Termux-packages: Aria2c segfaults

[Neo-Oli]

Problem description
After the recent update aria2c, wget crashes with SIGILL.

Steps to reproduce

$ aria2c ""
Invalid address 0xbebe011c passed to free: value not allocated

$ wget "https://termux.com"
--2019-03-03 23:23:45--  https://termux.com/
Disabling SSL due to encountered errors.



md5-870492827fa1578968164028e57b21fc



~ 130 > gdb wget
GNU gdb (GDB) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "arm-linux-androideabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from wget...(no debugging symbols found)...done.
(gdb) run https://termux.com
Starting program: /data/data/com.termux/files/usr/bin/wget https://termux.com

Program received signal SIGILL, Illegal instruction.
0xb6b2d3c0 in ?? () from /data/data/com.termux/files/usr/lib/libcrypto.so.1.1



md5-049e8c69be266c8eac1c4c3796960441



$ termux-info
Updatable packages:
All packages up to date
System information:
Linux localhost 3.4.0-perf-g284400aea4b #1 SMP PREEMPT Mon Feb 25 13:31:32 UTC 2019 armv7l Android
Termux-packages arch:
arm
Android version:
8.1.0
Device manufacturer:
Fairphone
Device model:
FP2



md5-e79adcdcdf4a0927ba4e79170b14365b



03-03 23:30:09.225 13520 13520 F libc    : Invalid address 0xbee0110c passed to free: invalid page index
03-03 23:30:09.226 13520 13520 F libc    : Fatal signal 6 (SIGABRT), code -6 in tid 13520 (aria2c), pid 13520 (aria2c)
03-03 23:30:09.228 13522 13522 W crash_dump32: type=1400 audit(0.0:68448): avc: denied { read write } for name="1" dev="devpts" ino=4 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:untrusted_app_devpts:s0:c512,c768 tclass=chr_file permissive=0
03-03 23:30:09.248 13523 13523 W crash_dump32: type=1400 audit(0.0:68449): avc: denied { search } for name="com.termux" dev="mmcblk0p20" ino=246018 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
03-03 23:30:09.264 13523 13523 I crash_dump32: obtaining output fd from tombstoned, type: kDebuggerdTombstone
03-03 23:30:09.270 13523 13523 I crash_dump32: performing dump of process 13520 (target tid = 13520)
03-03 23:30:09.270 13520 13520 F libc    : failed to resend signal during crash: Operation not permitted
03-03 23:30:09.271 13523 13523 E DEBUG   : unexpected waitpid response: n=13520, status=00000100
03-03 23:30:09.248 13523 13523 W crash_dump32: type=1400 audit(0.0:68450): avc: denied { search } for name="com.termux" dev="mmcblk0p20" ino=246018 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
03-03 23:30:09.258 13523 13523 I chatty  : uid=10084(com.termux.api) crash_dump32 identical 5 lines
03-03 23:30:09.258 13523 13523 W crash_dump32: type=1400 audit(0.0:68456): avc: denied { search } for name="com.termux" dev="mmcblk0p20" ino=246018 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
03-03 23:30:09.258 13523 13523 W crash_dump32: type=1400 audit(0.0:68457): avc: denied { search } for name="home" dev="mmcblk0p20" ino=253906 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
03-03 23:30:09.258 13523 13523 W crash_dump32: type=1400 audit(0.0:68458): avc: denied { search } for name="com.termux" dev="mmcblk0p20" ino=246018 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
03-03 23:30:09.258 13523 13523 W crash_dump32: type=1400 audit(0.0:68459): avc: denied { search } for name="home" dev="mmcblk0p20" ino=253906 scontext=u:r:crash_dump:s0:c512,c768 tcontext=u:object_r:app_data_file:s0:c512,c768 tclass=dir permissive=0
03-03 23:30:09.268 13101 13101 W zsh     : type=1400 audit(0.0:68460): avc: denied { signull } for scontext=u:r:untrusted_app:s0:c512,c768 tcontext=u:r:crash_dump:s0:c512,c768 tclass=process permissive=0

[xeffyr]

$ wget "https://termux.com"
--2019-03-03 23:23:45-- https://termux.com/
Disabling SSL due to encountered errors.

