Hi,

While checking the glibc transition (bug 1141940), I noticed that your
autopkgtest fails with the new glibc and it failing with a Segmentation
fault. To be open about it, we'll not be holding back the glibc
transition for this package, please have a look at it.

Paul

https://ci.debian.net/packages/s/sra-sdk/unstable/amd64/74480346/

  60s autopkgtest [12:02:15]: test run-unit-test: [-----------------------
  60s >>>>>Decompressing test-data archive...
  60s dbGaP-0/
  60s dbGaP-0/SRR2042184.fasta
  60s meta/
  60s meta/prj_phs710EA_test.ngc
  60s meta/SRR6650398_experiment.xml
  60s meta/SRR6650398.bam
  60s meta/SRR2042184_run.xml
  60s meta/SRR2042184_experiment.xml
  60s meta/SRR6650398_illumina_run.xml
  60s meta/SRR7032226_run.xml
  60s meta/SRR7032226_experiment.xml
  60s meta/reference.fna
  60s meta/SRR6650398_fastq_run.xml
  60s public/
  60s public/nannot/
  60s public/wgs/
  60s public/refseq/
  60s public/refseq/NC_000962.3
  60s public/sra/
  60s public/sra/SRR7032226.sra
  60s public/sra/SRR6650398.sra
  60s public/sra/SRR2042184.sra
  60s public/files/
  60s >>>>>Running test-sra...
  63s 2026-08-20T12:02:18 test-sra.3.2.1 fatal: SIGNAL - Segmentation fault
  64s autopkgtest [12:02:19]: test run-unit-test: -----------------------]

Hi,

This is the corresponding backtrace of the crash:

(gdb) bt
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x00007ffff7ce4ed3 in KOutMsgNulTermStringFmt (arg=<optimized out>) at ./libs/klib/out.c:50
#2  KOutVMsg (fmt=<optimized out>, args=args@entry=0x7fffffffd3c0) at ./libs/klib/out.c:154
#3  0x00007ffff7ce518d in KOutMsg (fmt=fmt@entry=0x55555556c0b4 "%s") at ./libs/klib/out.c:177
#4  0x000055555555ac02 in MainRanges (self=self@entry=0x7fffffffd7e0, arg=arg@entry=0x55555556bc0a "SRR000001", bol=bol@entry=0x55555556b54d "  ", get=get@entry=true, aHost=aHost@entry=0x7fffffffd610,
    aPath=aPath@entry=0x7fffffffd630, https=true) at ./tools/external/test-sra/test-sra.c:2703
#5  0x000055555555be39 in MainNetwotk (self=self@entry=0x7fffffffd7e0, arg=arg@entry=0x55555556bc0a "SRR000001", bol=0x55555556b54d "  ", eol=eol@entry=0x55555556b78b "\n")
    at ./tools/external/test-sra/test-sra.c:2910
#6  0x00005555555617d0 in KMain (argc=<optimized out>, argv=<optimized out>) at ./tools/external/test-sra/test-sra.c:4121
#7  0x0000555555566c51 in KMane ()
#8  0x000055555555a123 in main ()
(gdb)
#0  __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:76
#1  0x00007ffff7ce4ed3 in KOutMsgNulTermStringFmt (arg=<optimized out>) at ./libs/klib/out.c:50
#2  KOutVMsg (fmt=<optimized out>, args=args@entry=0x7fffffffd3c0) at ./libs/klib/out.c:154
#3  0x00007ffff7ce518d in KOutMsg (fmt=fmt@entry=0x55555556c0b4 "%s") at ./libs/klib/out.c:177
#4  0x000055555555ac02 in MainRanges (self=self@entry=0x7fffffffd7e0, arg=arg@entry=0x55555556bc0a "SRR000001", bol=bol@entry=0x55555556b54d "  ", get=get@entry=true, aHost=aHost@entry=0x7fffffffd610,
    aPath=aPath@entry=0x7fffffffd630, https=true) at ./tools/external/test-sra/test-sra.c:2703
#5  0x000055555555be39 in MainNetwotk (self=self@entry=0x7fffffffd7e0, arg=arg@entry=0x55555556bc0a "SRR000001", bol=0x55555556b54d "  ", eol=eol@entry=0x55555556b78b "\n")
    at ./tools/external/test-sra/test-sra.c:2910
#6  0x00005555555617d0 in KMain (argc=<optimized out>, argv=<optimized out>) at ./tools/external/test-sra/test-sra.c:4121
#7  0x0000555555566c51 in KMane ()
#8  0x000055555555a123 in main ()

And valgrind already sopt that location, with glibc 2.42 or 2.43:

