appstreamcli: double free or corruption with certain metadata

Bug #1574896 reported by Matthias Klumpp on 2016-04-25
This bug affects 4 people
Affects Status Importance Assigned to Milestone
appstream (Debian)
Fix Released
appstream (Ubuntu)

Bug Description

This crash happens if a certain combination of metadata and (not) availability of icons is met.
See the linked Debian bug report for details.
This bug manifests itself usually during an apt update run, if PPAs or other sources with that metadata are available.
A debdiff which solves this problem is attached.

Matthias Klumpp (ximion) wrote :

The attachment "appstream_dfoc-debbug822317-patch.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Changed in appstream (Debian):
status: Unknown → Fix Released
Iain Lane (laney) on 2016-04-29
Changed in appstream (Ubuntu):
status: Fix Committed → Fix Released
Iain Lane (laney) wrote :

I uploaded the fix, hopefully the SRU team will accept it - a reproducer will help

Changed in appstream (Ubuntu Xenial):
status: New → In Progress
Matthias Klumpp (ximion) wrote :

It's really hard to reproduce, likely depends on the individual machine.

In theory, this should trigger the bug:

* Add the Debian Sid sources to /etc/apt/sources.list (deb stretch main)
* Disable Ubuntu main/universe in sources.list (to prevent ID collisions from shadowing the bug)
* Run "sudo rm /var/lib/apt/lists/*Components*" to ensure the caches are clean
* Run "sudo apt update"
* Observe crash
* Run "sudo appstreamcli refresh --force --verbose"
* Observe crash (if it didn't happen already)
* Reset everything back to the previous state

It sometimes works (as in: you see the crash), many times it doesn't work... Yeah, it's that kind of bug :-/ The users seem to be much better at triggering it than I am :-D

Matthias Klumpp (ximion) on 2016-05-01
Changed in appstream (Ubuntu Xenial):
importance: Undecided → High
Matthias Klumpp (ximion) wrote :

I updated the patch to also include a fix for LP: #1579712

Matthias Klumpp (ximion) wrote :
Changed in appstream (Ubuntu Xenial):
milestone: none → xenial-updates
Changed in appstream (Ubuntu):
milestone: xenial-updates → none

Hello Matthias, or anyone else affected,

Accepted appstream into xenial-proposed. The package will build now and be available at in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at . Thank you in advance!

Changed in appstream (Ubuntu Xenial):
status: In Progress → Fix Committed
tags: added: verification-needed

I didn't have that crash.

tags: added: verification-done
removed: verification-needed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package appstream - 0.9.4-1ubuntu1

appstream (0.9.4-1ubuntu1) xenial; urgency=medium

  * iconfinding-refactor.patch: Fix double-free corruption which
    happens with certain metadata. (LP: #1574896)
  * fix-decompression.patch: Fix hang when refreshing the metadata
    cache. (LP: #1579712)

 -- Matthias Klumpp <email address hidden> Tue, 26 Apr 2016 10:18:14 +0200

Changed in appstream (Ubuntu Xenial):
status: Fix Committed → Fix Released

The verification of the Stable Release Update for appstream has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.