with.