#882386 avahi-daemon segfaults with txt-record values ending in "="

Package:
avahi-daemon
Source:
avahi
Description:
Avahi mDNS/DNS-SD daemon
Submitter:
Tor Slettnes
Date:
2022-06-05 16:45:03 UTC
Severity:
important
Tags:
#882386#5
Date:
2017-11-22 00:06:08 UTC
From:
To:
I have a custom service file, "/etc/avahi/services/instrument.service", containing the following:

  +------------------------------------------------------------------------------------------------
  | <?xml version="1.0" encoding="utf-8"?>
  | <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
  | <service-group>
  |   <name replace-wildcards="yes">%h</name>
  |   <service>
  |     <type>_abi-instrument._tcp</type>
  |     <port>7000</port>
  |     <txt-record>status=Sleeping</txt-record>
  |     <txt-record>protocol=</txt-record>
  |     <txt-record>experiment=</txt-record>
  |     <txt-record>serialnumber=932006666</txt-record>
  |     <txt-record>product=SeqStudio</txt-record>
  |     <txt-record>runid=</txt-record>
  |     <txt-record>version=1.1.dev</txt-record>
  |     <txt-record>release=1.1.b2</txt-record>
  |     <txt-record>build=</txt-record>
  |     <txt-record>injection=</txt-record>
  |     <txt-record>description=Applied Biosystems(tm) SeqStudio(tm) Genetic Analyzer</txt-record>
  |   </service>
  | </service-group>
  +------------------------------------------------------------------------------------------------

With this file in place, "avahi-daemon" encounters a segfault starting up:

  > startbit:~# avahi-daemon --debug
  > Process 20682 died: No such process; trying to remove PID file. (/run/avahi-daemon//pid)
  > Found user 'avahi' (UID 113) and group 'avahi' (GID 118).
  > Successfully dropped root privileges.
  > avahi-daemon 0.7 starting up.
  > chroot.c: chroot() helper started
  > Successfully called chroot().
  > Successfully dropped remaining capabilities.
  > chroot.c: chroot() helper got command 02
  > Loading service file /services/instrument.service.
  > chroot.c: chroot() helper exiting with return value 0
  > Segmentation fault

However if I remove those "<txt-record>" entries that have no value
after the "=" sign, "avahi-daemon" starts up normally (save for a
bugus warnign about duplicate mDNS stack on this host):

  +------------------------------------------------------------------------------------------------
  | <?xml version="1.0" encoding="utf-8"?>
  | <!DOCTYPE service-group SYSTEM "avahi-service.dtd">
  | <service-group>
  |   <name replace-wildcards="yes">%h</name>
  |   <service>
  |     <type>_abi-instrument._tcp</type>
  |     <port>7000</port>
  |     <txt-record>status=Sleeping</txt-record>
  |     <txt-record>protocol=</txt-record>
  |     <txt-record>experiment=</txt-record>
  |     <txt-record>serialnumber=932006666</txt-record>
  |     <txt-record>product=SeqStudio</txt-record>
  |     <txt-record>runid=</txt-record>
  |     <txt-record>version=1.1.dev</txt-record>
  |     <txt-record>release=1.1.b2</txt-record>
  |     <txt-record>build=</txt-record>
  |     <txt-record>injection=</txt-record>
  |     <txt-record>description=Applied Biosystems(tm) SeqStudio(tm) Genetic Analyzer</txt-record>
  |   </service>
  | </service-group>
  +------------------------------------------------------------------------------------------------


  > startbit:~# avahi-daemon --debug
  > Process 20846 died: No such process; trying to remove PID file. (/run/avahi-daemon//pid)
  > Found user 'avahi' (UID 113) and group 'avahi' (GID 118).
  > Successfully dropped root privileges.
  > avahi-daemon 0.7 starting up.
  > chroot.c: chroot() helper started
  > Successfully called chroot().
  > Successfully dropped remaining capabilities.
  > chroot.c: chroot() helper got command 02
  > Loading service file /services/instrument.service.
  > Loading service file /services/ssh.service.
  > *** WARNING: Detected another IPv4 mDNS stack running on this host. This makes mDNS unreliable and is thus not recommended. ***
  > *** WARNING: Detected another IPv6 mDNS stack running on this host. This makes mDNS unreliable and is thus not recommended. ***
  > Joining mDNS multicast group on interface enp4s0.IPv6 with address fe80::a28c:fdff:fe32:8013.
  > New relevant interface enp4s0.IPv6 for mDNS.
  > Joining mDNS multicast group on interface enp4s0.IPv4 with address 10.43.32.19.
  > New relevant interface enp4s0.IPv4 for mDNS.
  > Network interface enumeration completed.
  > Registering new address record for fe80::a28c:fdff:fe32:8013 on enp4s0.*.
  > Registering new address record for 10.43.32.19 on enp4s0.IPv4.
  > Server startup complete. Host name is startbit.local. Local service cookie is 3029496375.
  > Service "startbit" (/services/ssh.service) successfully established.
  > Service "startbit" (/services/instrument.service) successfully established.


Regards,
-tor

#882386#10
Date:
2017-11-22 05:05:02 UTC
From:
To:
I should mention that this issue is new to avahi-daemon 0.7-3; it does
not occur with the earlier .deb's versioned 0.6.32-2.

Regards,
-tor

#882386#15
Date:
2018-06-24 20:36:41 UTC
From:
To:
This bug can also occur easily when advertising a WebDAV server that
needs no user name / password on the LAN, or has an empty path because
everything on the server's authority is WebDAV.

#882386#20
Date:
2019-05-10 14:33:57 UTC
From:
To:
Hi,

I'm the last person who changed that code, so I think I'm to blame for the
crash. I was let know about this bug, so I wrote a fix. Please see the
following PR on github:

https://github.com/lathiat/avahi/pull/226

I suppose you could carry this patch in the package until it gets fixed
upstream.

Cheers,
Krzesimir

#882386#25
Date:
2020-04-24 11:25:32 UTC
From:
To:
Control: tags -1 + fixed-upstream pending

This looks like essentially the same bug as #947891. Your patch was
applied upstream, and there's an essentially equivalent patch queued up
in the packaging git repository already.

    smcv

#882386#32
Date:
2022-06-05 16:42:13 UTC
From:
To:
Marking as fixed in 0.8-1.

Thanks again.