Dear Maintainer,

while trying to use checkinstall to create a debianized package from a
cmake based source, the build failed with a segfault. These are linked
to installwatch and don't happen without it:

$ installwatch make cmake_check_build_system

INFO : Using a default root directory : /tmp/tmp.JBpq66zd4H

make: *** [Makefile:10806: cmake_check_build_system] Neoprávněný přístup do paměti (SIGSEGV) (obraz paměti uložen)

There is a backtrace of the crash, which indicates it happens early in
the initialization of cmake around a stat call:

(gdb) bt
#0  0x00000000 in ?? ()
#1  0xb6a3fbd3 in stat64 (__statbuf=<optimized out>, __path=0xb6b472bb "/etc/gnutls/config") at /usr/include/i386-linux-gnu/sys/stat.h:455
#2  _gnutls_update_system_priorities () at ../../lib/priority.c:1309
#3  0xb6a534f5 in _gnutls_global_init (constructor=constructor@entry=1) at ../../lib/global.c:387
#4  0xb6a25950 in lib_init () at ../../lib/global.c:511
#5  0xb7f35f5c in call_init (l=<optimized out>, argc=argc@entry=6, argv=argv@entry=0xbfe33e64, env=0xbfe33e80) at dl-init.c:72
#6  0xb7f36062 in call_init (env=0xbfe33e80, argv=0xbfe33e64, argc=6, l=<optimized out>) at dl-init.c:30
#7  _dl_init (main_map=<optimized out>, argc=6, argv=0xbfe33e64, env=0xbfe33e80) at dl-init.c:119
#8  0xb7f270fa in _dl_start_user () from /lib/ld-linux.so.2
(gdb) frame 1
#1  0xb6a3fbd3 in stat64 (__statbuf=<optimized out>, __path=0xb6b472bb "/etc/gnutls/config") at /usr/include/i386-linux-gnu/sys/stat.h:455
455       return __xstat (_STAT_VER, __path, __statbuf);

Why did it end up with EIP=0 I don't know.

It seems there's some incompatibility between installwatch's LD_PRELOAD
and glibc.

Could you have a look at it?

Regards
    Jiri Palecek

Jiri,

Thanks for the report. In order to help me narrow this down are you able to provide a simple test case to reproduce the problem?

Thanks!

Stephen

Hello,

I don't know if it's simple, but here goes. In an empty directory:

$ touch CMakeLists.txt

$ cmake .

$ installwatch cmake .


The last line crashes on my system.

Regards

     Jiri Palecek

Perfect, thanks. I will take a look and see what I can do. I will warn
you that the original developer of checkinstall doesn't seem
interested in the project anymore so any fix will be limited to
anything I or any other Debian contributor can figure out so no
promises that this will be able to be fixed promptly.

Stephen

Dear Maintainer,
tried to have a look and it seems that installwatch.so's
initialize function was not yet called.

Attached are some details and a patch trying to call initialize
just before the call to true_xstat64.

Another patch would add a build-id to the shared object, so
the build process can create a debug symbol package.

Kind regards,
Bernhard


Location just before we end up with eip=0:
  (rr) reverse-stepi
  0xb7edd1d8 in __xstat64 (version=<optimized out>, pathname=<optimized out>, info=<optimized out>) at installwatch.c:3731
  3731                    result=true_xstat64(version,pathname,info);
  1: x/i $pc
  => 0xb7edd1d8 <__xstat64+88>:   jmp    *%eax

  (rr) print true_xstat64
  $1 = (int (*)(int, const char *, struct stat64 *)) 0x0

Actually the 0014-fix-xstat64.patch already tries to fix this, but
applies the fix too late in the function.  If it was reworked to move
the new code up ~10 lines (to before the "real" mode check), then it
would run before the code that's crashing.

