[ISSUE] zathura and synctex: segfault

[ISSUE] zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 379 bytes --]

New issue by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722

Description:
For me, on `x86_64-musl`, the command
```
$ zathura --synctex-forward 1:1:'test.tex' 'test.pdf'
Segmentation fault
```
Do you see the same issue @ericonr @lemmi ?
I discovered it using `vimtex`, but it seems an issue in `zathura` + `libsynctex`.
Thanks.

Re: zathura and synctex: segfault

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 609 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-871452449

Comment:
Have you captured a backtrace? I could generate a segfault once, most of the time I just get `!SyncTeX Error : No File?` instead.

Stracing it looks highly suspicious, lots of

```
6982  open(0x7f9cc37f4170, O_RDONLY)    = -1 ENOENT (Arquivo ou diretório inexistente)
```

calls (also `stat`) where the string isn't shown, which would indicate to me they are doing something bad enough with memory that they are passing arbitrary points in memory to `open`.

Re: zathura and synctex: segfault

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 193 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-871462019

Comment:
I'm actually building one with synctex info now :)

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 206 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-871479089

Comment:
It works on my `glibc` container, so it could be a `musl` problem.

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 237 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-871480087

Comment:
I can `strace` it, but it generates a very long output. Anything special I should be looking for?

Re: zathura and synctex: segfault

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 497 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-871667884

Comment:
I think my execution stops much earlier than yours, because I somehow can't manage to create the synctex file. Any tips?

If you can run it under gdb and catch the segfault, then print a backtrace, that'd be best :)

`DEBUGINFOD_URLS="https://debuginfod.s.voidlinux.org" gdb --args zathura ...` and you can even avoid downloading the `-dbg` packages.

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 1587 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-872022593

Comment:
I use the `vimtex` plugin, which generates the synctex file, see https://github.com/lervag/vimtex (you also need `xdotool`).

Am I doing this right? it is running for several minutes without any new output, just maxing out a core..

```
$ DEBUGINFOD_URLS="https://debuginfod.s.voidlinux.org" gdb --args zathura --synctex-forward 1:1:'test.tex' 'test.pdf'
GNU gdb (GDB) 10.2
Copyright (C) 2021 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-musl".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from zathura...
(No debugging symbols found in zathura)
(gdb) run
Starting program: /usr/bin/zathura --synctex-forward 1:1:test.tex test.pdf
[New LWP 19565]
[New LWP 19566]
[New LWP 19567]
[New LWP 19568]
[LWP 19568 exited]
[LWP 19567 exited]
[New LWP 19692]
[New LWP 19693]
[LWP 19693 exited]
[LWP 19692 exited]

```

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 10242 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-872237071

