Possible memory corruption in xz / liblzma in Fedora 40 & 41

[Richard W.M. Jones]

We updated xz to new version 5.6.0 last week.  It was supposed to be a
safe change so we backported it to F40 at the request of the xz
author.  But there's been a report of possible memory corruption:

https://bugzilla.redhat.com/show_bug.cgi?id=2267598

I've not been able to reproduce this myself, still trying.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-builder quickly builds VMs from scratch
http://libguestfs.org/virt-builder.1.html

[Richard W.M. Jones]

On Mon, Mar 04, 2024 at 01:46:13PM +0000, Richard W.M. Jones wrote:
>  We updated xz to new version 5.6.0 last week.  It was supposed to be
> a
>  safe change so we backported it to F40 at the request of the xz
>  author.  But there's been a report of possible memory corruption:
>  
>  https://bugzilla.redhat.com/show_bug.cgi?id=2267598
>  
>  I've not been able to reproduce this myself, still trying. 
We're still not quite sure what is going on here, however I was able
to work around it in xz (as a temporary fix).

https://bugzilla.redhat.com/show_bug.cgi?id=2267598#c5

The versions which have the bug were:

xz-5.6.0-1.fc40
xz-5.6.0-1.fc41
xz-5.6.0-2.fc40
xz-5.6.0-2.fc41

The versions which contain the workaround are:

xz-5.6.0-3.fc40
xz-5.6.0-3.fc41

If anyone hits the bug with the -1/-2 package and is able to get a
more accurate and complete stack trace, please add it to the bug,
because that's what we're really missing at the moment.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top

[Richard W.M. Jones]

An update ...

This is fixed in xz 5.6.1.  I tested the fix and it works for me.
https://github.com/tukaani-project/xz/commit/82ecc53819

Rather than mess with Fedora 40 again, I did a build in Rawhide only:
https://bodhi.fedoraproject.org/updates/FEDORA-2024-7e9c14633a

I guess if this goes well we can try it in Fedora 40 later.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
Fedora Windows cross-compiler. Compile Windows programs, test, and
build Windows installers. Over 100 libraries supported.
http://fedoraproject.org/wiki/MinGW