Bug#1043332: gcr-ssh-agent crashes when trying to use it

[Sandelinos]

Package: gcr
Version: 3.41.1-3
Severity: important
X-Debbugs-Cc: deb...@sandelinos.me

Dear Maintainer,

gcr-ssh-agent crashes trying to use it.

I use Sway as the desktop on my system and wanted to use an ssh-agent to store
my keys. gnome-keyring's ssh-agent only runs on Gnome by default, while gcr-
ssh-agent.service seems to be running by default everywhere so it seems that is
the one I want to use. However when I add my key to the agent and try to ssh
into a server the agent crashes.

Steps to reproduce:
$ ssh-keygen
$ ssh-copy-id user@server
$ SSH_AUTH_SOCK=/run/user/1000/gcr/ssh ssh-add ~/.ssh/id_rsa
$ SSH_AUTH_SOCK=/run/user/1000/gcr/ssh ssh user@server # gcr-ssh-agent crashes

Log:
user@debian12:~$ journalctl --user -f -u gcr-ssh-agent.service
Aug 08 15:20:48 debian12 systemd[1163]: Started gcr-ssh-agent.service - GCR
ssh-agent wrapper.
Aug 08 16:06:49 debian12 systemd[1163]: gcr-ssh-agent.service: Main process
exited, code=killed, status=11/SEGV
Aug 08 16:06:49 debian12 systemd[1163]: gcr-ssh-agent.service: Failed with
result 'signal'.
Aug 08 16:06:50 debian12 systemd[1163]: gcr-ssh-agent.service: Scheduled
restart job, restart counter is at 1.
Aug 08 16:06:50 debian12 systemd[1163]: Stopped gcr-ssh-agent.service - GCR
ssh-agent wrapper.
Aug 08 16:06:50 debian12 systemd[1163]: Started gcr-ssh-agent.service - GCR
ssh-agent wrapper.

First encountered on a bookworm system with Sway desktop. Then tested on a
fresh bookworm install with Gnome and on trixie with Gnome (the system I'm
reporting from). The behaviour is the same everywhere.


-- System Information:
Debian Release: trixie/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 6.4.0-1-amd64 (SMP w/2 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages gcr depends on:
ii dbus-user-session [default-dbus-session-bus] 1.14.8-2
ii dconf-gsettings-backend [gsettings-backend] 0.40.0-4
ii init-system-helpers 1.65.2
ii libc6 2.37-6
ii libgck-1-0 3.41.1-3
ii libgcr-base-3-1 3.41.1-3
ii libgcr-ui-3-1 3.41.1-3
ii libglib2.0-0 2.77.1-2
ii libgtk-3-0 3.24.38-2
ii libsecret-1-0 0.20.5-3
ii libsystemd0 254-1

gcr recommends no packages.

gcr suggests no packages.

-- no debconf information

[Рустам Заитов]

Dear maintainer of gcr package,

I also have been caught by this crash of gcr-ssh-agent. I strongly believe that this issue is attributed to gnome's gcr-ssh-agent. This issue has already been fixed upstream. In the following I am going to provide arguments to support my conclusion.  

I can reproduce this issue when I try to test ssh connection:

```

# test rig
$ export SSH_AUTH_SOCK=/run/user/1000/gcr/ssh
$ ssh -T g...@github.com

# crash confirmation

$ journalctl --no-pager -f

Jan 15 08:42:07 pc-debian systemd[629]: gcr-ssh-agent.service: Main process exited, code=killed, status=11/SEGV
Jan 15 08:42:07 pc-debian systemd[629]: gcr-ssh-agent.service: Failed with result 'signal'.
Jan 15 08:42:08 pc-debian systemd[629]: gcr-ssh-agent.service: Scheduled restart job, restart counter is at 1.
Jan 15 08:42:08 pc-debian systemd[629]: Stopped gcr-ssh-agent.service - GCR ssh-agent wrapper.
Jan 15 08:42:08 pc-debian systemd[629]: Started gcr-ssh-agent.service - GCR ssh-agent wrapper.

