Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 955120 - app-shells/bash ebuild manifest creation generate a bash segfault on malformed ebuild
Summary: app-shells/bash ebuild manifest creation generate a bash segfault on malforme...
Status: UNCONFIRMED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo's Team for Core System packages
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2025-04-30 14:28 UTC by Zentoo
Modified: 2025-05-02 13:09 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
emerge --info (emerge-info.txt,10.34 KB, text/plain)
2025-04-30 17:17 UTC, Zentoo
Details
bactrace generated from coredump (backtrace_coredump.txt,12.18 KB, text/plain)
2025-04-30 18:03 UTC, Zentoo
Details
Minimal ebuild to trigger the segfault (segfault-0.1.ebuild,170 bytes, text/plain)
2025-04-30 18:04 UTC, Zentoo
Details
coredump (coredump.bz2,211.67 KB, application/x-bzip2)
2025-04-30 18:22 UTC, Zentoo
Details
full ebuild with syntax error (yubikey-manager-5.6.1-r1.ebuild,1.60 KB, text/plain)
2025-04-30 18:22 UTC, Zentoo
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Zentoo 2025-04-30 14:28:04 UTC
I accidentally made a syntax error by adding a dep condition in an ebuild that caused a bash segfault at manifest creation time using "ebuild $EBUILD_FILE manifest".

The syntax error that caused the bash segfault is reproducible.
Note the extra double quote at end of line of first dep condition:

DEPEND="
    >dev-python/dummy-dep-1.0[${PYTHON_USEDEP}]"
    <dev-python/dummy-dep-2.0[${PYTHON_USEDEP}]"

BDEPEND="
    dev-python/dummy-bdep1
    dev-python/dummy-bdep2"

My tries to isolate the problem show that it happens if you have the following minimal syntax in the ebuild:

<dev-python/dummy-dep-2.0[${PYTHON_USEDEP}]"
BDEPEND="
"

I don't know if this could have any security implications, but I suppose this syntax error needs to be caught before the segfault can happen.

Reproducible: Always
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2025-04-30 14:29:06 UTC
That's really a bash bug. Was that really the full ebuild (not just a snippet)? Can you give a backtrace?
Comment 2 Mike Gilbert gentoo-dev 2025-04-30 15:59:22 UTC
Also provide emerge --info.
Comment 3 Zentoo 2025-04-30 17:17:43 UTC
Created attachment 927180 [details]
emerge --info
Comment 4 Zentoo 2025-04-30 17:21:10 UTC
Using gdb, we can't have a backtrace of the subshell bash launched by python.
I need to reconfigure my kernel in order to generate a coredump that is actually deactivated.
I will post the backtrace resulting from the coredump.
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2025-04-30 17:25:40 UTC
(In reply to Zentoo from comment #4)
> Using gdb, we can't have a backtrace of the subshell bash launched by python.
> I need to reconfigure my kernel in order to generate a coredump that is
> actually deactivated.
> I will post the backtrace resulting from the coredump.

No, you can. see set-follow-fork mode and set-follow-exec mode.
Comment 6 Zentoo 2025-04-30 18:03:17 UTC
Created attachment 927209 [details]
bactrace generated from coredump
Comment 7 Zentoo 2025-04-30 18:04:20 UTC
Created attachment 927210 [details]
Minimal ebuild to trigger the segfault
Comment 8 Zentoo 2025-04-30 18:22:04 UTC
Created attachment 927213 [details]
coredump
Comment 9 Zentoo 2025-04-30 18:22:28 UTC
Created attachment 927214 [details]
full ebuild with syntax error
Comment 10 Zentoo 2025-04-30 18:31:50 UTC
the coredump have been generated after have emerged bash with:
CXXFLAGS="-O2 -pipe -march=native -ggdb" CFLAGS="-O2 -pipe -march=native -ggdb" FEATURES="nostrip keepwork" emerge -av1 bash