Have you tried to install openssl-tool ?
Seems like duplicate of https://github.com/termux/termux-packages/issues/3426.

[xeffyr]

Program received signal SIGILL, Illegal instruction.
0xb6b2d3c0 in ?? () from /data/data/com.termux/files/usr/lib/libcrypto.so.1.1

Illegal instruction in gdb is normal.
https://stackoverflow.com/questions/25708907/ssl-library-init-cause-sigill-when-running-under-gdb

[Neo-Oli]

@xeffyr I did ineed miss #3426, but installing openssl-tool only partially solves the problem. aria2c still has the same problem

~ 1 > gdb aria2c
GNU gdb (GDB) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "arm-linux-androideabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from aria2c...(no debugging symbols found)...done.
(gdb) run https://glow.li
Starting program: /data/data/com.termux/files/usr/bin/aria2c https://glow.li

Program received signal SIGILL, Illegal instruction.
0xb6bc73c0 in ?? () from /data/data/com.termux/files/usr/lib/libcrypto.so.1.1
(gdb)

[xeffyr]

Regarding SIGILL in gdb: https://stackoverflow.com/questions/25708907/ssl-library-init-cause-sigill-when-running-under-gdb

handle SIGILL nostop

[Neo-Oli]

@xeffyr I see. With handle SIGILL nostop I get a diffenrent error entirely.

~ 130 > gdb aria2c
GNU gdb (GDB) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "arm-linux-androideabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from aria2c...(no debugging symbols found)...done.
(gdb) handle SIGILL nostop
Signal        Stop      Print   Pass to program Description
SIGILL        No        Yes     Yes             Illegal instruction
(gdb) run "https://glow.li"
Starting program: /data/data/com.termux/files/usr/bin/aria2c "https://glow.li"

Program received signal SIGILL, Illegal instruction.

Program received signal SIGILL, Illegal instruction.

Program received signal SIGILL, Illegal instruction.

Program received signal SIGILL, Illegal instruction.

Program received signal SIGILL, Illegal instruction.

03/04 00:00:13 [NOTICE] Downloading 1 item(s)

Program received signal SIGSEGV, Segmentation fault.
0xb6b14e90 in __gnu_Unwind_Resume () from /system/lib/libz.so

[Neo-Oli]

$ aria2c ""
Invalid address 0xbe9c80fc passed to free: value not allocated

Normally it would trigger and internal error

debian $  aria2c ""
Exception caught
Exception: [download_helper.cc:451] errorCode=1 Unrecognized URI or unsupported protocol:

[xeffyr]

Interesting, for me it looks like okay:

[~]:$ aria2c ""
Exception caught
Exception: [/home/builder/.termux-build/aria2/src/src/download_helper.cc:451] errorCode=1 Unrecognized URI or unsupported protocol:

[xeffyr]

When called on URL:

[~]:$ aria2c https://glow.li

03/04 01:10:57 [NOTICE] Downloading 1 item(s)

03/04 01:10:57 [ERROR] CUID#7 - Download aborted. URI=https://glow.li
Exception: [/home/builder/.termux-build/aria2/src/src/AbstractCommand.cc:351] errorCode=1 URI=https://glow.li
  -> [/home/builder/.termux-build/aria2/src/src/SocketCore.cc:1015] errorCode=1 SSL/TLS handshake failure: protocol error

03/04 01:10:57 [NOTICE] Download GID#19b855b53c846139 not complete: 

Download Results:
gid   |stat|avg speed  |path/URI
======+====+===========+=======================================================
19b855|ERR |       0B/s|https://glow.li

Status Legend:
(ERR):error occurred.

aria2 will resume download if the transfer is restarted.
If there are any errors, then see the log file. See '-l' option in help/man page for details.