```

I decided to attach a dbg to the running service in order to find the cause of the problem.

```

$ export DEBUGINFOD_URLS="https://debuginfod.debian.net"
$ gdb  /usr/libexec/gcr-ssh-agent -p <pid_of_gcr-ssh-agent>

GNU gdb (Debian 13.1-3) 13.1
...
This GDB supports auto-downloading debuginfo from the following URLs:
  <https://debuginfod.debian.net>
Enable debuginfod for this session? (y or [n]) y
Debuginfod has been enabled.
...
(gdb) set pagination 0
(gdb) run /run/user/1000/gcr/
Starting program: /usr/libexec/gcr-ssh-agent /run/user/1000/gcr/
Downloading separate debug info for system-supplied DSO at 0x7ffff7fc9000
...
[New Thread 0x7ffff71f66c0 (LWP 2330)]
[New Thread 0x7ffff69f56c0 (LWP 2366)]
[Detaching after fork from child process 2367]

Thread 3 "pool" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7ffff69f56c0 (LWP 2366)]
0x00007ffff7e5ffc0 in ascii_table_data () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
(gdb) bt
#0  0x00007ffff7e5ffc0 in ascii_table_data () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#1  0x000055555555b25a in handle_request
    (error=0x7ffff69f4718, cancellable=0x555555574620 [GCancellable], resp=0x7ffff69f4750, req=0x7ffff69f4720, connection=0x7fffe8006450 [GUnixConnection], self=0x555555566b60 [GcrSshAgentService])
    at ../gcr/gcr-ssh-agent-service.c:197
#2  on_run (service=<optimized out>, connection=connection@entry=0x5555555814f0 [GUnixConnection], source_object=source_object@entry=0x0, user_data=user_data@entry=0x555555566b60)
    at ../gcr/gcr-ssh-agent-service.c:326
#3  0x00007ffff7bea19e in _g_cclosure_marshal_BOOLEAN__OBJECT_OBJECTv
    (closure=0x555555580660, return_value=0x7ffff69f4940, instance=<optimized out>, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x55555557c4c0)
    at ../../../gio/gmarshal-internal.c:335
#4  0x00007ffff7d5d5a9 in _g_closure_invoke_va
    (closure=closure@entry=0x555555580660, return_value=return_value@entry=0x7ffff69f4940, instance=instance@entry=0x5555555775d0, args=args@entry=0x7ffff69f4a10, n_params=2, param_types=0x55555557c4c0)
    at ../../../gobject/gclosure.c:895
#5  0x00007ffff7d7605e in g_signal_emit_valist (instance=0x5555555775d0, signal_id=8, detail=<optimized out>, var_args=var_args@entry=0x7ffff69f4a10) at ../../../gobject/gsignal.c:3456
#6  0x00007ffff7d76dbf in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=detail@entry=0) at ../../../gobject/gsignal.c:3606
#7  0x00007ffff7c1c71d in g_threaded_socket_service_func (job_data=0x555555576400, user_data=<optimized out>) at ../../../gio/gthreadedsocketservice.c:98
#8  0x00007ffff7e256ca in g_thread_pool_thread_proxy (data=<optimized out>) at ../../../glib/gthreadpool.c:352
#9  0x00007ffff7e24cfd in g_thread_proxy (data=0x5555555671e0) at ../../../glib/gthread.c:831
#10 0x00007ffff78dd044 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#11 0x00007ffff795d61c in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
(gdb) Quit
(gdb)

```

This have lead me to the source code of gcr-ssh-agent-service.c at line 197

https://gitlab.gnome.org/GNOME/gcr/-/blob/gcr-3-41/gcr/gcr-ssh-agent-service.c?ref_type=heads#L191

According to backtrace the crash appears at line 197, but there is an `if` branch above with wrong comparison `op <= GCR_SSH_OP_MAX` should be `op < GCR_SSH_OP_MAX`. I was ready to report a bug report to gcr project when I suddenly found that this issue has been fixed already:

https://gitlab.gnome.org/GNOME/gnome-keyring/-/merge_requests/47/diffs

I built the gcr-ssh-agent from the 4.2.0 branch and I can confirm that the issue is resolved with the new binary.

I guess it might be possible to apply this patch to the gcr debian package also in order to publish a new version of the package. 

---

Rustam