rtorrent crashes on startup

[Ignat Loskutov]

After some upgrade (I'm using 24.04, so `-D_FORITFY_SOURCE=3` applies), it seems that some increased level of libc hardening has been applied, leading to a crash inside the `Lockfile::try_lock()` function on startup.

There is an upstream commit addressing this issue (https://github.com/rakshasa/rtorrent/commit/92bec88d0904bfb31c808085c2fd0f22d0ec8db7) but no release has been formed to include it yet.

SRU addendum

[ Impact ]

Any user which specifies a session directory to save torrent progress (I'd say this is the normal setup for anyone using rtorrent regularly) will have persistent crashing on startup. This renders rtorrent unusable for some (most?) users, warranting a SRU.

[ Test Plan ]

docker run -it ubuntu:24.04 sh -c 'apt update && apt install -y rtorrent && rtorrent -s ~'

yields

*** buffer overflow detected ***: terminated

Expected behavior is for the software to not crash and show the normal TUI.

[ Where problems could occur ]

Minor risk of regression for the codechange as such. It's been in upstream for a long time already so it's well tested, the only reason we have to patch it manually here is because rtorrent havent had an upstream release in a long time.
Multiple users are reporting the issue as fixed once the patch has been applied.

Naturally there's always a risk of something unexpected, (memory leaks or introducing another crash somewhere else) but this patch has worked reliably for me for weeks now.

[ Other Info ]
N/A

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Evgeni Vasilev (aquilax)]

(gdb) bt
#0 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:44
#1 __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6) at ./nptl/pthread_kill.c:89
#3 0x00007ffff764526e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#4 0x00007ffff76288ff in __GI_abort () at ./stdlib/abort.c:79
#5 0x00007ffff76297b6 in __libc_message_impl (fmt=fmt@entry=0x7ffff77ce765 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:132
#6 0x00007ffff7736c19 in __GI___fortify_fail (msg=msg@entry=0x7ffff77ce74c "buffer overflow detected") at ./debug/fortify_fail.c:24
#7 0x00007ffff77365d4 in __GI___chk_fail () at ./debug/chk_fail.c:28
#8 0x00007ffff7737db5 in ___snprintf_chk (s=<optimized out>, maxlen=maxlen@entry=255, flag=flag@entry=2, slen=<optimized out>, format=format@entry=0x555555646372 ":+%i\n")
    at ./debug/snprintf_chk.c:29
#9 0x00005555555cbce1 in snprintf (__fmt=<optimized out>, __n=<optimized out>, __s=<optimized out>, __s=<optimized out>, __n=<optimized out>, __fmt=<optimized out>)
    at /usr/include/x86_64-linux-gnu/bits/stdio2.h:54
#10 utils::Lockfile::try_lock (this=0x5555556dbd40) at utils/lockfile.cc:101
#11 core::DownloadStore::enable (lock=<optimized out>, this=0x5555556dbd20) at core/download_store.cc:74
#12 Control::initialize (this=0x5555556d7480) at /usr/src/rtorrent-0.9.8-1build3/src/control.cc:115
#13 0x00005555555947af in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/rtorrent-0.9.8-1build3/src/main.cc:469

[Frédéric Giquel (fredericgiquel)]

I'm facing the same crash when I use the "-s" option of rtorrent on Ubuntu 24.04.

So I tried to recompile the package after applyng the patch from upstream suggested in the original post. It fixes the crash.

[Russell Phillips (ignissport)]

Seconded. Doing an "apt source rtorrent", applying this patch, building and installing fixes the issue for me.

Rakshasa hasn't done an official release since 2019, and this commit has been sitting in trunk for over a year. It would be nice to see this patch expedited. I can't tell how long we'll be waiting for the next upstream release.

[Launchpad Janitor (janitor)]

This bug was fixed in the package rtorrent - 0.9.8-1.1ubuntu1

---------------
rtorrent (0.9.8-1.1ubuntu1) oracular; urgency=medium

  * d/rules: fix buffer overflow (LP: #2063110)

 -- Alexander Fougner <email address hidden> Sat, 06 Jul 2024 11:51:52 +0200

[Dave Jones (waveform)]

This looks good: a nice minimal patch, patch has proper headers and attribution, SRU template looks well written with an easy to use test-case and a reasonable regression section, and the patch is well formed with a good version number for SRU.

One minor quibble: the changelog mentions d/rules but this file isn't actually changed in the diff, it's a new patch instead. However, I'm happy to fix that on upload; sponsoring for noble.

[Alexander Fougner (fougner)]

@Dave The reason I used d/rules is because that's what I got told in the review for oracular. I was under the impression that any "code change" for the package would fall under d/rules, and the previous upload got sponsored as is. Anyways, thanks for fixing and the sponsoring!