GNOME Bugzilla – Bug 310214
Deleting 2 lsigned keys at same time segfaults seahorse
Last modified: 2005-07-18 13:37:51 UTC
Version details: From 0.7.8-1mdk rpm Distribution/Version: Mandriva Cooker 2006.0 I have been able to reproduce this twice: keys that were previously lsigned and now either expired or revoked, when next to each other (above and below) in the Seahorse gui, selecting both, rightclicking and pressing "Delete" gave a segfault: quote ** (seahorse:13019): CRITICAL **: file seahorse-key-op.c: line 360 (sign_transit): should not be reached ** (seahorse:13019): CRITICAL **: edit_key: assertion `GPG_IS_OK (err)' failed ** (seahorse:13019): CRITICAL **: file seahorse-key-op.c: line 360 (sign_transit): should not be reached ** (seahorse:13019): CRITICAL **: edit_key: assertion `GPG_IS_OK (err)' failed [1]+ Segmentation fault seahorse unquote
Jim and I confirmed a similar bug last night where deleting any single public key crashed seahorse. Looking at the stack trace I would suppose the single key bug is due to a bad pointer access.
Flav found that the crash seems to go away on a 1 key delete by putting a conditional if skrow != NULL just before seahorse_key_row_remove_all (skrow) the single key delete won't crash. seahorse_key_store_key_added (SeahorseKeySource ... ... if (skrow != NULL) seahorse_key_row_remove_all (skrow) I'm wondering if the option to delete multiple keys at once should just be disabled all together. In practice, I would think that bulk deleting of keys is a pretty rare case. Just a thought.
Created attachment 49313 [details] [review] Extra pointer validation patch Patches: libseahorse/seahorse-key-store.c libseahorse/seahorse-multi-source.c
Oops, put the patch above the post. Looks like there were some null pointers being passed around. I also noticed a seg fault when using the druid to create a new key, right at the end. I added some extra checks for null pointers in a few functions and both issues appear to be working correctly now. **Note: anonycvs.gnome.org has version seahorse-key-store.c 1.17 which is missing the 'if (skrow)' and therefore is in this patch as well...
Committed to both HEAD and seahorse-0-8
Wonderful. Good work.