#1144318 libcifti0t64: double free or corruption in autopkgtest

#1144318#5
Date:
2026-08-13 16:42:05 UTC
From:
To:
Dear maintainer,

ciftilib autopkgtest fails when run against glibc 2.43 [1]:

|  69s The following tests FAILED:
|  69s 	  1 - info-Conte69.MyelinAndCorrThickness.32k_fs_LR.dscalar.nii (Subprocess aborted)
|  69s 	  2 - rewrite-little-Conte69.MyelinAndCorrThickness.32k_fs_LR.dscalar.nii (Subprocess aborted)
|  69s 	  3 - rewrite-big-Conte69.MyelinAndCorrThickness.32k_fs_LR.dscalar.nii (Subprocess aborted)
|  69s 	  4 - info-Conte69.MyelinAndCorrThickness.32k_fs_LR.dtseries.nii (Subprocess aborted)
|  69s 	  5 - rewrite-little-Conte69.MyelinAndCorrThickness.32k_fs_LR.dtseries.nii (Subprocess aborted)
|  69s 	  6 - rewrite-big-Conte69.MyelinAndCorrThickness.32k_fs_LR.dtseries.nii (Subprocess aborted)
|  69s 	  7 - info-Conte69.MyelinAndCorrThickness.32k_fs_LR.ptseries.nii (Subprocess aborted)
|  69s 	  8 - rewrite-little-Conte69.MyelinAndCorrThickness.32k_fs_LR.ptseries.nii (Subprocess aborted)
|  69s 	  9 - rewrite-big-Conte69.MyelinAndCorrThickness.32k_fs_LR.ptseries.nii (Subprocess aborted)
|  69s 	 10 - info-Conte69.parcellations_VGD11b.32k_fs_LR.dlabel.nii (Subprocess aborted)
|  69s 	 11 - rewrite-little-Conte69.parcellations_VGD11b.32k_fs_LR.dlabel.nii (Subprocess aborted)
|  69s 	 12 - rewrite-big-Conte69.parcellations_VGD11b.32k_fs_LR.dlabel.nii (Subprocess aborted)
|  69s 	 13 - info-ones.dscalar.nii (Subprocess aborted)
|  69s 	 14 - rewrite-little-ones.dscalar.nii (Subprocess aborted)
|  69s 	 15 - rewrite-big-ones.dscalar.nii (Subprocess aborted)
|  69s Errors while running CTest
|  69s Output from these tests are in: /tmp/autopkgtest.mAiw3u/autopkgtest_tmp/build/Testing/Temporary/LastTest.log
|  69s Use "--rerun-failed --output-on-failure" to re-run the failed cases verbosely.
|  69s make: *** [Makefile:71: test] Error 8

Looking at the log file, there is:

| 15/15 Testing: rewrite-big-ones.dscalar.nii
| 15/15 Test: rewrite-big-ones.dscalar.nii
| Command: "/home/aurel32/work/glibc/transition/tmp/ciftilib/AUTOPKGTEST_TMP/build/rewrite" "/home/aurel32/work/glibc/transition/tmp/ciftilib/AUTOPKGTEST_TMP/data/ones.dscalar.nii" "big-ones.dscalar.nii" "BIG"
| Directory: /home/aurel32/work/glibc/transition/tmp/ciftilib/AUTOPKGTEST_TMP/build
| "rewrite-big-ones.dscalar.nii" start time: Aug 13 16:23 UTC
| Output:
| ----------------------------------------------------------
| double free or corruption (!prev)
| <end of output>
| Test time =   0.51 sec
| ----------------------------------------------------------
| Test Failed.
| "rewrite-big-ones.dscalar.nii" end time: Aug 13 16:23 UTC
| "rewrite-big-ones.dscalar.nii" time elapsed: 00:00:00
| ----------------------------------------------------------

