RSS Feeds cause SIGSEGV

[gshearer]

Is there already an issue for your problem?

• I have checked older issues, open and closed

NZBGet Version

v24.9-testing

Platform

Linux/Docker

Environment

Archlinux latest kernel latest updates x86_64.

I've been using nzbget for... heck, a decade at least. I've been using the new nzbget.com version since you folks took over. No problems. But as of a few days ago, my RSS feeds started causing SIGSEGV immediately upon starting nzbget.

I've confirmed via strace that the SIGSEGV happens shortly after it opens the just downloaded feed. Looks like the code for Feed processing hasn't changed in a couple of years, so maybe this is a bug in a library you're using and maybe it got recently updated. 

I used xmllint to validate the XML file, I get this:
$ xmllint --noout --valid feed-1.tmp 
feed-1.tmp:3: validity error : Validation failed: no DTD found !
org/2005/Atom" xmlns:newznab="http://www.newznab.com/DTD/2010/feeds/attributes/"

Even if thats the cause (no DTD?) .. I don't think nzbget should SIGSEGV, so its probably a really old bug somewhere in the feed processing code.

This is this is the strace:

[pid 207674] futex(0x79e5cbcf696c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
[pid 207674] newfstatat(AT_FDCWD, "/mnt/scratch/nzbget/temp/feed-1.tmp", {st_mode=S_IFREG|0644, st_size=193922, ...}, 0) = 0
[pid 207674] openat(AT_FDCWD, "/mnt/scratch/nzbget/temp/feed-1.tmp", O_RDONLY) = 5
[pid 207674] lseek(5, 0, SEEK_CUR)      = 0
[pid 207674] dup(5)                     = 7
[pid 207674] lseek(7, 0, SEEK_CUR)      = 0
[pid 207674] read(7, "\r\n\r\n<rss version=\"2.0\" xmlns:ato"..., 8192) = 8192
[pid 207674] lseek(5, 0, SEEK_SET)      = 0
[pid 207674] close(7)                   = 0
[pid 207674] lseek(5, 0, SEEK_CUR)      = 0
[pid 207674] dup(5)                     = 7
[pid 207674] lseek(7, 0, SEEK_CUR)      = 0
[pid 207674] read(7, "\r\n\r\n<rss version=\"2.0\" xmlns:ato"..., 8192) = 8192
[pid 207674] lseek(5, 0, SEEK_SET)      = 0
[pid 207674] close(7)                   = 0
[pid 207674] dup(5)                     = 7
[pid 207674] close(5)                   = 0
[pid 207674] read(7, "\r\n\r\n<rss version=\"2.0\" xmlns:ato"..., 4000) = 4000
[pid 207674] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 207664] <... futex resumed>)       = ?
[pid 207673] <... futex resumed>)       = ?
[pid 207672] <... futex resumed>)       = ?
[pid 207671] <... futex resumed>)       = ?
[pid 207670] <... futex resumed>)       = ?
[pid 207669] <... futex resumed>)       = ?
[pid 207668] <... futex resumed>)       = ?
[pid 207667] <... clock_nanosleep resumed> <unfinished ...>) = ?
[pid 207666] <... accept resumed>)      = ?
[pid 207674] +++ killed by SIGSEGV (core dumped) +++
[pid 207673] +++ killed by SIGSEGV (core dumped) +++
[pid 207672] +++ killed by SIGSEGV (core dumped) +++
[pid 207671] +++ killed by SIGSEGV (core dumped) +++
[pid 207670] +++ killed by SIGSEGV (core dumped) +++
[pid 207669] +++ killed by SIGSEGV (core dumped) +++
[pid 207668] +++ killed by SIGSEGV (core dumped) +++
[pid 207667] +++ killed by SIGSEGV (core dumped) +++
[pid 207666] +++ killed by SIGSEGV (core dumped) +++
+++ killed by SIGSEGV (core dumped) +++

Current Behavior

Segmentation fault when attempting to use any RSS feed

Expected Behavior

No SIGSEGV :)

Steps To Reproduce

No response

Logs

No response

Extra information

No response

[gshearer]

I've been using nzbget for... heck, a decade at least. I've been using the new nzbget.com version since you folks took over. No problems. But as of a few days ago, my RSS feeds started causing SIGSEGV immediately upon starting nzbget.

I've confirmed via strace that the SIGSEGV happens shortly after it opens the just downloaded feed. Looks like the code for Feed processing hasn't changed in a couple of years, so maybe this is a bug in a library you're using and maybe it got recently updated.

I used xmllint to validate the XML file, I get this:
$ xmllint --noout --valid feed-1.tmp
feed-1.tmp:3: validity error : Validation failed: no DTD found !
org/2005/Atom" xmlns:newznab="http://www.newznab.com/DTD/2010/feeds/attributes/"

Even if thats the cause (no DTD?) .. I don't think nzbget should SIGSEGV, so its probably a really old bug somewhere in the feed processing code.

