Segfault in comps_elem_display_order_postproc() when group definition contains an empty `display_order` or `uservisible` field

[pkratoch]

Reproducer:

<group>
    <id>test-group</id>
    <name>Test group</name>
    <display_order></display_order>
    <uservisible></uservisible>
    <packagelist>
    </packagelist>
</group>

It's probably not reasonable to want to allow empty uservisible, since a boolean value is expected, but an empty default field doesn't have this problem and in any case, segfaulting is not a nice way to handle it.

[ppisar]

I placed the document to comps element, but I cannot get the crash with "dnf5 --repo=test group list". Do you have more details?

[pkratoch]

I placed the document to comps element, but I cannot get the crash with "dnf5 --repo=test group list". Do you have more details?

The issue is only for dnf, not dnf5.

[ppisar]

I see. It crashes in a libcomps expat callback:

Program received signal SIGSEGV, Segmentation fault.
__strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
[...]
(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
rpm-software-management/dnf#1  0x00007ffff767b645 in _IO_str_init_static_internal
    (sf=sf@entry=0x7fffffffce20, ptr=ptr@entry=0x0, size=size@entry=0, pstart=pstart@entry=0x0)
    at strops.c:41
rpm-software-management/dnf#2  0x00007ffff7644829 in _IO_strfile_read (sf=0x7fffffffce20, string=0x0) at ../libio/strfile.h:90
rpm-software-management/dnf#3  __GI___isoc99_sscanf (s=0x0, format=format@entry=0x7ffff43dc518 "%d") at isoc99_sscanf.c:28
rpm-software-management/dnf#4  0x00007ffff43cbd87 in comps_elem_display_order_postproc
    (parsed=0x555555e0cd50, elem=0x555556101bb0)
    at /usr/src/debug/libcomps-0.1.21-20250402010915.3.gc37f570.fc43.x86_64/libcomps/src/comps_elem.c:863
rpm-software-management/dnf#5  0x00007ffff43cf46b in comps_parse_end_elem_handler
    (userData=0x555555e0cd50, s=0x555556101af0 "display_order")
    at /usr/src/debug/libcomps-0.1.21-20250402010915.3.gc37f570.fc43.x86_64/libcomps/src/comps_parse.c:309
rpm-software-management/dnf#6  0x00007ffff43967ed in doContent
    (parser=parser@entry=0x555555e6cd60, startTagLevel=0, enc=<optimized out>, s=s@entry=0x555555df6e90 "<comps>\n\t<group>\n\t    <id>test-group</id>\n\t    <name>Test group</name>\n\t    <display_order></display_order>\n\t    <uservisible></uservisible>\n\t    <packagelist>\n\t    </packagelist>\n\t</group>\n</comps>\n", end=end@entry=0x555555df6f57 "", nextPtr=nextPtr@entry=0x555555e6cd90, haveMore=1 '\001', account=XML_ACCOUNT_DIRECT) at /usr/src/debug/expat-2.7.1-1.fc43.x86_64/lib/xmlparse.c:3255
rpm-software-management/dnf#7  0x00007ffff4397755 in contentProcessor
    (parser=parser@entry=0x555555e6cd60, start=start@entry=0x555555df6e90 "<comps>\n\t<group>\n\t    <id>test-group</id>\n\t    <name>Test group</name>\n\t    <display_order></display_order>\n\t    <uservisible></uservisible>\n\t    <packagelist>\n\t    </packagelist>\n\t</group>\n</comps>\n", end=end@entry=0x555555df6f57 "", endPtr=endPtr@entry=0x555555e6cd90)
    at /usr/src/debug/expat-2.7.1-1.fc43.x86_64/lib/xmlparse.c:2812
rpm-software-management/dnf#8  0x00007ffff4397941 in doProlog
    (parser=parser@entry=0x555555e6cd60, enc=<optimized out>, s=s@entry=0x555555df6e90 "<comps>\n\t<group>\n\t    <id>test-group</id>\n\t    <name>Test group</name>\n\t    <display_order></display_order>\n\t    <uservisible></uservisible>\n\t    <packagelist>\n\t    </packagelist>\n\t</group>\n</comps>\n", end=end@entry=0x555555df6f57 "", tok=<optimized out>, next=<optimized out>, nextPtr=0x555555e6cd90, haveMore=1 '\001', allowClosingDoctype=1 '\001', account=XML_ACCOUNT_DIRECT)
    at /usr/src/debug/expat-2.7.1-1.fc43.x86_64/lib/xmlparse.c:5120
rpm-software-management/dnf#9  0x00007ffff439a0ef in prologProcessor
    (parser=0x555555e6cd60, s=0x555555df6e90 "<comps>\n\t<group>\n\t    <id>test-group</id>\n\t    <name>Test group</name>\n\t    <display_order></display_order>\n\t    <uservisible></uservisible>\n\t    <packagelist>\n\t    </packagelist>\n\t</group>\n</comps>\n", end=0x555555df6f57 "", nextPtr=0x555555e6cd90) at /usr/src/debug/expat-2.7.1-1.fc43.x86_64/lib/xmlparse.c:4823