And this is the corresponding backtrace:

| #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
| #1  0x00007ffff79f606f in __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
| #2  0x00007ffff799f582 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
| #3  0x00007ffff7987507 in __GI_abort () at ./stdlib/abort.c:77
| #4  0x00007ffff7988540 in __libc_message_impl (vma_name=vma_name@entry=0x7ffff7b09f89 "glibc: fatal", fmt=fmt@entry=0x7ffff7b0d5c6 "%s\n")
|     at ../sysdeps/posix/libc_fatal.c:138
| #5  0x00007ffff79ffe2e in __libc_message_wrapper (vmaname=0x7ffff7b09f89 "glibc: fatal", fmt=0x7ffff7b0d5c6 "%s\n") at ../include/stdio.h:203
| #6  malloc_printerr (str=str@entry=0x7ffff7b10080 "double free or corruption (!prev)") at ./malloc/malloc.c:5341
| #7  0x00007ffff7a0177c in _int_free_merge_chunk (av=0x7ffff7b46ac0 <main_arena>, p=0x55555557d5c0, size=32) at ./malloc/malloc.c:4423
| #8  0x00007ffff7a017e5 in _int_free_chunk (av=<optimized out>, p=<optimized out>, size=<optimized out>, have_lock=<optimized out>) at ./malloc/malloc.c:4368
| #9  0x00007ffff7e8ebb5 in Glib::VariantType::~VariantType() () at /usr/lib/x86_64-linux-gnu/libglibmm-2.4.so.1
| #10 0x00007ffff79a160d in __cxa_finalize (d=0x7ffff7922000) at ./stdlib/cxa_finalize.c:97
| #11 0x00007ffff78da307 in __do_global_dtors_aux () at /usr/lib/x86_64-linux-gnu/libglibmm-2.68.so.1
| #12 0x00007ffff791e510 in __frame_dummy_init_array_entry () at /usr/lib/x86_64-linux-gnu/libglibmm-2.68.so.1
| #13 0x00007ffff7fc8002 in _dl_call_fini (closure_map=closure_map@entry=0x7ffff7b55aa0) at ./elf/dl-call_fini.c:43
| #14 0x00007ffff7fcbe8e in _dl_fini () at ./elf/dl-fini.c:120
| #15 0x00007ffff79a1b50 in __run_exit_handlers (status=0, listp=0x7ffff7b46680 <__exit_funcs>, run_list_atexit=run_list_atexit@entry=true, run_dtors=run_dtors@entry=true)
|     at ./stdlib/exit.c:118
| #16 0x00007ffff79a1c2c in __GI_exit (status=<optimized out>) at ./stdlib/exit.c:148
| #17 0x00007ffff7988fc1 in __libc_start_call_main (main=main@entry=0x5555555572f9 <main>, argc=argc@entry=4, argv=argv@entry=0x7fffffffdff8)
|     at ../sysdeps/nptl/libc_start_call_main.h:83
| #18 0x00007ffff79890d7 in __libc_start_main_impl
|     (main=0x5555555572f9 <main>, argc=4, argv=0x7fffffffdff8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffdfe8)
|     at ../csu/libc-start.c:360
| #19 0x0000555555557231 in _start ()

You could notice that the code is linked to both libglibmm-2.4 and
libglibmm-2.68. This causes some issues as the exit handlers are
executed for both versions, doing the same work, and at the end causing
a double free.

The glibc 2.43 changed a bit the way the memory is being allocated and
reused, triggering the issue. However it can also be reproduce with glibc
2.42, for instance by executing the test binary without any argument.

The double linking is due to an incomplete conversion to libxml++ 4.0
introduced in ciftilib 1.6.0-8. The .pc file is still requiring binaries
to be linked with libxml++ 2.6, and it is used by the autopkgtest. The
attached patch fixes the issue.

