Skip to content

Fix segfault on accessing items in the DBus vault. Discard all items that are nullptr.#7850

Closed
bionade24 wants to merge 1 commit intokeepassxreboot:developfrom
bionade24:fix-segfault-on-dbus-item-access
Closed

Fix segfault on accessing items in the DBus vault. Discard all items that are nullptr.#7850
bionade24 wants to merge 1 commit intokeepassxreboot:developfrom
bionade24:fix-segfault-on-dbus-item-access

Conversation

@bionade24
Copy link
Copy Markdown

@bionade24 bionade24 commented Apr 10, 2022

Discards all items from the loop which are nullptr. I doubt this isn't really fixing the root issue, but afterall it works. Root of issue probably in a31c5ba
Fixes: #7731

Testing strategy

Tests run manually and tested manually.

Type of change

  • ✅ Bug fix (non-breaking change that fixes an issue)

@michaelk83

@droidmonkey
Copy link
Copy Markdown
Member

Need to trace this further back to see why an item would be nullptr. Also need to fix a couple things here. bool locked; and if (item)

@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 10, 2022

Codecov Report

Merging #7850 (4b6093e) into develop (5916a8f) will decrease coverage by 0.01%.
The diff coverage is 75.00%.

@@             Coverage Diff             @@
##           develop    #7850      +/-   ##
===========================================
- Coverage    64.31%   64.29%   -0.01%     
===========================================
  Files          339      339              
  Lines        43404    43431      +27     
===========================================
+ Hits         27911    27922      +11     
- Misses       15493    15509      +16     
Impacted Files Coverage Δ
src/fdosecrets/objects/Service.cpp 82.80% <75.00%> (+0.05%) ⬆️
...rc/fdosecrets/widgets/SettingsWidgetFdoSecrets.cpp 56.06% <0.00%> (-3.03%) ⬇️
src/fdosecrets/dbus/DBusMgr.cpp 52.20% <0.00%> (-1.47%) ⬇️
src/core/Tools.cpp 71.93% <0.00%> (-1.02%) ⬇️
src/gui/DatabaseWidget.cpp 61.79% <0.00%> (-0.26%) ⬇️
src/gui/MainWindow.cpp 72.68% <0.00%> (-0.15%) ⬇️
src/gui/styles/base/BaseStyle.cpp 57.90% <0.00%> (-0.03%) ⬇️
src/core/Entry.cpp 82.86% <0.00%> (+0.20%) ⬆️
src/gui/KMessageWidget.cpp 75.68% <0.00%> (+3.38%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5916a8f...4b6093e. Read the comment docs.

@michaelk83
Copy link
Copy Markdown

Need to trace this further back to see why an item would be nullptr. Also need to fix a couple things here. bool locked; and if (item)

Agreed. @Aetf

@bionade24 , I would remove the "Fixes: #7731", I'm not convinced this is the same crash as the OP in #7731. Actually, the OP sounds more like what was fixed in 2.7.1.

@bionade24
Copy link
Copy Markdown
Author

Need to trace this further back to see why an item would be nullptr. Also need to fix a couple things here. bool locked; and if (item)

Agreed. @Aetf

@bionade24 , I would remove the "Fixes: #7731", I'm not convinced this is the same crash as the OP in #7731. Actually, the OP sounds more like what was fixed in 2.7.1.

Fine, as he didn't provide a backtrace we can't know for sure.

@droidmonkey
Copy link
Copy Markdown
Member

Agreed the referenced issue definitely sounds like the problem fixed by 2.7.1. Going to close that one as duplicate.

@bionade24 bionade24 force-pushed the fix-segfault-on-dbus-item-access branch from 4b6093e to 6b143c8 Compare April 10, 2022 17:57
@Aetf
Copy link
Copy Markdown
Contributor

Aetf commented Apr 10, 2022

Any info about how to reproduce this? (best with a dbus-monitor trace dbus-monitor "destination=org.freedesktop.secrets" "sender=org.freedesktop.secrets")
The original repro in #7731 is for the already fixed crash.

items pointer may be nullptr if Collection::searchItems returns nullptr. And all pointers produced by
Collection::searchItems are obtained by m_entryToItem.value(entry). So if for some reason the map doesn't contain
the entry, a default nullptr will be returned.

So if after an entry is added, and before Collection::onEntryAdded gets called, a searchItems call comes in, it may
trigger this.

The correct fix should be to make sure Collection::searchItems doesn't return nullptr.

@droidmonkey
Copy link
Copy Markdown
Member

Agree searchItems should never add nullptr to the array, that is begging for crashes.

@Aetf
Copy link
Copy Markdown
Contributor

Aetf commented Apr 10, 2022

However it is still unclear to me why this happens in the first place. I can't come up with a case where an entry is added but onEntryAdded is not called before anything else. That's why there is no checks in searchItems, because I supposed the invariant is always maintained.

@Aetf
Copy link
Copy Markdown
Contributor

Aetf commented May 5, 2022

The root cause is found to be entries in the recycle bin returned during search, and they don't have corresponding items, thus nullptr.

I'll prepare a new PR to fix that, and close this one.

@Aetf Aetf closed this May 5, 2022
@bionade24
Copy link
Copy Markdown
Author

@Aetf have you opened a PR/Issue for it yet?

@Aetf
Copy link
Copy Markdown
Contributor

Aetf commented May 7, 2022

#8021

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Segmentation fault when dbus.secrets service is used from docker

5 participants