[Bug 1579712] Re: Refresh hangs indefinitely, appstreamcli using 100% CPU

[Neil Mayhew]

The simplest workaround seems to be to use Ctrl-C when apt update hangs
at the end. It's already done most of the work, and this just aborts the
running of appstreamcli at the end. You can then go ahead and update any
binary packages built from the appstream source package (ie any of
appstream appstream-doc appstream-index gir1.2-appstream libappstream-
dev libappstream3 libappstreamqt-dev libappstreamqt1 that are already
installed). The use of appstreamcli in the postinst shouldn't hang
because the new versions of appstreamcli and libappstream.so.3 will
already be in place.

However, using Ctrl-C is possible only when using the command line. I'm
not sure what happens if someone is using Synaptic or Gnome Software. I
assume it would be necessary to use System Monitor to kill off
appstreamcli. I'm concerned that we could see breakage in a very large
number of Xenial installations, all of which would require manual
intervention to get them unstuck.

The fact that this is happening now, when it hasn't been reported in the
past 3 years, must be due to a subtle change in the execution
environment, maybe due to updates in other shared libraries that
appstreamcli uses. The problem is a result of reading uninitialized
memory, and in the past it must have been pure luck that the memory
always contained zeroes.

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors Team, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/1579712

Title:
  Refresh hangs indefinitely, appstreamcli using 100% CPU

Status in appstream package in Ubuntu:
  Fix Released
Status in appstream source package in Xenial:
  Fix Committed

Bug description:
  [Impact]

   * The cache refresh is blocked on a strdup on a non-NULL-terminated string in some very rare occasions (very rare because this bug is present for almost 3y without a single report).
   * Fixing this bug resolves the issue for people who might experience it.
   * See https://github.com/ximion/appstream/issues/35 for details.

  [Test Case 1]

   * Run `sudo appstreamcli refresh --force`
   * The AppStream cache should be updated, no change in behavior should be seen.

  [Test Case 2]

   * In case you were experiencing the almost-infinite hang when running
  `sudo appstreamcli refresh --force`, this issue should be fixed with
  the SRU.

  [Regression Potential]

   * Very low, since this only fixes the decompression code. There
  should be no sideeffects of that (given that the patch itself doesn't
  break anything, which it shouldn't, since it has been tested upstream
  for a while)

  [Other Info]

   * This fix has been applied upstream: https://github.com/ximion/appstream/commit/f33c520c37e2ba51d92402220250b8d501a2bf43
   * A smaller version of the patch (one-liner) is available, at the expense of not having reduced memory usage: https://github.com/ximion/appstream/commit/378941787d3584b3eb31a6ebe40e0aacc10e180a

  ####

  /!\ Installing the bugfix from xenial-proposed, without going through APT:
  To install the fixed packages manually, please execute the following commands (for amd64, adjust URLs for other architectures):

  ```
  cd /tmp && mkdir asfix
  cd asfix
  wget https://launchpad.net/ubuntu/+archive/primary/+files/appstream_0.9.4-1ubuntu1_amd64.deb
  wget https://launchpad.net/ubuntu/+archive/primary/+files/libappstream3_0.9.4-1ubuntu1_amd64.deb
  sudo dpkg -i libappstream3*.deb
  sudo dpkg -i appstream*.deb
  ```

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/appstream/+bug/1579712/+subscriptions