Another one:

[~]:$ aria2c https://google.com

03/04 01:11:58 [NOTICE] Downloading 1 item(s)
[#c37894 0B/0B CN:1 DL:0B]                                                     
03/04 01:11:59 [NOTICE] CUID#7 - Redirecting to https://www.google.com/
[#c37894 12KiB/0B CN:1 DL:13KiB]                                               
03/04 01:12:01 [NOTICE] Download complete: /data/data/com.termux/files/home/index.html

Download Results:
gid   |stat|avg speed  |path/URI
======+====+===========+=======================================================
c37894|OK  |   5.8KiB/s|/data/data/com.termux/files/home/index.html

Status Legend:
(OK):download completed.

[Neo-Oli]

@xeffyr Maybe it's an arm thing? Don't you have aarch64?

[xeffyr]

Yes, thats on AArch64. I will try on ARM.

[Neo-Oli]

It does work for a lot of websites, I've only found a few that it doesn't work for (including all of mine, I wonder what I configured differently on those).

$ aria2c "https://debian.org/"

03/04 00:24:30 [NOTICE] Downloading 1 item(s)

03/04 00:24:31 [NOTICE] CUID#7 - Redirecting to https://www.debian.org/
~ 1 >

All magnet links seem to fail as well.

[xeffyr]

Yeah, it happens on ARM:

[~]:$ aria2c ""
Invalid address 0xbee0a0ac passed to free: value not allocated
Aborted
[~]:$ aria2c https://google.com

03/04 01:26:29 [NOTICE] Downloading 1 item(s)

03/04 01:26:29 [NOTICE] CUID#7 - Redirecting to https://www.google.com/

03/04 01:26:30 [NOTICE] File already exists. Renamed to /data/data/com.termux/files/home/index.2.html.

03/04 01:26:30 [NOTICE] Download complete: /data/data/com.termux/files/home/index.2.html

Download Results:
gid   |stat|avg speed  |path/URI
======+====+===========+=======================================================
7d4859|OK  |    34KiB/s|/data/data/com.termux/files/home/index.2.html

Status Legend:
(OK):download completed.
[~]:$ aria2c https://glow.li

03/04 01:26:34 [NOTICE] Downloading 1 item(s)
Segmentation fault

No matter which OpenSSL version is installed (i have tried to downgrade). Perhaps new NDK caused this ?

[tomty89]

Could be something similar to https://github.com/termux/termux-packages/pull/2588.

[its-pointless]

Libgnu issue that still hasn't been fixed upstream?

[its-pointless]

Process 3193 stopped

• thread #1, name = 'aria2c', stop reason = signal SIGSEGV: invalid address (fault address: 0x0) frame #0: 0xaaaca53c aria2caria2::(anonymous namespace)::AccRequestGroup::operator(this=0x00000000, uri=0x00000002)(std::__ndk1::basic_string<char, std::__ndk1::char_traits<char>, std::__ndk1::allocator<char> > const&) at download_helper.cc:406:7 (lldb) bt * thread #1, name = 'aria2c', stop reason = signal SIGSEGV: invalid address (fault address: 0x0) * frame #0: 0xaaaca53c aria2caria2::(anonymous namespace)::AccRequestGroup::operator(this=0x00000000, uri=0x00000002)(std::__ndk1::basic_string, std::__ndk1::allocator > const&) at download_helper.cc:406:7
  frame #1: 0xaaae3984 aria2caria2::ProtocolDetector::guessTorrentMagnet(this=<unavailable>, uri=<unavailable>) const at ProtocolDetector.cc:82:5 frame #2: 0xaaaca53a aria2caria2::(anonymous namespace)::AccRequestGroup::operator(this=0xfffef390, uri=0xf7174d40)(std::__ndk1::basic_string
  , std::__ndk1::allocator > const&) at download_helper.cc:405:24
  frame #3: 0xaaac9b2c aria2c`aria2::createRequestGroupForUri(std::__ndk1::vector, std::__ndk1::allocator :RequestGroup> > >&, std::__ndk1::shared_ptr const&, std::__ndk1::vector, std::__ndk1::allocator >,
  std::__ndk1::allocator, std::__ndk1::allocator > > > const&, bool, bool, bool) [inlined] aria2::(anonymous namesp
  ace)::AccRequestGroup std::__ndk1::for_each, std::__ndk1::allocator >>, aria2::(__first=
  , __last=, __f=)::AccRequestGroup>(std::__ndk1::__wrap_iter, std::__ndk1::allocat
  or >>, std::__ndk1::__wrap_iter, std::__ndk1::allocator >*>, aria2::(a

