Breakage with glib-2.76.0 (exposes bugs in buggy packages)

Breakage with glib-2.76.0 (exposes bugs in buggy packages)

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 1098 bytes --]

Hi folks,

glib-2.76 switches from using its own 'slice' allocator to using
the system malloc instead.

This ends up exposing various memory safety bugs in consumers
of glib, including some XFCE software.

So far:
- openbox (https://bugzilla.icculus.org/show_bug.cgi?id=6669)
- xfce4-session (https://gitlab.xfce.org/xfce/xfce4-session/-/issues/166) 
- xfce4-screensaver (https://gitlab.xfce.org/apps/xfce4-screensaver/-/issues/119)
- thunar (https://gitlab.xfce.org/xfce/thunar/-/issues/1063)
- gegl (https://gitlab.gnome.org/GNOME/gegl/-/issues/320)
- girara (https://git.pwmt.org/pwmt/girara/-/issues/17)
- tint2 (not yet reported upstream, https://bugs.gentoo.org/901775)

See also:
-
https://bugs.gentoo.org/showdependencytree.cgi?id=901805&hide_resolved=0
- https://gitlab.gnome.org/GNOME/glib/-/issues/2937
- https://gitlab.gnome.org/GNOME/glib/-/issues/2941

You can try see these issues with older glib by using Valgrind (which
makes glib on older versions disable the slice allocator) or ASAN.

I anticipate there'll be quite a few more of these.

best,
sam

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]

Re: Breakage with glib-2.76.0 (exposes bugs in buggy packages)

[Sam James]

[-- Attachment #1: Type: text/plain, Size: 1415 bytes --]


Sam James <sam@gentoo.org> writes:

> [[PGP Signed Part:Undecided]]
> Hi folks,
>
> glib-2.76 switches from using its own 'slice' allocator to using
> the system malloc instead.
>
> This ends up exposing various memory safety bugs in consumers
> of glib, including some XFCE software.
>
> So far:
> - openbox (https://bugzilla.icculus.org/show_bug.cgi?id=6669)
> - xfce4-session (https://gitlab.xfce.org/xfce/xfce4-session/-/issues/166) 
> - xfce4-screensaver (https://gitlab.xfce.org/apps/xfce4-screensaver/-/issues/119)
> - thunar (https://gitlab.xfce.org/xfce/thunar/-/issues/1063)
> - gegl (https://gitlab.gnome.org/GNOME/gegl/-/issues/320)
> - girara (https://git.pwmt.org/pwmt/girara/-/issues/17)
> - tint2 (not yet reported upstream, https://bugs.gentoo.org/901775)
>
> See also:
> -
> https://bugs.gentoo.org/showdependencytree.cgi?id=901805&hide_resolved=0
> - https://gitlab.gnome.org/GNOME/glib/-/issues/2937
> - https://gitlab.gnome.org/GNOME/glib/-/issues/2941
>
> You can try see these issues with older glib by using Valgrind (which
> makes glib on older versions disable the slice allocator) or ASAN.

To be explicit, you can do this with <glib-2.76:
```
$ export G_SLICE=always-malloc
$ some-application
```

Or just valgrind in the usual way, etc.

> I anticipate there'll be quite a few more of these.
>
> best,
> sam
>
> [[End of PGP Signed Part]]


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 377 bytes --]