appstreamcli: double free or corruption with certain metadata

The attachment "appstream_dfoc-debbug822317-patch.debdiff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

I uploaded the fix, hopefully the SRU team will accept it - a reproducer will help

It's really hard to reproduce, likely depends on the individual machine.

In theory, this should trigger the bug:

* Add the Debian Sid sources to /etc/apt/sources.list (deb ftp://ftp.debian.org/debian/ stretch main)
* Disable Ubuntu main/universe in sources.list (to prevent ID collisions from shadowing the bug)
* Run "sudo rm /var/lib/apt/lists/*Components*" to ensure the caches are clean
* Run "sudo apt update"
* Observe crash
* Run "sudo appstreamcli refresh --force --verbose"
* Observe crash (if it didn't happen already)
* Reset everything back to the previous state

It sometimes works (as in: you see the crash), many times it doesn't work... Yeah, it's that kind of bug :-/ The users seem to be much better at triggering it than I am :-D

I updated the patch to also include a fix for LP: #1579712

Hello Matthias, or anyone else affected,

Accepted appstream into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/appstream/0.9.4-1ubuntu1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

I didn't have that crash.

This bug was fixed in the package appstream - 0.9.4-1ubuntu1

---------------
appstream (0.9.4-1ubuntu1) xenial; urgency=medium

  * iconfinding-refactor.patch: Fix double-free corruption which
    happens with certain metadata. (LP: #1574896)
  * fix-decompression.patch: Fix hang when refreshing the metadata
    cache. (LP: #1579712)

 -- Matthias Klumpp <email address hidden> Tue, 26 Apr 2016 10:18:14 +0200

The verification of the Stable Release Update for appstream has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.