Debian Bug report logs - #881231
chasen-dictutils: writes uninitialized memory to .dat files

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: "Bernhard M. Wiedemann" <debianbugs@zq1.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: chasen-dictutils: writes uninitialized memory to .dat files

Date: Thu, 09 Nov 2017 05:49:05 +0100

[Message part 1 (text/plain, inline)]

Package: chasen-dictutils
Severity: wishlist
Tags: patch
User: reproducible-builds@lists.alioth.debian.org
Usertags: toolchain randomness ASLR padding

Dear Maintainer,

While working on the “reproducible builds” effort [1] for openSUSE,
we have noticed that ipadic could not be built reproducibly [2]
and the same is the case for Debian [3].

The attached patch initializes memory written to .dat files.
Once applied, ipadic can be built reproducibly in our current
experimental framework.

 [1]: https://wiki.debian.org/ReproducibleBuilds
 [2]: https://bugzilla.opensuse.org/show_bug.cgi?id=1067269
 [3]: https://tests.reproducible-builds.org/debian/rb-pkg/unstable/amd64/ipadic.html

[chasen-initialize-memory.patch (text/plain, attachment)]

Message #10 received at 881231@bugs.debian.org (full text, mbox, reply):

From: Vagrant Cascadian <vagrant@debian.org>

To: "Bernhard M. Wiedemann" <debianbugs@zq1.de>, 881231@bugs.debian.org

Subject: Re: Bug#881231: chasen-dictutils: writes uninitialized memory to .dat files

Date: Wed, 08 Nov 2017 23:12:32 -0800

[Message part 1 (text/plain, inline)]

On 2017-11-08, Bernhard M. Wiedemann wrote:
> While working on the “reproducible builds” effort [1] for openSUSE,
> we have noticed that ipadic could not be built reproducibly [2]
> and the same is the case for Debian [3].
>
> The attached patch initializes memory written to .dat files.
> Once applied, ipadic can be built reproducibly in our current
> experimental framework.

I can confirm that the patch fixed the issue when building on Debian
Stretch. I'm guessing sid or buster would work as well.

live well,
  vagrant

> Index: chasen-2.4.4/mkchadic/dumpdic.c
> ===================================================================
> --- chasen-2.4.4.orig/mkchadic/dumpdic.c
> +++ chasen-2.4.4/mkchadic/dumpdic.c
> @@ -45,6 +45,7 @@ dump_dat(lexicon_t *lex, FILE *datfile,
>      long index;
>      da_dat_t dat;
>  
> +    memset(&dat, 0, sizeof(dat));
>      index = ftell(datfile);
>      dat.stem_len = lex->stem_len;
>      dat.reading_len = lex->reading_len;
> @@ -137,6 +138,7 @@ dump_dic(lexicon_t *entries, FILE *outpu
>      da_lex_t lex;
>      long compound = NO_COMPOUND;
>  
> +    memset(&lex, 0, sizeof(lex));
>      if (entries[1].pos)
>  	compound = dump_compound(entries, lexfile, datfile);

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 881231@bugs.debian.org (full text, mbox, reply):

From: NOKUBI Takatsugu <knok@daionet.gr.jp>

To: Vagrant Cascadian <vagrant@debian.org>, 881231@bugs.debian.org

Cc: "Bernhard M. Wiedemann" <debianbugs@zq1.de>

Subject: Re: [Pkg-nlp-ja-devel] Bug#881231: chasen-dictutils: writes uninitialized memory to .dat files

Date: Fri, 10 Nov 2017 07:32:52 +0900

On Thu, 09 Nov 2017 16:12:32 +0900,
Vagrant Cascadian wrote:
> > The attached patch initializes memory written to .dat files.
> > Once applied, ipadic can be built reproducibly in our current
> > experimental framework.
> 
> I can confirm that the patch fixed the issue when building on Debian
> Stretch. I'm guessing sid or buster would work as well.

I'll apply the patch.