We believe that the bug you reported is fixed in the latest version of
checkinstall, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 964458@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Stephen Gelman <ssgelm@debian.org> (supplier of updated checkinstall package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Fri, 07 Aug 2026 02:18:30 -0500
Source: checkinstall
Architecture: source
Version: 1.6.2+git20170426.d24a630-8
Distribution: unstable
Urgency: medium
Maintainer: Stephen Gelman <ssgelm@debian.org>
Changed-By: Stephen Gelman <ssgelm@debian.org>
Closes: 667606 805905 878117 964458 993498 1054601
Changes:
 checkinstall (1.6.2+git20170426.d24a630-8) unstable; urgency=medium
 .
   * Initialise from lstat64(), __lxstat64() and renameat2() as the other
     wrappers do. Reached before _init() runs, they called a NULL pointer and
     took the process down (Closes: #964458)
   * Wrap openat64(). Programs built for large files, which on 32-bit is most
     of them, created their output on the real filesystem (Closes: #1054601)
   * Wrap utimensat(), which set timestamps on the real path and stopped an
     install with "cp: preserving times ...: No such file or directory"
   * Wrap the 64-bit time entry points. A program built with _TIME_BITS=64
     calls __stat64_time64() rather than stat(), so on i386 nothing coreutils
     did to inspect a file was intercepted
   * Strip ELF objects that have no execute bit. A shared library installs
     0644, so --stripso had never stripped one
   * Apply --exclude to a path that is not on the build host. With filesystem
     translation the installed files are only in the translated tree, so the
     exclusion was silently ignored. Thanks Kostas Tamateas for diagnosing
     both of these (Closes: #667606)
   * Add the French translation. Thanks Damien and the debian-l10n-french
     team! It matches more of the current strings than any translation the
     package already carried (Closes: #805905)
   * Guess the package name from the source directory rather than from a
     build subdirectory, and keep a trailing field as the version only when it
     has a digit in it. cmake and meson builds produced packages called build,
     and gr-binviz produced gr version binviz (Closes: #878117)
   * Work out the shared library dependencies with dpkg-shlibdeps and record
     them, as a normally packaged program has. Packages built here had none
     unless typed by hand. Debian only, and --autodeps=no turns it off
     (Closes: #993498)
Checksums-Sha1:
 69d65d7cf65c6db7207d119ab4c3eb4dc9b46078 2208 checkinstall_1.6.2+git20170426.d24a630-8.dsc
 a8ce934a946649f6fd7d5a7bd117d6f0460c4570 43904 checkinstall_1.6.2+git20170426.d24a630-8.debian.tar.xz
 43f8f9baf45590fa41248aa13b1fabf7220a6609 6980 checkinstall_1.6.2+git20170426.d24a630-8_amd64.buildinfo
Checksums-Sha256:
 5e9675c501010c9a21527e9f7bfaee029c891e956a1b325493af37212405e865 2208 checkinstall_1.6.2+git20170426.d24a630-8.dsc
 0fb0ab247eb11999903417d12bf366f5829755967e92101aa526e04b0eafcabc 43904 checkinstall_1.6.2+git20170426.d24a630-8.debian.tar.xz
 64a72fd2db7d315efd9cf765f66abb147bc2d5b8e08225c0755cd9a5f2b8c7f3 6980 checkinstall_1.6.2+git20170426.d24a630-8_amd64.buildinfo
Files:
 7263556fd8b16fc87d2fabeb14554a5a 2208 admin optional checkinstall_1.6.2+git20170426.d24a630-8.dsc
 cf89b632a7d6aaede4d250c9b66c5ac8 43904 admin optional checkinstall_1.6.2+git20170426.d24a630-8.debian.tar.xz
 1f08f998dc65438dd26854afef9fd6f4 6980 admin optional checkinstall_1.6.2+git20170426.d24a630-8_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEC77u8GTpSr6EMli0dUHPqvw16s8FAmp1ipUSHHNzZ2VsbUBk
ZWJpYW4ub3JnAAoJEHVBz6r8NerP6uwP/10Mqcv1scexbvD428mQhWtjVyFo3Wi3
25mC22+uDCwernvv7cf2QCx/falR8BSJrk8U0Q3ympcfh6MrdopdwUs5V3gho+WJ
YRCqAGGJGTGx6Deve6rrN4RgQZ0p8pSJ8Yk55OehSgNMWY7NVyw1eavP+6XqESWB
uQ7SvA7T5+0PrBURe4BwKoigy9AvQa1kIByeUVfIWOZEn3vIn9SOIpEWEpcDJ0m3
YMub8oh52sr7NFe2DxIO1fqTMF9hYJIpaKA+rvd9p428CwF7l50Ywit3l0bGvhZM
CgBPWRWvk+6ccoNi3v2NkRqpF2ouDZfcA5r5UYazw/PihAzQYId4laPM+3ktZ8rg
xFSSlW7CE2WaQiZZdOfbVo6oXKCEw727catGFAoJzlB8iQRBpB6jrwwfoZkyYumE
wIZQ1MU5owDMA1h+dQIM52mVdIno2Q0Imj/AckeSE12Ey0RSgk3RZe8J+esHQ/bD
e1mnj/4LJPOz0Syy+xjO/gtFJfwZEE/HEdbLysgkipIVokal7L7YSdeQ9LrfzucR
Wi/wbvlHlSBpvVa4Ejxw/Oa8YkcoOvEk15BpFbNZdBBe0robWuEQqs1XN8Kbvs+F
RethNvWrZEyc6R6F8snaWkRi6fdNBzbvAunfhCHQGK9dkRN42aeFeViER4vGs+EI
mXj+ChjUQqUm
=tEZD
-----END PGP SIGNATURE-----