Crash in gnutls_x509_privkey_import_pkcs8()

[dwmw2]

$ git clone git://git.infradead.org/users/dwmw2/openconnect.git
$ nm-connection-editor

Add a Wifi connection, use EAP-TLS and click the button to select a private key. Navigate to the openconnect/tests/certs/ directory. Watch it segfault instead of displaying the contents of that directory in the file browser.

Thread 1 "nm-connection-e" received signal SIGSEGV, Segmentation fault.
__memset_avx2 () at ../sysdeps/x86_64/multiarch/memset-avx2.S:161
161 ../sysdeps/x86_64/multiarch/memset-avx2.S: No such file or directory.
(gdb) bt
#0 __memset_avx2 () at ../sysdeps/x86_64/multiarch/memset-avx2.S:161
#1 0x00007ffff1ddff1d in gnutls_memset ()
   from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
#2 0x00007ffff1e13a96 in ?? () from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
#3 0x00007ffff1e1673f in ?? () from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
#4 0x00007ffff1e17d6e in gnutls_x509_privkey_import_pkcs8 ()
   from /usr/lib/x86_64-linux-gnu/libgnutls.so.30
#5 0x00007ffff6ccdc48 in ?? () from /usr/lib/x86_64-linux-gnu/libnm.so.0
#6 0x00007ffff6c8c3e5 in ?? () from /usr/lib/x86_64-linux-gnu/libnm.so.0
#7 0x00007ffff6c8c4ff in ?? () from /usr/lib/x86_64-linux-gnu/libnm.so.0
#8 0x00007ffff6cc7fc3 in nm_utils_file_is_private_key ()
   from /usr/lib/x86_64-linux-gnu/libnm.so.0
#9 0x0000000000440913 in ?? ()
#10 0x00007ffff742f6a1 in gtk_file_filter_filter ()
   from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#11 0x00007ffff7432135 in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#12 0x00007ffff7432aae in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#13 0x00007ffff7432ccc in ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
#14 0x00007ffff68f8237 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#15 0x00007ffff692eb43 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#16 0x00007ffff692eb79 in ?? () from /usr/lib/x86_64-linux-gnu/libgio-2.0.so.0
#17 0x00007ffff638d05a in g_main_context_dispatch ()
   from /lib/x86_64-linux-gnu/libglib-2.0.so.0

Apologies for lack of debugging symbols; it wasn't clear how to install those. And it's trivially reproducible on Ubuntu 16.04.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[dwmw2 (dwmw2)]

Without debugging symbols I can at least strace it. The last file opened was
openconnect/tests/certs/ec-key-pkcs8-pbes2-sha1.pem

[dwmw2 (dwmw2)]

And indeed openconnect fails too:

$ openconnect -c tests/certs/ec-cert.pem -k tests/certs/ec-key-pkcs8-pbes2-sha1.pem auth.startssl.com

It doesn't show up in the openconnect 'make check' because adding '--key-password password' to the command line actually fixes it; it's something to do with the password callback or decryption attempt loop.

[dwmw2 (dwmw2)]

Testing on Fedora (GnuTLS 3.5.7) shows that GnuTLS returns the wrong error code in this situation but doesn't crash. So probably a separate bug: https://bugzilla.redhat.com/show_bug.cgi?id=1404192

[Nikos Mavrogiannopoulos (nmavrogiannopoulos)]

I believe that this is related with this bug
https://gitlab.com/gnutls/gnutls/issues/148

that was fixed only in 3.5.x branch. I've backported it to the 3.4.x branch at:
https://gitlab.com/gnutls/gnutls/merge_requests/188