==3640786== Invalid read of size 1
==3640786==    at 0x48700A6: strlen (vg_replace_strmem.c:506)
==3640786==    by 0x49BFED2: KOutMsgNulTermStringFmt (out.c:50)
==3640786==    by 0x49BFED2: KOutVMsg (out.c:154)
==3640786==    by 0x49C018C: KOutMsg (out.c:177)
==3640786==    by 0x4006C01: MainRanges.constprop.0.isra.0 (test-sra.c:2703)
==3640786==    by 0x4007E38: MainNetwotk.isra.0 (test-sra.c:2910)
==3640786==    by 0x400D7CF: KMain (test-sra.c:4121)
==3640786==    by 0x4012C50: KMane (in /usr/bin/test-sra)
==3640786==    by 0x4006122: main (in /usr/bin/test-sra)
==3640786==  Address 0xffffffff is not stack'd, malloc'd or (recently) free'd
==3640786==
2026-08-20T18:09:49 test-sra.3.2.1 fatal: SIGNAL - Segmentation fault
==3640786==
==3640786== HEAP SUMMARY:
==3640786==     in use at exit: 1,497,081 bytes in 5,970 blocks
==3640786==   total heap usage: 47,871 allocs, 41,901 frees, 5,726,644 bytes allocated
==3640786==
==3640786== LEAK SUMMARY:
==3640786==    definitely lost: 4,112 bytes in 1 blocks
==3640786==    indirectly lost: 0 bytes in 0 blocks
==3640786==      possibly lost: 0 bytes in 0 blocks
==3640786==    still reachable: 1,492,969 bytes in 5,969 blocks
==3640786==         suppressed: 0 bytes in 0 blocks
==3640786== Rerun with --leak-check=full to see details of leaked memory
==3640786==
==3640786== For lists of detected and suppressed errors, rerun with: -s
==3640786== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 0 from 0)

So this is not a glibc bug. glibc 2.43 got changes to the memory
allocator, the memory is not allocated or reused the same way. This just
reveal an existing bug.

Regards
Aurelien

Hi Aaron,

I noticed there is a new upstream version (please pull, I've fixed
the watch file).  Since you have a direct channel to upstream would
you mind forwarding this issue?

Thanks a lot
    Andreas.

AFAICT, upstream already fixed the error at some point prior to 3.4.1,
so upgrading the VDB/SRA stack should suffice; thanks for paving the way
with the watch file fix.  I've prepared preliminary 3.4.1 packages
locally and will get them into proper shape soon.  Meanwhile, the stack
trace *suggests* that the bug may be in the test itself rather than any
actual library code.