[its-pointless]

okay you were right tomty this is same issue as gmic on arm. libz linked for other libs causing issues with exceptions.

[its-pointless]

quick patch
patchelf --remove-needed libz.so ~/../usr/bin/aria2c
makes aria2 work from device.

[kenneth-Q]

After run patchelf --remove-needed libz.so ~/../usr/bin/aria2c, I got this error.
$ CANNOT LINK EXECUTABLE: cannot locate symbol "deflateEnd" referenced by "aria2c"...

[its-pointless]

Yeah its complicated i have a pull request up.

[reardenlife]

Indeed, after update of OS up to 8.1.0, the segfault happens.

Or it doesn't depend on OS? And just the aria package alone that I had to reinstall?

$ termux-info                                                   Updatable packages:
apt/stable 1.4.9-1 arm [upgradable from: 1.4.8-9]               bash/stable 5.0.2 arm [upgradable from: 4.4.23-3]               busybox/stable 1.30.1-1 arm [upgradable from: 1.29.3-1]         ca-certificates/stable 20190124 all [upgradable from: 20181205] dpkg/stable 1.19.4 arm [upgradable from: 1.19.2]                gpgv/stable 2.2.13-1 arm [upgradable from: 2.2.12]              libbz2/stable 1.0.6-2 arm [upgradable from: 1.0.6-1]
libc++/stable 19b arm [upgradable from: 18]
libcurl/stable 7.64.0 arm [upgradable from: 7.63.0]
libgpg-error/stable 1.35 arm [upgradable from: 1.34]
ncurses/stable 6.1.20181117-1 arm [upgradable from: 6.1.20181117]
openssl/stable 1.1.1b-2 arm [upgradable from: 1.1.1a]           readline/stable 8.0 arm [upgradable from: 7.0.5-2]              System information:                                             Linux localhost 3.18.14-14291193-QB19693433 #1 SMP PREEMPT Fri Sep 7 23:16:07 KST 2018 armv8l Android                           Termux-packages arch:                                           arm                                                             Android version:                                                8.1.0                                                           Device manufacturer:                                            samsung

@its-pointless's fix doesn't work

[its-pointless]

yeah we need to merge #3452

[reardenlife]

@its-pointless

So... As for now I have to pull your branch ("aria2 fix" commit) on my server, compile aria2c and download its binary on my smartphone?

[its-pointless]

I wil upload a working binary

[its-pointless]

https://github.com/its-pointless/gcc_termux/raw/master/aria2_1.34.0-3_arm.deb

[reardenlife]

@its-pointless

Great!

Would you please explain how the usage of libunwind crashes the app on Android?

[its-pointless]

You need an unwinder to use c++ exceptions. on x86_64 i686 and aarch64 they use llvm-unwind. There is no llvm-unwind for arm though so they use a different unwinder that is less tested and less integrated into clang and it uses a script libgcc.a instead of the real libgcc.a which links unwinder libclang etc. For a normal android app you would use -fexceptions on all the libraries you wouldn't mix and match and have different build systems etc so the odds of running into to this sort of error is low. But we are doing things a bit beyond normal.
Thus the linking order is making ld not link libunwinder properly.