Comment:
Do you see anything relevant here?
```
$ zathura --log-level=debug --synctex-forward 1:1:'test.tex' 'test.pdf'
debug: ../zathura/main.c:202: main(): No instance found. Starting new one.
debug: ../girara/template.c:311: base_changed(): Variable 'session' not set.
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/pdf
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/oxps
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/epub+zip
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/x-fictionbook+xml
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/xml
debug: ../zathura/plugin.c:173: load_plugin(): Successfully loaded plugin from '/usr/lib/zathura/libpdf-mupdf.so'.
debug: ../zathura/plugin.c:174: load_plugin(): plugin pdf-mupdf: version 0.3.6
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/postscript
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/eps
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: application/x-eps
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: image/eps
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: image/x-eps
debug: ../zathura/plugin.c:173: load_plugin(): Successfully loaded plugin from '/usr/lib/zathura/libps.so'.
debug: ../zathura/plugin.c:174: load_plugin(): plugin ps: version 0.2.6
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: image/vnd.djvu
debug: ../zathura/plugin.c:278: register_plugin(): plugin: filetype mapping added: image/vnd.djvu+multipage
debug: ../zathura/plugin.c:173: load_plugin(): Successfully loaded plugin from '/usr/lib/zathura/libdjvu.so'.
debug: ../zathura/plugin.c:174: load_plugin(): plugin djvu: version 0.2.9
debug: ../girara/config.c:420: girara_config_parse(): reading configuration file '/etc/xdg/zathurarc'
debug: ../girara/config.c:327: config_parse(): failed to open config file '/etc/xdg/zathurarc'
debug: ../girara/config.c:420: girara_config_parse(): reading configuration file '/etc/zathurarc'
debug: ../girara/config.c:327: config_parse(): failed to open config file '/etc/zathurarc'
debug: ../girara/config.c:420: girara_config_parse(): reading configuration file '/home/nicolo/.config/zathura/zathurarc'
debug: ../zathura/zathura.c:444: zathura_init(): Basic sandbox allowing normal operation.
debug: ../zathura/seccomp-filters.c:51: seccomp_enable_basic_filter(): adding rule kill to _sysctl
debug: ../zathura/seccomp-filters.c:52: seccomp_enable_basic_filter(): adding rule kill to acct
debug: ../zathura/seccomp-filters.c:53: seccomp_enable_basic_filter(): adding rule kill to add_key
debug: ../zathura/seccomp-filters.c:54: seccomp_enable_basic_filter(): adding rule kill to adjtimex
debug: ../zathura/seccomp-filters.c:55: seccomp_enable_basic_filter(): adding rule kill to chroot
debug: ../zathura/seccomp-filters.c:56: seccomp_enable_basic_filter(): adding rule kill to clock_adjtime
debug: ../zathura/seccomp-filters.c:57: seccomp_enable_basic_filter(): adding rule kill to create_module
debug: ../zathura/seccomp-filters.c:58: seccomp_enable_basic_filter(): adding rule kill to delete_module
debug: ../zathura/seccomp-filters.c:59: seccomp_enable_basic_filter(): adding rule kill to fanotify_init
debug: ../zathura/seccomp-filters.c:60: seccomp_enable_basic_filter(): adding rule kill to finit_module
debug: ../zathura/seccomp-filters.c:61: seccomp_enable_basic_filter(): adding rule kill to get_kernel_syms
debug: ../zathura/seccomp-filters.c:62: seccomp_enable_basic_filter(): adding rule kill to get_mempolicy
debug: ../zathura/seccomp-filters.c:63: seccomp_enable_basic_filter(): adding rule kill to init_module
debug: ../zathura/seccomp-filters.c:64: seccomp_enable_basic_filter(): adding rule kill to io_cancel
debug: ../zathura/seccomp-filters.c:65: seccomp_enable_basic_filter(): adding rule kill to io_destroy
debug: ../zathura/seccomp-filters.c:66: seccomp_enable_basic_filter(): adding rule kill to io_getevents
debug: ../zathura/seccomp-filters.c:67: seccomp_enable_basic_filter(): adding rule kill to io_setup
debug: ../zathura/seccomp-filters.c:68: seccomp_enable_basic_filter(): adding rule kill to io_submit
debug: ../zathura/seccomp-filters.c:69: seccomp_enable_basic_filter(): adding rule kill to ioperm
debug: ../zathura/seccomp-filters.c:70: seccomp_enable_basic_filter(): adding rule kill to iopl
debug: ../zathura/seccomp-filters.c:71: seccomp_enable_basic_filter(): adding rule kill to ioprio_set
debug: ../zathura/seccomp-filters.c:72: seccomp_enable_basic_filter(): adding rule kill to kcmp