rpm-software-management/dnf#10 0x00007ffff438fabf in callProcessor
    (parser=parser@entry=0x555555e6cd60, start=0x555555df6e90 "<comps>\n\t<group>\n\t    <id>test-group</id>\n\t    <name>Test group</name>\n\t    <display_order></display_order>\n\t    <uservisible></uservisible>\n\t    <packagelist>\n\t    </packagelist>\n\t</group>\n</comps>\n", end=0x555555df6f57 "", endPtr=endPtr@entry=0x555555e6cd90) at /usr/src/debug/expat-2.7.1-1.fc43.x86_64/lib/xmlparse.c:1057
rpm-software-management/dnf#11 0x00007ffff439cf14 in XML_ParseBuffer
    (parser=<optimized out>, len=len@entry=199, isFinal=isFinal@entry=0)
    at /usr/src/debug/expat-2.7.1-1.fc43.x86_64/lib/xmlparse.c:2180
rpm-software-management/dnf#12 0x00007ffff43cf5c7 in comps_parse_file
    (parsed=parsed@entry=0x555555e0cd50, f=0x555555dc37b0, options=<optimized out>)
    at /usr/src/debug/libcomps-0.1.21-20250402010915.3.gc37f570.fc43.x86_64/libcomps/src/comps_parse.c:229
rpm-software-management/dnf#13 0x00007ffff43f5752 in PyCOMPS_fromxml_f
    (self=0x7ffff3b67960, args=<optimized out>, kwds=<optimized out>)
    at /usr/src/debug/libcomps-0.1.21-20250402010915.3.gc37f570.fc43.x86_64/libcomps/src/python/src/pycomps.c:244
rpm-software-management/dnf#14 0x00007ffff797f94d in method_vectorcall_VARARGS_KEYWORDS () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#15 0x00007ffff794110d in PyObject_Vectorcall () at /lib64/libpython3.13.so.1.0
--Type <RET> for more, q to quit, c to continue without paging--
rpm-software-management/dnf#16 0x00007ffff795420b in _PyEval_EvalFrameDefault () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#17 0x00007ffff7988b04 in PyObject_CallOneArg () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#18 0x00007ffff797670d in _PyObject_GenericGetAttrWithDict () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#19 0x00007ffff794125b in PyObject_GetAttr () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#20 0x00007ffff795474e in _PyEval_EvalFrameDefault () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#21 0x00007ffff7a2a42f in PyEval_EvalCode () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#22 0x00007ffff7a4d809 in run_eval_code_obj () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#23 0x00007ffff7a47893 in run_mod () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#24 0x00007ffff7a69476 in pyrun_file () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#25 0x00007ffff7a68b5f in _PyRun_SimpleFileObject () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#26 0x00007ffff7a68983 in _PyRun_AnyFileObject () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#27 0x00007ffff7a60f39 in Py_RunMain () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#28 0x00007ffff7a196ab in Py_BytesMain () at /lib64/libpython3.13.so.1.0
rpm-software-management/dnf#29 0x00007ffff7612575 in __libc_start_call_main
    (main=main@entry=0x5555555544a0 <main>, argc=argc@entry=5, argv=argv@entry=0x7fffffffddd8)
    at ../sysdeps/nptl/libc_start_call_main.h:58
rpm-software-management/dnf#30 0x00007ffff7612628 in __libc_start_main_impl
    (main=0x5555555544a0 <main>, argc=5, argv=0x7fffffffddd8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffddc8) at ../csu/libc-start.c:360
rpm-software-management/dnf#31 0x00005555555543d5 in _start ()

Here in comps_elem_display_order_postproc():

    if (prop)
→       sscanf(parsed->tmp_buffer, "%d", &((COMPS_Num*)prop)->val);
    parsed->tmp_buffer = NULL;

The "parsed->tmp_buffer" is NULL:

p *parsed
$5 = {elem_stack = 0x555555dfa4b0, comps_doc = 0x555555dccbf0, text_buffer = 0x555555e28e10, text_buffer_len = 0, text_buffer_pt = 0x0, tmp_buffer = 0x0, log = 0x555555e03530, fatal_error = 0 '\000', 
  parser = 0x555555e6cd60, enc = 0x7ffff440929d "UTF-8", def_options = 0x7ffff43e5098 <COMPS_DDefaultsOptions>, doctype_name = 0x0, doctype_sysid = 0x0, doctype_pubid = 0x0}

I'm for moving this issue to libcomps.

[ppisar]

Reproducer with DNF4 is "/usr/bin/python3 /usr/bin/dnf4 --repo test group" where "test" repository contains a group subtree as in the original comment.