python3-pykdl: PyKDL crashes Python 3 interpretter (SIGABRT) if any API accepting a str is used

[Shane Loretz]

[Impact]

 * The package python3-pykdl in focal crashes the Python 3 interpreter if any API accepting a str is used.

 * python3-pykdl is used in the ROS robot control software (https://ros.org) based on Ubuntu.

 * The patch is taken from upstream and uses PyUnicode_AsUTF8, as provided by Python 3.

[Test Case]

$ python3 -c "import PyKDL; PyKDL.Tree('foobar')"
python3: /build/orocos-kdl-oHbJfL/orocos-kdl-1.4.0/python_orocos_kdl/PyKDL/std_string.sip:52: int convertTo_std_string(PyObject*, void**, int*, PyObject*): Assertion `PyUnicode_Check(s)' failed.
Aborted (core dumped)
$ echo $?
134

[Regression Potential]

 * The patch is part of upstream git since 2018 [1], Debian bullseye [2] , Ubuntu groovy and has been accepted into Debian buster [3].

 * I don't see a regression potential as is basically the utf-8 transition of Python 3.

[1] https://github.com/orocos/orocos_kinematics_dynamics/commit/ee996a4442339010571cadd976fc6ed17c98dfab
[2] https://tracker.debian.org/news/1117004/accepted-orocos-kdl-140-9-source-into-unstable/
[3] https://tracker.debian.org/news/1119612/accepted-orocos-kdl-140-7deb10u1-source-into-proposed-updates-stable-new-proposed-updates/

[Original Description]

Dear Maintainer,

The package python3-pykdl crashes the Python 3 interpreter if any API
accepting a str is used. I've tested this using the latest Focal packages.

Minimal reproducible example:

$ python3 -c "import PyKDL; PyKDL.Tree('foobar')"
python3: /build/orocos-kdl-mPkyII/orocos-kdl-1.4.0/python_orocos_kdl/PyKDL/std_string.sip:52: int convertTo_std_string(PyObject*, void**, int*, PyObject*): Assertion `PyUnicode_Check(s)' failed.
Aborted (core dumped)
$ echo $?
134

There is a patch fixing this issue in this upstream Debian Buster bug:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956254

Would you be willing to apply that patch in Ubuntu Focal?

Cheers,
Shane

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jochen Sprickerhof (v-launchpad-jochen-sprickerhof-de)]

Hi Shane,

there is not really a maintainer for Ubuntu, can you prepare the SRU yourself?
https://wiki.ubuntu.com/StableReleaseUpdates

Cheers Jochen

[rawphi (raphael-ist)]

Until it is fixed, a workaround is to use the upstream debian package:

wget http://deb.debian.org/debian/pool/main/o/orocos-kdl/python3-pykdl_1.4.0-9_amd64.deb && sudo dpkg --install python3-pykdl_1.4.0-9_amd64.deb

[Jochen Sprickerhof (v-launchpad-jochen-sprickerhof-de)]

debdiff of the patch adoped from Debian buster.

[Marc Deslauriers (mdeslaur)]

ACK on the debdiff in comment #4, uploaded for processing by the SRU team

[Brian Murray (brian-murray)]

Hello Shane, or anyone else affected,

Accepted orocos-kdl into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/orocos-kdl/1.4.0-7ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Jochen Sprickerhof (v-launchpad-jochen-sprickerhof-de)]

I tested: python3-pykdl:amd64 1.4.0-7ubuntu1
by:
python3 -c "import PyKDL; PyKDL.Tree('foobar')"
git clone https://github.com/ros/kdl_parser/
rm kdl_parser_py/CATKIN_IGNORE
catkin_make run_tests
(according to https://github.com/ros/kdl_parser/pull/38#issuecomment-608474487)

both work fine.

[Launchpad Janitor (janitor)]

This bug was fixed in the package orocos-kdl - 1.4.0-7ubuntu1

---------------
orocos-kdl (1.4.0-7ubuntu1) focal; urgency=medium

  * Add patch for python3 std string conversion (LP: #1871725)

 -- Jochen Sprickerhof <email address hidden> Thu, 09 Apr 2020 18:46:55 +0200

[Łukasz Zemczak (sil2100)]

The verification of the Stable Release Update for orocos-kdl has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.