debug: ../zathura/seccomp-filters.c:73: seccomp_enable_basic_filter(): adding rule kill to kexec_file_load
debug: ../zathura/seccomp-filters.c:74: seccomp_enable_basic_filter(): adding rule kill to kexec_load
debug: ../zathura/seccomp-filters.c:75: seccomp_enable_basic_filter(): adding rule kill to keyctl
debug: ../zathura/seccomp-filters.c:76: seccomp_enable_basic_filter(): adding rule kill to lookup_dcookie
debug: ../zathura/seccomp-filters.c:77: seccomp_enable_basic_filter(): adding rule kill to mbind
debug: ../zathura/seccomp-filters.c:78: seccomp_enable_basic_filter(): adding rule kill to nfsservctl
debug: ../zathura/seccomp-filters.c:79: seccomp_enable_basic_filter(): adding rule kill to migrate_pages
debug: ../zathura/seccomp-filters.c:80: seccomp_enable_basic_filter(): adding rule kill to modify_ldt
debug: ../zathura/seccomp-filters.c:81: seccomp_enable_basic_filter(): adding rule kill to mount
debug: ../zathura/seccomp-filters.c:82: seccomp_enable_basic_filter(): adding rule kill to move_pages
debug: ../zathura/seccomp-filters.c:83: seccomp_enable_basic_filter(): adding rule kill to name_to_handle_at
debug: ../zathura/seccomp-filters.c:84: seccomp_enable_basic_filter(): adding rule kill to open_by_handle_at
debug: ../zathura/seccomp-filters.c:85: seccomp_enable_basic_filter(): adding rule kill to perf_event_open
debug: ../zathura/seccomp-filters.c:86: seccomp_enable_basic_filter(): adding rule kill to pivot_root
debug: ../zathura/seccomp-filters.c:87: seccomp_enable_basic_filter(): adding rule kill to process_vm_readv
debug: ../zathura/seccomp-filters.c:88: seccomp_enable_basic_filter(): adding rule kill to process_vm_writev
debug: ../zathura/seccomp-filters.c:89: seccomp_enable_basic_filter(): adding rule kill to ptrace
debug: ../zathura/seccomp-filters.c:90: seccomp_enable_basic_filter(): adding rule kill to reboot
debug: ../zathura/seccomp-filters.c:91: seccomp_enable_basic_filter(): adding rule kill to remap_file_pages
debug: ../zathura/seccomp-filters.c:92: seccomp_enable_basic_filter(): adding rule kill to request_key
debug: ../zathura/seccomp-filters.c:93: seccomp_enable_basic_filter(): adding rule kill to set_mempolicy
debug: ../zathura/seccomp-filters.c:94: seccomp_enable_basic_filter(): adding rule kill to swapoff
debug: ../zathura/seccomp-filters.c:95: seccomp_enable_basic_filter(): adding rule kill to swapon
debug: ../zathura/seccomp-filters.c:96: seccomp_enable_basic_filter(): adding rule kill to sysfs
debug: ../zathura/seccomp-filters.c:97: seccomp_enable_basic_filter(): adding rule kill to syslog
debug: ../zathura/seccomp-filters.c:98: seccomp_enable_basic_filter(): adding rule kill to tuxcall
debug: ../zathura/seccomp-filters.c:99: seccomp_enable_basic_filter(): adding rule kill to umount2
debug: ../zathura/seccomp-filters.c:100: seccomp_enable_basic_filter(): adding rule kill to uselib
debug: ../zathura/seccomp-filters.c:101: seccomp_enable_basic_filter(): adding rule kill to vmsplice
debug: ../girara/session.c:929: girara_set_window_icon(): Loading window icon with name: org.pwmt.zathura
debug: ../zathura/zathura.c:370: init_database(): Using plain database backend.
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/dbus-interface.c:104: bus_acquired(): Bus acquired at 'org.pwmt.zathura.PID-7532'.
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/dbus-interface.c:131: name_acquired(): Acquired 'org.pwmt.zathura.PID-7532' on session bus.
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/content-type.c:99: guess_type_magic(): magic detected filetype: application/pdf
debug: ../zathura/file-monitor.c:134: zathura_filemonitor_new(): using glib file monitor
debug: ../zathura/zathura.c:1110: document_open(): starting file monitor
debug: ../zathura/zathura.c:680: setup_renderer(): starting renderer with cache size 15
debug: ../zathura/zathura.c:199: zathura_update_view_ppi(): monitor width: 597 mm, pixels: 3840, ppi: 163.38
debug: ../zathura/render.c:923: render_all(): Queuing resize for page 0 to 1505 x 2128 (595.28 x 841.89).
debug: ../zathura/callbacks.c:235: cb_widget_screen_changed(): called
debug: ../zathura/zathura.c:1228: document_open(): Failed to load bookmarks.
debug: ../zathura/jumplist.c:158: zathura_jumplist_load(): Loaded the jumplist from the database
debug: ../zathura/render.c:971: page_cache_is_cached(): Page 1 is a cache miss
debug: ../zathura/render.c:1070: zathura_renderer_page_cache_add(): Page 1 is cached at cache index 0
Segmentation fault
```