Regards
Aurelien

[1] https://ci.debian.net/data/autopkgtest/testing/amd64/c/ciftilib/74304878/log.gz

#1144318#8
Date:
2026-08-14 09:50:16 UTC
From:
To:
Hello,

Bug #1144318 in ciftilib reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/med-team/ciftilib/-/commit/72448a702f9d7f59e1d229cdc841b0d7a8639b8e
------------------------------------------------------------------------
Update xmlplusplus4.patch to fix error detected by autopkgtest

Closes: #1144318
------------------------------------------------------------------------

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/1144318

#1144318#15
Date:
2026-08-14 10:04:29 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
ciftilib, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144318@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jeremy Bícha <jbicha@ubuntu.com> (supplier of updated ciftilib package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 14 Aug 2026 11:49:42 +0200
Source: ciftilib
Built-For-Profiles: derivative.ubuntu noudeb
Architecture: source
Version: 1.6.0-10
Distribution: unstable
Urgency: high
Maintainer: Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed-By: Jeremy Bícha <jbicha@ubuntu.com>
Closes: 1144318
Changes:
 ciftilib (1.6.0-10) unstable; urgency=high
 .
   * Team upload
 .
   [ Aurelien Jarno ]
   * Update xmlplusplus4.patch to fix error detected by autopkgtest
     (Closes: #1144318)
Checksums-Sha1:
 e94f10bd72b6b01cba8cad7c27414183bfa74107 2278 ciftilib_1.6.0-10.dsc
 ac9b577022d875d1b090908d6fb1b976e0632115 14232 ciftilib_1.6.0-10.debian.tar.xz
 a543f77a5dcbfbf538f6d3846b575ce143fef6cf 7657 ciftilib_1.6.0-10_source.buildinfo
Checksums-Sha256:
 6e16e1d55680213db1944c8eed267ceed60d7367db502728cb96d548d63ac489 2278 ciftilib_1.6.0-10.dsc
 ffaa6f55c721a44afd6ccfd7c471913c73b7fc2ad71a4fec702f19cb768ab850 14232 ciftilib_1.6.0-10.debian.tar.xz
 2606480a384187451378c9b30634099f5e48ed8d97a9557dde001fd8e81adeb1 7657 ciftilib_1.6.0-10_source.buildinfo
Files:
 8105689bbcbcfb7037255f094a653fb6 2278 libs optional ciftilib_1.6.0-10.dsc
 1cf5589cfafbae4e7e5e3385c03cd34f 14232 libs optional ciftilib_1.6.0-10.debian.tar.xz
 153b711341506d3ca7302ce4d3e1cd8b 7657 libs optional ciftilib_1.6.0-10_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEETQvhLw5HdtiqzpaW5mx3Wuv+bH0FAmp+5OkACgkQ5mx3Wuv+
bH09NQ//fLpnnELZoz8HJKoVIYS0yjZOnZsptHIZRTp4Tz9qJqh08PKYOKermiaq
+dUNpJX867uZ/tmGEO2qwgPpykgpPc5yCcfPT82lUy+bdpLlNeEvxC4H3Mwv3PZI
YaA8cJI+VYdgAipNN06EHJE/8ASm9ojgolfJExypI1PpWbOD/piw4QjWFsOeAdGx
8oizAp32Z51ZyZd9Z31A2BMH4l28Bx9ZHaDoWm3S6P+9EQGB7I8+E4d7Vc045NmO
c9TMjaEAPAvyh+vs95aqpEW9Cz3OBYdoHmkpfxlsdiE0VPeUzlpkfvQlOLKujJU1
Hb5LCzV02nLrqNed7+SdMK63F5GcwPmvY9bTM7hI0lXqxphFQgEIrmo2mf0MCND1
/ngJ4tQlGbJeOjOV2YNBbDm25zozzgt8ThQ1Cc51uemK9krtX/jeJFX214JCv6Tn
mev3YzrExm8m167qSIhLwZhM9SgZf2Akm4BI/M9XSi1rNeinmOROBk9ekyAMJkTr
hMqtgtjaj/vmu4fjt4yDvLtymE6ExpKtoy/fikPapM/cfnKe5IubnjQorPKOuKGk
MxJEMAkja3lIxUNl8/rN7ElVtJ8gW08otroL0H4PjgMllss3EuXPs7oPanwS1FwZ
BujELz0SIWMC2y0zULBwE2tmsZveVJmHVlWvb3pfsiDAiGczDi4=
=Wkhb
-----END PGP SIGNATURE-----