Message #20 received at 881231-close@bugs.debian.org (full text, mbox, reply):

From: NOKUBI Takatsugu <knok@daionet.gr.jp>

To: 881231-close@bugs.debian.org

Subject: Bug#881231: fixed in chasen 2.4.5-39

Date: Fri, 10 Nov 2017 06:51:01 +0000

Source: chasen
Source-Version: 2.4.5-39

We believe that the bug you reported is fixed in the latest version of
chasen, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 881231@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
NOKUBI Takatsugu <knok@daionet.gr.jp> (supplier of updated chasen package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 10 Nov 2017 15:13:44 +0900
Source: chasen
Binary: libchasen-dev libchasen2 chasen chasen-dictutils
Architecture: source amd64
Version: 2.4.5-39
Distribution: unstable
Urgency: medium
Maintainer: "Natural Language Processing, Japanese" <pkg-nlp-ja-devel@lists.alioth.debian.org>
Changed-By: NOKUBI Takatsugu <knok@daionet.gr.jp>
Description:
 chasen     - Japanese Morphological Analysis System
 chasen-dictutils - Japanese Morphological Analysis System - utilities for dictionary
 libchasen-dev - Japanese Morphological Analysis System (libraries and headers)
 libchasen2 - Japanese Morphological Analysis System (shared libraries)
Closes: 881231
Changes:
 chasen (2.4.5-39) unstable; urgency=medium
 .
   * d/p/chasen-initialize-memory.patch: Add, closes: #881231
   * debian/watch: New URL.
Checksums-Sha1:
 43d3399d265d7e4a8c5b20ca4a58a05bf9c4c5ea 2190 chasen_2.4.5-39.dsc
 a6d5c61b97778884a38a300daea34899a3e79605 11980 chasen_2.4.5-39.debian.tar.xz
 1a250936d834b9d80f75abf270bd29be6528707b 6352 chasen-dbgsym_2.4.5-39_amd64.deb
 57c769835d793eab053219cf0aa191a53a21e9fe 28636 chasen-dictutils-dbgsym_2.4.5-39_amd64.deb
 a066c3efbec4741118114e64fb0bd4a60af45f05 26720 chasen-dictutils_2.4.5-39_amd64.deb
 9c71b25058a48a7deeaca46f21701931d266c4e0 7043 chasen_2.4.5-39_amd64.buildinfo
 9e55b58dd3971494ec73a786f380c8fff350a70f 447816 chasen_2.4.5-39_amd64.deb
 f6f01b6cf35f1f9399cf24666a96a292f5d14d0e 55660 libchasen-dev_2.4.5-39_amd64.deb
 da45d4cfc0db85f03946fd2441c34d02e0993912 142412 libchasen2-dbgsym_2.4.5-39_amd64.deb
 aedc1b9cc405744d3469a824ea62448ce9efd71c 52120 libchasen2_2.4.5-39_amd64.deb
Checksums-Sha256:
 a0dae903ac4b82439dadc3eea908ecfcf3362f84c32a5599babf067ac6387b11 2190 chasen_2.4.5-39.dsc
 bdb6d578708e89f24a9236f5302eca0bac6fb4738659fa85789a1eede7eca548 11980 chasen_2.4.5-39.debian.tar.xz
 378e36e41f184d44cca536e6a9df09fcab4b4deefa33c7fd6e888279d24fe89c 6352 chasen-dbgsym_2.4.5-39_amd64.deb