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 334 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-875742565

Comment:
@ericonr To generate synctex files, just use `pdflatex --synctex=1 test.tex`, and then try to open it with `zathura --synctex-forward 1:1:'test.tex' 'test.pdf'`. Do you see the segfault on musl?

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 574 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880842458

Comment:
By setting the sandbox to `none`, I got
```
Thread 1 "zathura" received signal SIGSEGV, Segmentation fault.
0x00007ffff7f76010 in __libc_free () from /lib/ld-musl-x86_64.so.1
(gdb) bt full
#0  0x00007ffff7f76010 in __libc_free () from /lib/ld-musl-x86_64.so.1
No symbol table info available.
#1  0x00007fffee79f820 in ?? ()
No symbol table info available.
#2  0x0000000000000000 in ?? ()
No symbol table info available.
```

Re: zathura and synctex: segfault

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 394 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880878242

Comment:
>  Do you see the segfault on musl?

Yes, not sure why I couldn't generate the file properly.

> By setting the sandbox to none, I got

How did you do this?

I'm trying to look into it with valgrind first. There are lots of invalid frees here.

Re: zathura and synctex: segfault

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 228 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880897169

Comment:
I think valgrind doesn't work well for constructors, which seem to be what's failing.

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 238 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880902553

Comment:
Holy crap!
it works with musl-1.x from the repo :)

the segfault is only with newer musl-1.2 !!

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 240 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880902553

Comment:
Holy crap!
it works with musl-1.1.x from the repo :)

the segfault is only with newer musl-1.2 !!

Re: zathura and synctex: segfault

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 210 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880903252

Comment:
the sandbox was set in .config/zathura/zathurarc as `set sandbox none`

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 243 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880908709

Comment:
Is it possible this is not a bug in zathura, rather it just needs to be rebuilt against change in musl?

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 222 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880909579

Comment:
Shouldn't be, but you can try. This sounds like something that mallocng caught.

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 2952 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880911906

