Fabre

#1141809 otpclient: error "couldn't lock 16384 bytes of memory (gtk)" - mlock fails with ENOMEM #1141809

Package:: otpclient

Source:: otpclient

Description:: Simple GTK+ software to generate OTPs (TOTP and HOTP)

Submitter:: Vincent Lefevre

Date:: 2026-07-13 02:45:02 UTC

Severity:: normal

Tags:

#1141809#5

Date:: 2026-07-10 10:44:48 UTC

From:

To:

Just after typing the first character of the password to unlock
the database (after starting otpclient), I get the following
error in the terminal:

couldn't lock 16384 bytes of memory (gtk): Cannot allocate memory

Indeed, strace shows:

  mlock(0x7fa42aa9a000, 16384)     = -1 ENOMEM (Cannot allocate memory)

Last year, there was

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098822
  otpclient: otpclient complains about lock memory limits
  (show_memlock_warning)

but the memlock was more than 8 MB. Here, this is much smaller!

I don't know the consequences. A potential security issue about
the password?

#1141809#10

Date:: 2026-07-10 11:06:54 UTC

From:

To:

This error message actually comes from the GTK4 library

  /usr/lib/x86_64-linux-gnu/libgtk-4.so.1

However, libraries should normally not output error messages to
stderr, but pass the error to the caller.

#1141809#15

Date:: 2026-07-10 11:24:36 UTC

From:

To:

According to

https://chat.mistral.ai/chat/27317f33-8880-49f4-b5d8-f8bef90d7a08

"the password (and possibly other sensitive data) was stored in
regular, unlocked memory" (because the otpclient/GTK4 accepted
the password instead of aborting after the mlock failure). So
this is apparently a security issue.

There may actually be 2 bugs:

1. The fact that the password is stored in regular, unlocked memory
   (security).

2. The fact that mlock fails with ENOMEM on such a low value.

#1141809#24

Date:: 2026-07-11 00:04:59 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
otpclient, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141809@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Francisco Vilmar Cardoso Ruviaro <vilmar@debian.org> (supplier of updated otpclient package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 10 Jul 2026 23:36:10 +0000
Source: otpclient
Architecture: source
Version: 5.1.4-1
Distribution: unstable
Urgency: medium
Maintainer: Francisco Vilmar Cardoso Ruviaro <vilmar@debian.org>
Changed-By: Francisco Vilmar Cardoso Ruviaro <vilmar@debian.org>
Closes: 1141809
Changes:
 otpclient (5.1.4-1) unstable; urgency=medium
 .
   * New upstream version 5.1.4. (Closes: #1141809)
Checksums-Sha1:
 cda643ddf7ce4c1932074bee9301fb0b48af551a 2405 otpclient_5.1.4-1.dsc
 3fb14a256930bdbe44df6a8d1d2973417dec51dc 342642 otpclient_5.1.4.orig.tar.gz
 c81225a96cc566bfc2814319c29a138c478e51be 902 otpclient_5.1.4.orig.tar.gz.asc
 aa80f132f7268eba5df596a764a1a5d6b426a42e 11804 otpclient_5.1.4-1.debian.tar.xz
 c55d7b34a6801069e795915d56673698ae35236d 19959 otpclient_5.1.4-1_amd64.buildinfo
Checksums-Sha256:
 2500959c256485c3554d30483b6d2e269d74347b534cce44e0473c3307e8d3e8 2405 otpclient_5.1.4-1.dsc
 ca9b93ea3ada2a1d582bc469079803726fc7941d70b50c7d8c9f829f28c00ee4 342642 otpclient_5.1.4.orig.tar.gz
 3420fe90b6e7a1f5ece700c1899e425df9a512e7fdea6d027f775cc3863a7b83 902 otpclient_5.1.4.orig.tar.gz.asc
 adb34eb80cd238974b384720f4fd408316415077e9eb9964805c548a91c24891 11804 otpclient_5.1.4-1.debian.tar.xz
 a528834319e9001758ee306ac7cedf6a6a29d15e79190e83cd21bf3bcfb1a4bf 19959 otpclient_5.1.4-1_amd64.buildinfo
Files:
 d6c5e5e38e117677761ae5eb56b39de6 2405 utils optional otpclient_5.1.4-1.dsc
 3214851588bd14c953b66a97367281a5 342642 utils optional otpclient_5.1.4.orig.tar.gz
 eb1199e8f528d010f31a128e92c7bf3e 902 utils optional otpclient_5.1.4.orig.tar.gz.asc
 ba9dd28f4290931cb00f444381056922 11804 utils optional otpclient_5.1.4-1.debian.tar.xz
 becf0ff51a5fb93d75923c2fb8e47338 19959 utils optional otpclient_5.1.4-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEG4z2Vu87hEcvSPDngvv3BgsvfQAFAmpRhHASHHZpbG1hckBk
ZWJpYW4ub3JnAAoJEIL79wYLL30AwKUP/iheMUHEO8nvgufp8ZDQ79rAKDal52WV
0eMIBhtr/708Y4aDuw3KsnE8R8jG/imxSA2pAE0H1dfDKlyFhhppjhFgNQ1MtRtL
Pw+LD1YGQDbLPi4XQWt40BlW8Ddvob6WsPmntkHXYonLFP0ObQCK+Q01CEQL63XE
g7xnQ0CfIvNKEXQOaVYfugTru1B2y9HZ5s8AjEyWCcrNk5A9IFzscRFiHxDzykTF
hsv7myMNBPefOJrbV1pxCzj71TJzC0miEbLdtz80UNehXZIaINookuqTTPPyQKGR
Z8YEwVGh0Z2DfwiZ3wU0UGPvm8jJuBjfWFCUrKuJ5xOr9hSeX6OQ1jf3eUJCY55r
MAplnxtAV6boNevpaHp8HDCIf3zRXpCSaICIARG7ra+1hWSOdaU3nlplJQv76huO
Nvd7HwVgbNBKkZJ2w+yZJSDe7OYHy/7OOY4IXTmA0N9IomTilM0qh5+YkAiSS8+s
t1nK79+UqishROCGpB735vISVDp8Of4YdXcT6gB82+11k5mDB5gtXsKw5qsTbTOV
Er54joY8Oqs2lN30CvM88ca2oFE9qtLFLFq7aGI1+rnV44Gp69JP4ZOSzxYLDOAF
C83P+6fJFF1frMn4nmIAtpJ3aIQFLIggd/+vLfrNmnSaMtsCDpqM/RtIs3+8L7UW
7zOEDJOFLYsb
=Jt2D
-----END PGP SIGNATURE-----

#1141809#29

Date:: 2026-07-12 00:47:49 UTC

From:

To:

I still get the warning message:

couldn't lock 16384 bytes of memory (gtk): Cannot allocate memory

#1141809#40

Date:: 2026-07-12 00:57:29 UTC

From:

To:

Indeed, 5.1.4 was released before the commit that fixes the bug

https://github.com/paolostivanin/OTPClient/commit/4093c2ae8ff064deb87ad0a58c75951fadc7d714

as this can be seen:

https://github.com/paolostivanin/OTPClient/commits/master/

#1141809#45

Date:: 2026-07-13 02:43:50 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
otpclient, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1141809@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Francisco Vilmar Cardoso Ruviaro <vilmar@debian.org> (supplier of updated otpclient package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 13 Jul 2026 01:56:37 +0000
Source: otpclient
Architecture: source
Version: 5.1.4+git20260710.4093c2a-1
Distribution: unstable
Urgency: medium
Maintainer: Francisco Vilmar Cardoso Ruviaro <vilmar@debian.org>
Changed-By: Francisco Vilmar Cardoso Ruviaro <vilmar@debian.org>
Closes: 1141809
Changes:
 otpclient (5.1.4+git20260710.4093c2a-1) unstable; urgency=medium
 .
   * New upstream git snapshot version 5.1.4+git20260710.4093c2a.
     (Closes: #1141809)
Checksums-Sha1:
 4d5f7b5df2e8154c213d723e0d3dc4634af384d5 2295 otpclient_5.1.4+git20260710.4093c2a-1.dsc
 cd1f086126793c6792d34d86d1283327f0f10a78 279084 otpclient_5.1.4+git20260710.4093c2a.orig.tar.xz
 72ea2a8cc0a8f45f252b194051efc6f011110ad1 11836 otpclient_5.1.4+git20260710.4093c2a-1.debian.tar.xz
 6ec8c6b9af2161a517af01f6b54d2cca0038f8a7 20299 otpclient_5.1.4+git20260710.4093c2a-1_amd64.buildinfo
Checksums-Sha256:
 3acf0941149d5df66846ff478ff921471b4858a00b6afb2daef3914e9ccdefe8 2295 otpclient_5.1.4+git20260710.4093c2a-1.dsc
 1d62280e24168d101d4fa119932df42828be69feba521ae418743d331b046f31 279084 otpclient_5.1.4+git20260710.4093c2a.orig.tar.xz
 1baf0803eb11492fe49ffeaf8a6aec2a36fc1f8597ce88c508023f7866302772 11836 otpclient_5.1.4+git20260710.4093c2a-1.debian.tar.xz
 406de591862f43d39cbc24971a277fe7f2420fccab65e740b57df53a00fcef77 20299 otpclient_5.1.4+git20260710.4093c2a-1_amd64.buildinfo
Files:
 c2979c15bc97d90b546f9ad2edf45ffd 2295 utils optional otpclient_5.1.4+git20260710.4093c2a-1.dsc
 17ebd3b85349cc92349125383b34d78d 279084 utils optional otpclient_5.1.4+git20260710.4093c2a.orig.tar.xz
 96d88c951d57835d07289cba4bfb0c54 11836 utils optional otpclient_5.1.4+git20260710.4093c2a-1.debian.tar.xz
 5e3704327cea4232bed02b349a251a43 20299 utils optional otpclient_5.1.4+git20260710.4093c2a-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEG4z2Vu87hEcvSPDngvv3BgsvfQAFAmpUR5ASHHZpbG1hckBk
ZWJpYW4ub3JnAAoJEIL79wYLL30A0J4P/1nQUnGp/a1ACtSlFdc64y8szDJqCRi0
OD4822mVzOy1ACpLz/xFswyJDqFg0aK60eLXr455gAZoMZSYb5MzqUAq1gyDYyKO
mmfEsqBClD4IQ4l+W5g8WVo0KRh4ZG7H8XVnvGRuKzFeezfIZFxHiPKn8Hz/Al4D
IrXFNzVaal3bUhzfFaXBKs2TjOAwT6dygZz82r+9Xp4S/aS4MynACTE0SdBCmJNB
pDGgDLFsackg94NewaM/714jNiiWjJT+BmqKN3vMeOVsbanPHEYC72YYet+rBamN
1VFmxcgIQsYzWKBlGq1jtV+s3DX0ymGmfoPySRt/0FJWd+Fog0B4/0+4LlxLxWCV
IBR3SGj34eFvvgYt26IiXaHz5TTr+5IfXf7ykq2kZkuThiqPp/vKWphS07drDyKS
gV3KE3s27hjtemGyoHxod/mwBSNJsb9jptttJpiBdWLiSl+5P6WXpScWAi8uccZl
OmlwBt1E8Abz3AhxBb5n2K2kyxs9UKia5ZTnO83r+lE8T8HgMuMErwjnTp67e3or
EHqPcaIABS8El7M9wePNflIhoBnYl2TLOIdQCqtdTHQSAi6vT/MmoPy3S05PXpZQ
y70+CZOlYUSRMHzcBbrSVFDMBZdkkpmBMUIIlyiiiwAtKwTmzksCM5WmTVAVf7eI
t0NBWB2VY8lo
=UydP
-----END PGP SIGNATURE-----

#1141809 otpclient: error "couldn't lock 16384 bytes of memory (gtk)" - mlock fails with ENOMEM #1141809

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)