 f5b2d963d413564b6495138be99eccd61c6941150cdae68cd5f6a3f3ce9e1244 28636 chasen-dictutils-dbgsym_2.4.5-39_amd64.deb
 685977ee08183f26a5ebdbae5291a1ee16dad815c7b74493135cf4372be4be3a 26720 chasen-dictutils_2.4.5-39_amd64.deb
 acbd0d669d6b40ad50a1b1be8f3f772d5e16256aed3f87e51bec0357533cec6e 7043 chasen_2.4.5-39_amd64.buildinfo
 b0c12a6f727483f237ec52625ded2fc27747bcd01c105f20c7a7360b09a927f6 447816 chasen_2.4.5-39_amd64.deb
 0e27e19413b6523081b60cdd78e09044907b1eb77196207922d3308e512cc53d 55660 libchasen-dev_2.4.5-39_amd64.deb
 343eaed90578680b4d9bc50d02cd5338f30aa63b144338eab35b3b3444d3d48d 142412 libchasen2-dbgsym_2.4.5-39_amd64.deb
 9477587b08a5c7aeffd6c823e7a829316f2aa09de62b47eba707acffeee8b556 52120 libchasen2_2.4.5-39_amd64.deb
Files:
 4a1dd3cf39d6337eb7d7a59f7b8dc740 2190 misc optional chasen_2.4.5-39.dsc
 31d664ad0d9f19d58630d14a5358919b 11980 misc optional chasen_2.4.5-39.debian.tar.xz
 d8dffaa1ad52156ab94c9a1cc75a3663 6352 debug optional chasen-dbgsym_2.4.5-39_amd64.deb
 a8cb04e2510457f4727fc66c8c5a3436 28636 debug optional chasen-dictutils-dbgsym_2.4.5-39_amd64.deb
 3a669a18587c35439cd131520ca01111 26720 misc optional chasen-dictutils_2.4.5-39_amd64.deb
 984ab2b74774b262dbac95d8bea15986 7043 misc optional chasen_2.4.5-39_amd64.buildinfo
 dddd5993e197cd206a6b134a2fab8b63 447816 misc optional chasen_2.4.5-39_amd64.deb
 667fde6e94fffc6674d1e3e213f87af9 55660 libdevel optional libchasen-dev_2.4.5-39_amd64.deb
 d839b5a7a0371780eee1ecd85a9bf81b 142412 debug optional libchasen2-dbgsym_2.4.5-39_amd64.deb
 b32b6105eeb2796ab1d8789cd09c5984 52120 libs optional libchasen2_2.4.5-39_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQJHBAEBCAAxFiEEmUUrTdKL7qyKtckxsGZi7JwMFAQFAloFRwETHGtub2tAZGFp
b25ldC5nci5qcAAKCRCwZmLsnAwUBOQXD/46+JKd/HcyGuO93xwksp71gpz03H7y
oTpVn79es9R1O/NwdfY+byjmJQ3gzgTiIUlTXYn8PPVeOTuqoVY4mI3ypVwX7pnG
5LADI28Jn2/p0fvwuR5l3jKHrxsuZIpnRGKlmcrY6MX7sW9XtAuZbCWwemrPbQOR
Xaj2MwA9LjTBc6zEQVZPVYQ7lYbFWBDSeaMkJWH6lLUl+tZAN+Al3rE6rDqSYn2o
0iQhsPnLskQdg939gx1akYcKqTj8AJv5gwRHan2AZPe2d7kMg1p2uOv5rMb3zWqt
gKbP3jx0Qt5lHLjLw2CluYMOzbdIetbiblyKm1wYGAgh9/FenB/s4ge+4sqXd6i4
0le/NSahnI+bH1RtZ4Qq9/wmq51ZQHm+clGU8GwUk8+vKOfKlzIp/yMogfn9X9da
J/4l9CeyrV2ZCkK7X+i70tlK/6L6jKAsEHk7pSLaxcFHvNz5JOQg+3w5ENlrBxjp
QCYwnMbVRf9Yxi2yCnY728P/B5mLL55R2OyCTXgcm01oCfqsqKylmGo3ThI2i3BN
zsy/9VXqahKNlRL/C6pQ7z7JcLrvrvzfzUOlOyDmvTCe7J1fwhKdwpl1uyaPBCYB
SJgLy/+XYIZDWVI8L4/xYfXbrKCQc3ZIhYXZn7R/gGLwUKFtEgCi02hr8pO1aodr
rEtl/RJt15OCLw==
=lVgs
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.