This is this is the strace:

[pid 207674] futex(0x79e5cbcf696c, FUTEX_WAKE_PRIVATE, 2147483647) = 0
[pid 207674] newfstatat(AT_FDCWD, "/mnt/scratch/nzbget/temp/feed-1.tmp", {st_mode=S_IFREG|0644, st_size=193922, ...}, 0) = 0
[pid 207674] openat(AT_FDCWD, "/mnt/scratch/nzbget/temp/feed-1.tmp", O_RDONLY) = 5
[pid 207674] lseek(5, 0, SEEK_CUR) = 0
[pid 207674] dup(5) = 7
[pid 207674] lseek(7, 0, SEEK_CUR) = 0
[pid 207674] read(7, "\r\n\r\n<rss version="2.0" xmlns:ato"..., 8192) = 8192
[pid 207674] lseek(5, 0, SEEK_SET) = 0
[pid 207674] close(7) = 0
[pid 207674] lseek(5, 0, SEEK_CUR) = 0
[pid 207674] dup(5) = 7
[pid 207674] lseek(7, 0, SEEK_CUR) = 0
[pid 207674] read(7, "\r\n\r\n<rss version="2.0" xmlns:ato"..., 8192) = 8192
[pid 207674] lseek(5, 0, SEEK_SET) = 0
[pid 207674] close(7) = 0
[pid 207674] dup(5) = 7
[pid 207674] close(5) = 0
[pid 207674] read(7, "\r\n\r\n<rss version="2.0" xmlns:ato"..., 4000) = 4000
[pid 207674] --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=NULL} ---
[pid 207664] <... futex resumed>) = ?
[pid 207673] <... futex resumed>) = ?
[pid 207672] <... futex resumed>) = ?
[pid 207671] <... futex resumed>) = ?
[pid 207670] <... futex resumed>) = ?
[pid 207669] <... futex resumed>) = ?
[pid 207668] <... futex resumed>) = ?
[pid 207667] <... clock_nanosleep resumed> <unfinished ...>) = ?
[pid 207666] <... accept resumed>) = ?
[pid 207674] +++ killed by SIGSEGV (core dumped) +++
[pid 207673] +++ killed by SIGSEGV (core dumped) +++
[pid 207672] +++ killed by SIGSEGV (core dumped) +++
[pid 207671] +++ killed by SIGSEGV (core dumped) +++
[pid 207670] +++ killed by SIGSEGV (core dumped) +++
[pid 207669] +++ killed by SIGSEGV (core dumped) +++
[pid 207668] +++ killed by SIGSEGV (core dumped) +++
[pid 207667] +++ killed by SIGSEGV (core dumped) +++
[pid 207666] +++ killed by SIGSEGV (core dumped) +++
+++ killed by SIGSEGV (core dumped) +++

[dnzbk]

I'll take a look. Thanks for the report.

[gshearer]

Thanks dnzbk --- I suspect the problem is in FeedFile.cpp. I've attached an example RSS feed file hopefully to assist your troubleshooting.

[gshearer]

I have confirmed the SIGSEGV happens at this line in FeedFile.CPP:

WebUtil::XmlStripTags(description);

In fact, all of the WebUtil functions that happen within the if (!strcmp("description", name) && m_feedItemInfo) code block will cause the SIGSEGV.

Commenting them out as such makes nzbget work:
//WebUtil::XmlStripTags(description);
//WebUtil::XmlDecode(description);
//WebUtil::XmlRemoveEntities(description);
//m_feedItemInfo->SetDescription(description);

Clearly, that's not the right fix, but I don't know enough about this code or WebUtil to determine the root cause. I assume something is wrong with "description".. it is not NULL however

[dnzbk]

Thanks, this is helpful. I’ll look into this asap.

[dnzbk]

Unfortunately, I couldn’t reproduce the segmentation faults you reported. I've only observed errors like:
Error parsing rss feed ...

I’ve submitted a PR with several improvements. These changes should prevent potential undefined behavior (UB) and segfaults. I hope they resolve the problem you’re experiencing.

[gshearer]

I'm using archlinux and I've updated to nzbget 25.0 just now, the SIGSEGV still happens. Did you try to make your test version load the XML file I provided as an example? It should crash with that file. Note that I've been using the same provider for years and this problem only just started happening. It's possible that they've changed something about the feed that is making nzbget crash, but it should handle the crash better. The XML is also syntax checked xmllint.

My own binary is still running fine, and all I did was comment out the calls as noted above.

The provider I use is very popular, I can't be the only one having this problem.

[dnzbk]

Could you please try running version 25.1-testing? There isn’t a fix in v25.0.
As I mentioned before, I haven’t been able to reproduce any segmentation faults. I’ve only encountered parsing errors.
Could your settings be causing this? Do you use filters or feed scripts?
Could you send me your nzbget.conf file? Without any sensitive info, of course.
denis@nzbget.com

[gshearer]

Hello -- sorry I've been out of town, but I'll test 25.1-testing this weekend and provide example configs. Thank you.

[gshearer]

Hello dnzbk -- just reporting in. So far 25.1-git has not crashed :-) I'll follow up in a few more days.

[gshearer]

Hello again dnzbk -- It appears the bug is fixed! Thank you.

[dnzbk]

Hello @gshearer ,
Thank you for confirming that it works. So, I’m closing this issue now.