We believe that the bug you reported is fixed in the latest version of
sra-sdk, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1144917@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Aaron M. Ucko <ucko@debian.org> (supplier of updated sra-sdk package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 27 Sep 2026 21:07:56 -0400
Source: sra-sdk
Architecture: source
Version: 3.4.1+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Med Packaging Team <debian-med-packaging@lists.alioth.debian.org>
Changed-By: Aaron M. Ucko <ucko@debian.org>
Closes: 1144917
Changes:
 sra-sdk (3.4.1+dfsg-1) unstable; urgency=medium
 .
   * New upstream release.
     - test-sra no longer crashes under glibc 2.43.  (Closes: #1144917.)
   * debian/control:
     - Bump libngs-c++-dev Breaks/Replaces on libncbi-vdb-dev to (<< 3.4)
       per libkapp.a takeover.  (NB: sra-sdk took over the name and the
       main() wrapper, but ncbi-vdb retained the remaining content under
       the name libvdbapp.a.)
     - Bump B-D on libncbi-vdb-dev to (>= 3.4.1+dfsg~) and add one on
       python3-setuptools-whl to support Test_NGS_Python_install's patch.
   * debian/copyright: Revisit per licenserecon (lrc).
     - Add stanzas for bxzstr, rwqueue, SparkKMer.java, sse2neon.h,
       taskflow (complete with internal special cases), and tsl.
     - Wildcard (N. Lohmann's) json.hpp.
     - Extend BitMagic (libs/inc/bm) date range.
     - Formally rename BSD-3-clause-CLI11 to BSD-3-clause, uncontended.
   * debian/not-installed: Broaden lib*ngs*-static.a to lib*-static.a.
   * debian/patches: Update existing patches for new release.  Notably:
     - bypass-libxml2-ATTRIBUTE_UNUSED.patch, fix_bm_for_gcc15.patch:
       Disable (fully superseded).
     - include_cstdint_for_gcc15.patch: Drop superseded portion.
     - label_online_tests.patch: Resync; leave out Test_NGS_Python_install.
     - link_vdb_dynamically.patch, prefer_dynamic_libraries.patch: Drop
       build/env.cmake changes; we can now set DYNAMIC_LINK=ON instead.
     - setuptools.patch: Repurpose somewhat.  (setup.py has already
       migrated to setuptools, but the new accompanying test-install.sh
       [Test_NGS_Python_install] uses pip and needs patching to take
       infrastructure wheels from the local filesystem rather than PyPI.)
     - support_libre2-11.patch, use_debian_packaged_*.patch: Resync.
   * debian/patches/not_just_ubuntu.patch (new): Don't use a build-wide
     Python virtual env. under Debian (or any other derivative) either.
   * debian/patches/public_version-hash.patch (new): In
     tools/loaders/sharq/version.h, #include <kapp/version-hash.h> without
     a leading ../libs/, which works only when building against uninstalled
     VDB.  (As of 3.4.1, Debian's installation makes the header public.)
   * debian/patches/tiny_csra_shell.patch (new): Run
     test/external/fasterq-dump/tiny_csra.sh under bash per its use of [[.
     (As is, it could never officially fail.  No further changes needed,
     though.)
   * debian/rules:
     - Don't clean "expected" (golden) *.orig files.  To that end, move
       custom cleanup logic to override_dh_clean (vs. _autoclean).
     - override_dh_auto_install: Add libkapp.a* to libngs-c++-dev.
     - execute_after_dh_auto_build (new): Take over javadoc invocation from
       the upstream build system, which no longer ever runs javadoc itself.
     - override_dh_auto_configure: Set the new DYNAMIC_LINK option to ON,
       thereby linking dynamically against dependencies in most cases.
       (Some portions of the tree still need patching to do so.)
   * debian/tests/run-unit-test: Stop testing cache-mgr, retired upstream.
   * Standards-Version: 4.7.4 (routine-update)
   * Reflow Uploaders field (cme)
   * Remove Priority field (cme)
   * Drop 'Rules-Requires-Root: no' from d/control (routine-update)
   * Reformat the Last-Update date as ISO YYYY-MM-DD.
   * No tab in license text (routine-update)
 .
 sra-sdk (3.2.1+dfsg-7) UNRELEASED; urgency=medium
 .
   * Fix watch file
Checksums-Sha1:
 3bcf9527c866c4ff58447fec76ce5ae0c0b2f812 3036 sra-sdk_3.4.1+dfsg-1.dsc
 15a020e8c65d4115f28d85703c3d531045161446 50290644 sra-sdk_3.4.1+dfsg.orig.tar.xz
 4e010bfd54e18c033616a64a60acde4f55db9bbb 3798672 sra-sdk_3.4.1+dfsg-1.debian.tar.xz
Checksums-Sha256:
 e9ebcf5412fc1b8bc3f95a9a2a3ab136ff3bc69cd9de12f35d522d2d62872b39 3036 sra-sdk_3.4.1+dfsg-1.dsc
 658663be972005fbae4d6b53963fb1aff069a1d4c4c2a81c320910f40701f66c 50290644 sra-sdk_3.4.1+dfsg.orig.tar.xz
 5015efbb2fd710377d940d614816a1c9010461c5cabc9bba73e9f6d728a74d86 3798672 sra-sdk_3.4.1+dfsg-1.debian.tar.xz
Files:
 8df5493df73a2dea7728f5219363f60d 3036 science optional sra-sdk_3.4.1+dfsg-1.dsc
 37f30ef5d9a181d2881a833416a3036e 50290644 science optional sra-sdk_3.4.1+dfsg.orig.tar.xz
 1981d0b2c494ba60b5d8d0c7e5342505 3798672 science optional sra-sdk_3.4.1+dfsg-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEfDq5z9IwvTDdAJxZHnCRsfFKZKIFAmq5vnUACgkQHnCRsfFK
ZKIwmxAAlEOCoGhnItVBW1hnf1vED/GxA9BNqzPPiWG5dxO+QTed824CfJ3j2OBS
f0JTr6m+zPAXtbFMjd6330be9Cnwzy6Po2YCNEOmXuCG3EdO7CzElqRHbTDg5z0A
mA/nYn2FG7AbwGQ0VL/TY9T2HKi7V3n476HuRgBmwe6huWmNHJzpX00YPtQCZu1Z
Z7yGYRKgOpkXS3KKqfP2nxabdahNPMJZ1D+9/+pyWldSl1pO57p/TLcQUxHNUOdF
uDwluvG4XFq4SkCmsjTAIYJSwEqkgosxO3w3jG9gZyserguRm3OvhVFl2ZNmIP/2
aBRz6LoBB0NlWVp758YWZj4e1pxx33omR4Zn8cW5Rrfu72YIy9kaziDpUZncTb84
Xusy0p4B2RaeCOfXl/QYLsUuqrPadpIg/0LGUuIdU7MizKJ9djHj29E4vZnM1fBD
twxKwAIXyuvolxzubTV/W3S6w4IyV44YDsjVPbrmIVV0TpcPqkuPNHiSbU041cRv
RnxFr0Ja6Nt3xyXnoOvRdZ3padmxmi1+rr+qmL4IDh21ky6kb+K1S02PcyIttCCA
xy8V2lRjdUcpGqtYA+73kW7bapzbvVxRMWhyuyK1o/vHHKVgO0R2h+Mc/PeXOob/
uUNZgA45XZ1qMHr+1Huhy6Ieo3bRK1hsHtm/611PJgL8R6mFkwM=
=p8N0
-----END PGP SIGNATURE-----