Comment:
Full backtrace:

```
#0  __libc_free (p=0x7ffff4e2cde0) at src/malloc/mallocng/free.c:110
#1  0x00007ffff71ca2b8 in g_list_foreach (list=<optimized out>, list@entry=0x7ffff4f53c20, func=0x7ffff71d47f0 <g_free>, user_data=user_data@entry=0x0) at ../glib/glist.c:1090
#2  0x00007ffff71ca2db in g_list_free_full (list=0x7ffff4f53c20, free_func=<optimized out>) at ../glib/glist.c:244
#3  0x00007ffff7f36fcf in girara_list_clear () from /lib/libgirara-gtk3.so.3
#4  0x00007ffff7f3714e in girara_list_free () from /lib/libgirara-gtk3.so.3
#5  0x0000555555584689 in cut_rectangle (rectangles=0x7ffff4f4dd60, points=0x7ffff4f4d400, rect=<optimized out>) at ../zathura/utils.c:447
#6  flatten_rectangles (rectangles=0x7ffff4f50000) at ../zathura/utils.c:458
#7  synctex_rectangles_from_position (secondary_rects=<synthetic pointer>, page=<synthetic pointer>, column=<optimized out>, line=<optimized out>, input_file=<optimized out>, filename=<optimized out>) at ../zathura/synctex.c:205
#8  synctex_rectangles_from_position (secondary_rects=<synthetic pointer>, page=<synthetic pointer>, column=<optimized out>, line=<optimized out>, input_file=<optimized out>, filename=<optimized out>) at ../zathura/synctex.c:130
#9  synctex_view (zathura=zathura@entry=0x7ffff4fff190, input_file=<optimized out>, line=<optimized out>, column=<optimized out>) at ../zathura/synctex.c:365
#10 0x0000555555584b06 in synctex_view (column=<optimized out>, line=<optimized out>, input_file=<optimized out>, zathura=0x7ffff4fff190) at ../zathura/synctex.c:357
#11 document_open_synctex (path=<optimized out>, uri=<optimized out>, password=<optimized out>, synctex=0x7ffff4d4a5b0 "1:1:handbook.tex", zathura=0x7ffff4fff190) at ../zathura/zathura.c:1304
#12 document_open_synctex (synctex=0x7ffff4d4a5b0 "1:1:handbook.tex", password=<optimized out>, uri=<optimized out>, path=0x7ffff47b8d90 "/home/ericonr/void/void-docs/book/latex/handbook.pdf", zathura=0x7ffff4fff190) at ../zathura/zathura.c:1285
#13 document_info_open (data=0x7ffff4d3c910) at ../zathura/zathura.c:865
#14 0x00007ffff769eeb9 in ?? () from /lib/libgdk-3.so.0
#15 0x00007ffff71ce69f in g_main_dispatch (context=0x7ffff6e30f00) at ../glib/gmain.c:3337
#16 g_main_context_dispatch (context=context@entry=0x7ffff6e30f00) at ../glib/gmain.c:4055
#17 0x00007ffff71cea48 in g_main_context_iterate (context=0x7ffff6e30f00, block=block@entry=0x1, dispatch=dispatch@entry=0x1, self=<optimized out>) at ../glib/gmain.c:4131
#18 0x00007ffff71ced3b in g_main_loop_run (loop=0x7ffff4d4a730) at ../glib/gmain.c:4329
#19 0x00007ffff79bf975 in gtk_main () from /lib/libgtk-3.so.0
#20 0x0000555555561f32 in main (argc=<optimized out>, argv=<optimized out>) at ../zathura/main.c:311
```

And expanded one: https://gist.github.com/dda56c06335a0efd760d876dcc80c361

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 395 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880916714

Comment:
The backtrace needs libc debug info to be more meaningful. It's almost surely a UAF bug or buffer overflow or other memory corruption by the caller, but seeing exactly *where* in `free` it crashed would help tell you which type of bug to look for.

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 347 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880917929

Comment:
Ah, never mind, there's already a line number. OK. So, like 110 is `get_nominal_size`. That means there was a buffer overflow in the object being freed, into the space past the end of the allocation.

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 347 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880917929

Comment:
Ah, never mind, there's already a line number. OK. So, line 110 is `get_nominal_size`. That means there was a buffer overflow in the object being freed, into the space past the end of the allocation.

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 361 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880918847

Comment:
Great! I appreciathe the help.

Should I point this out to zathura devel?

line 110 is get_nominal_size. That means there was a buffer overflow in the object being freed, into the space past the end of the allocation.

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 181 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880919972

Comment:
Yeah, it's almost surely their bug.

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 179 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880920380

Comment:
Many thanks. I linked this issue there.

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 297 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880921052

Comment:
If their tracker isn't on github to auto-linkback, maybe add a link in the other direction here so folks reading here can follow the upstream thread.

