#1058620 iwctl crashes with double-free when asking more than one question on command-line

Package:
iwd
Source:
iwd
Description:
wireless daemon for Linux
Submitter:
Victor Westerhuis
Date:
2023-12-13 16:39:03 UTC
Severity:
normal
#1058620#5
Date:
2023-12-13 16:34:27 UTC
From:
To:
Hi maintainer,

In /var/lib/iwd/<ssid>.8021x I have defined a corporate network,
without specifying my username or password. If I run `iwctl station
<interface> connect <ssid>`, I can succesfully enter my username.
After pressing return, iwctl asks for my password. However, I cannot
enter my password and iwctl does not respond to pressing return.
Terminating iwctl by pressing ^C terminates iwctl with a libc error
"free(): double free detected in tcache 2".

I have recompiled libell0 and iwd with AddressSanitizer and found
the error location. I have attached the output from AddressSanatizer.

There are no issues when I connect using the iwctl shell or when I
specify my username in the configuration file.
- --
Groet, Regards,

Victor Westerhuis


- -- System Information:
Debian Release: trixie/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (100, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.5.0-5-amd64 (SMP w/4 CPU threads; PREEMPT)
Locale: LANG=en_NL.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages iwd depends on:
ii  init-system-helpers  1.66
ii  libc6                2.37-12
ii  libell0              0.61-1
ii  libreadline8         8.2-3

Versions of packages iwd recommends:
ii  dbus [dbus-system-bus]         1.14.10-3
ii  dbus-broker [dbus-system-bus]  33-1+~optimized
ii  wireless-regdb                 2022.06.06-1

iwd suggests no packages.

- -- Configuration Files:
/etc/iwd/main.conf changed [not included]

- -- no debconf information
-----BEGIN PGP SIGNATURE-----

iQJHBAEBCAAxFiEE6OxII3T+o0Ujs6ECQz2Rq5dHQPsFAmV53RITHHZpY3RvckB3
ZXN0ZXJodS5pcwAKCRBDPZGrl0dA+7lxD/9LGdzp7q/V04nyPUk578bdytdbpRu/
rC/5xvtBYvdGj2pvoYgKQYOi8JiVUEbZyByKe3wTJL1+quONNCLy/2a8PO9AQI0n
XdVPmqx65RO+AI0a4w5E+TLL+g5AsK5pdB+ON1Hvn9rWOegZW7Ct0psCYMqJIC+W
vK3HZOcnVnoJiKJyCVynNyCkzftrleVb9uR5tx6ArTbNWJ75uSg+galUWAhbYLNT
rJvNcHZllH++CVD45oqIn90tCwjmxWFYe6m9SMJg9NIM0uzQMO7aTxd1Wd/DbyKG
wXUHiLZVRSTZgITDv83Ukt0r+l/3lLUzpaEu2ds0B8eRN6LC+sFImI9GM/S4NFR1
lHj1nUkmoooTGbQm98baIjavEO5J5w7FKf4EduJjSn0BE25fWAVxKeoHx/skmoob
Vhp2rtCW5hAV0Fob/NMBDL1gBENdlkP47kije3azWOFYBNxcMnlHw9XBs2iR8zpj
mYQbWaEMXo3kBtbnFYA2+mDvFeY3jp19BAg714oJVPgADQ5Jt4cTGmuLCfI5MBx0
PotrktkSzue/uG/jjCMdPyy6lwzQXHq4chRAqQf8a+SrA3MvzHZoVKkXGTVYhzKt
914WCwAr5tHXCxNoRyr3DQxf/WzAt76KsT8gyTA7y33rEW64RLO3kh4O9fDicVsE
o27ixJDMKt0pMA==
=H8lJ
-----END PGP SIGNATURE-----