[ManuLinares]

https://github.com/its-pointless/gcc_termux/raw/master/aria2_1.34.0-3_arm.deb

I tried it, it doesn't work for me.

u0_a126@localhost ~/s/s/Download> aria2c ""
CANNOT LINK EXECUTABLE "aria2c": library "libssl.so.1.1" not found

but

ls -la ~/../usr/lib/
lrwxrwxrwx 1 u0_a126 u0_a126 13 May 17 16:09 libssl.so -> libssl.so.1.1
-rw------- 1 u0_a126 u0_a126 310.5K May 17 16:09 libssl.so.1.1

sorry FIXED: with export LD_LIBRARY_PATH=/data/data/com.termux/files/usr/lib/

[xeffyr]

Should be fixed in https://github.com/termux/termux-packages/commit/52683fb48d739d5721256734d5a9b168575dbfbf.

[Neo-Oli]

@xeffyr Would this fix also work for other programs? I think notmuch and gdb are also affected.

notmuch new

~ > gdb notmuch
GNU gdb (GDB) 8.3
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "arm-linux-androideabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from notmuch...
(No debugging symbols found in notmuch)
(gdb) run new
Starting program: /data/data/com.termux/files/usr/bin/notmuch new
[Detaching after fork from child process 22589]

Program received signal SIGSEGV, Segmentation fault.
0xb6a17ea0 in __gnu_Unwind_Resume () from /data/data/com.termux/files/usr/lib/libglib-2.0.so

gdb asdf (some not existing command)

~ > gdb gdb
GNU gdb (GDB) 8.3
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "arm-linux-androideabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from gdb...
(No debugging symbols found in gdb)
(gdb) run asdf
Starting program: /data/data/com.termux/files/usr/bin/gdb asdf
GNU gdb (GDB) 8.3
Copyright (C) 2019 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "arm-linux-androideabi".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...

Program received signal SIGSEGV, Segmentation fault.
0xb6cee32e in __gnu_Unwind_Resume () from /data/data/com.termux/files/usr/lib/libncursesw.so.6.1

I'm also experiencing segfaults with mosh but have so far been unable to reliably reproduce them

[xeffyr]

What is your version of gdb package ?
For me 8.3-2 fixes issues with crash on invalid commands.

Executing notmuch new also works fine.

[tomty89]

Or rather, if you are building gdb, which version of ncurses are you building against? (Or in other words, is the ncurses you used to build gdb built with the https://github.com/termux/termux-packages/commit/7e60494c163ebbecedc21624749c53af7bf5a741?)

glib, libtalloc and notmuch might need a rebuild (maybe also libuuid and libxapian), although I'm not getting segfault here either.

[tomty89]

Also note that https://github.com/termux/termux-packages/commit/7e60494c163ebbecedc21624749c53af7bf5a741 has not been applied to the android-5 branch.

[Neo-Oli]

ah I see. I haven't really been keeping up so I'm not on the Android-7 branch. I'll guess I'll try that out

[Neo-Oli]

@xeffyr, @tomty89: About notmuch segfaulting: I figured out it happens when notmuch encounters an encrypted email
Here are the steps to reproduce it on a blank Termux:

pkg install -y notmuch
yes ""|notmuch setup
mkdir -p ~/mail/new ~/mail/cur ~/mail/tmp
echo "From: a\nTo: a\nContent-Type: text/plain; charset=us-ascii; x-action=pgp-encrypted\n\n----- BEGIN PGP MESSAGE-----\n\na\n\n-----END PGP MESSAGE-----\n" > mail/new/test
notmuch new

This still happens in the android-7 branch. gdb however is fixed.

[tomty89]

As I've said, its dependencies and itself should be rebuilt.