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 197 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880922138

Comment:
of course, https://git.pwmt.org/pwmt/zathura/-/issues/237

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 441 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880922193

Comment:
Almost certainly `utils.c`:

```
static void
append_unique_uint(girara_list_t* list, const unsigned int v) {
  double* p = g_try_malloc(sizeof(v));
  if (p == NULL) {
    return;
  }

  *p = v;

  if (girara_list_append_unique(list, cmp_uint, p) == false) {
    g_free(p);
  }
}
```

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 185 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880924927

Comment:
It's that one. Just fix to do `sizeof(*p)`

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 256 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880925552

Comment:
@dkwo I don't want to create an account to post there, so please inform them :p 

Will create a patch for void.

Re: [ISSUE] [CLOSED] zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 382 bytes --]

Closed issue by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722

Description:
For me, on `x86_64-musl`, the command
```
$ zathura --synctex-forward 1:1:'test.tex' 'test.pdf'
Segmentation fault
```
Do you see the same issue @ericonr @lemmi ?
I discovered it using `vimtex`, but it seems an issue in `zathura` + `libsynctex`.
Thanks.

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 310 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880941699

Comment:
Patch had wrong logic, it would seem `double *p` should be changed to `unsigned int *p` instead? Will wait for upstream to answer. For now, it werks and doesn't crash.

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 293 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880946431

Comment:
https://git.pwmt.org/pwmt/zathura/-/commit/ab37394d087be634a63985171b760703d293cb84 offending commit, see line 404. Thanks quinq from `#musl-distros`.

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 248 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880979106

Comment:
https://git.pwmt.org/pwmt/zathura/-/commit/2713de2f6c810f5f0be3c179944867b5b07ddaed it seems upstream agrees

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 176 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880995074

Comment:
@dkwo would you mind backporting?

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 169 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-880997494

Comment:
Sure, I'll do that tomorrow.

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 329 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-881003654

Comment:
I read the upstream patch, and it's still using an explicit `sizeof(TYPE)`. Using `malloc(sizeof *p)` would be a lot safer and would have avoided introducing this bug to begin with.

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 240 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-881009216

Comment:
@richfelker Do you mean line 404 could be like this?

`unsigned int* p = g_try_malloc(sizeof *p);`

Re: zathura and synctex: segfault with musl 1.2

[richfelker]

[-- Attachment #1: Type: text/plain, Size: 217 bytes --]

New comment by richfelker on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-881015561

Comment:
Yes, that's the safe idiom I prefer for using `sizeof` with `malloc`.

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 436 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-881873405

Comment:
Btw, when I was experimenting with this issue, I installed `musl-bootstrap` from repo, and then removed it via `xbps-remove -R`.
This completely broke my system (I think it broke `musl`, as /bin/sh was not there) and I had to chroot from the installer to fix it:
is this the expected behaviour?

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 509 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-881951799

Comment:
@dkwo I recommend doing `xbps-install -f musl` instead to experiment, that would have installed older musl from repos. `musl-bootstrap` should only be built for Void glibc.

>  (I think it broke musl, as /bin/sh was not there)

It would have removed `/usr/lib/ld-musl-x86_64.so.1`, which would generate `ENOENT` when trying to launch dynamically linked binaries.

Re: zathura and synctex: segfault with musl 1.2

[ericonr]

[-- Attachment #1: Type: text/plain, Size: 234 bytes --]

New comment by ericonr on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-881953595

Comment:
https://github.com/void-linux/void-packages/commit/e1c153d8416da00ff960e635f54a1742fa33fdb3

Re: zathura and synctex: segfault with musl 1.2

[dkwo]

[-- Attachment #1: Type: text/plain, Size: 314 bytes --]

New comment by dkwo on void-packages repository

https://github.com/void-linux/void-packages/issues/31722#issuecomment-882034243

Comment:
@ericonr Indeed, that's what happened :)
Installing old musl is fine, but for some perverse reason I also tried with -bootsrtap.
All clear now, your commit will avoid this.