Bug 121429 - Missing NSS libs in the chroot cause loolforkit to segfault on PDF export
Summary: Missing NSS libs in the chroot cause loolforkit to segfault on PDF export
Status: RESOLVED FIXED
Alias: None
Product: LibreOffice Online
Classification: Unclassified
Component: LibreOffice (show other bugs)
Version:
(earliest affected)
unspecified
Hardware: x86-64 (AMD64) Linux (All)
: medium normal
Assignee: Andras Timar
URL:
Whiteboard: target:6.3.0 target:6.2.0.1 target:6....
Keywords:
Depends on:
Blocks:
 
Reported: 2018-11-15 05:44 UTC by guilhem
Modified: 2020-01-30 16:33 UTC (History)
1 user (show)

See Also:
Crash report or crash signature:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description guilhem 2018-11-15 05:44:13 UTC
On Debian systems, extra libraries have to be copied to the systemplate chroot, namely /usr/lib/$TRIPLET/nss/*.so and /usr/lib/$TRIPLET/libsqlite3.so.* (where $TRIPLET is the architecture triplet, typically "x86_64-linux-gnu").

These libraries don't show up in `ldd /path/to/xpdfimport`, but omitting them in the chroot (partially) breaks NSS.  In particular, exporting a document to PDF, either directly in LOOL or using its API with `curl -F data=@/path/to/doc.odt http://127.0.0.1:9980/lool/convert-to/pdf`, causes loolforkit to segfault.  AFAICT from a debug trace, this is because the PDF writer calls ::comphelper::Hash which in turns triggers a null pointer dereference in libnss's HASH_Begin.

Making loolwsd-systemplate-setup copy these libraries to the chroot fixed the PDF export issue on our instance.  The problem might be Debian-specific as RedHat-based distros don't have that "nss" sub-directory (instead libfreebl3.so and friends are copied directly in /lib; not sure if on these systems the chroot has a crippled libnss or not).

System info: LOOLWSD 6.1.3, LOKit 6.1.3.2
Comment 1 Andras Timar 2018-11-21 13:14:58 UTC
What Debian system is that? One of my LibreOffice Online servers is a Debian 9 and it does not have /usr/lib/x86_64-linux-gnu/nss/. I tried to export PDF and it worked.
Comment 2 guilhem 2018-11-21 13:48:10 UTC
Debian 9.6 (codename Stretch), packaged LibreOffice and LOKit from stretch-backports (1:6.1.3-1~bpo9+2).

/usr/lib/x86_64-linux-gnu/nss/*.so are owned by libnss3 2:3.26.2-1.1+deb9u1.

    $ dpkg -S /usr/lib/x86_64-linux-gnu/nss/*.so
    libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libfreebl3.so
    libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libfreeblpriv3.so
    libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libnssckbi.so
    libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libnssdbm3.so
    libnss3:amd64: /usr/lib/x86_64-linux-gnu/nss/libsoftokn3.so

The directory is installed on all releases since jessie (on amd64 at least, didn't check other archs):

    https://packages.debian.org/jessie/amd64/libnss3/filelist
    https://packages.debian.org/stretch/amd64/libnss3/filelist
    https://packages.debian.org/buster/amd64/libnss3/filelist
    https://packages.debian.org/sid/amd64/libnss3/filelist

libnss3 is "Priority: optional" so you might not have it installed, but the libreoffice-* packages depend on it.

    $ apt-cache rdepends libnss3 | grep libreoffice
      libreoffice-sdbc-postgresql
      libreoffice-core
      libreoffice-sdbc-postgresql
      libreoffice-core
Comment 3 guilhem 2018-11-21 13:51:09 UTC
Even if only users of the official Debian packages from stretch backports are affected, I guess it doesn't hurt to try to copy these into the chroot.  (The script looks for stuff that doesn't exist on my system already.)
Comment 4 guilhem 2018-11-21 14:20:56 UTC
I indeed forgot to mention in the original report that we were using the LibreOffice packages from stretch-backports, sorry.  I guess you're using something else on your Debian 9 system?  Which perhaps uses OpenSSL's EVP not NSS to calculate the PDF digest?
Comment 5 Andras Timar 2018-11-21 14:43:42 UTC
OK, so the bug occurs when LibreOffice is built with system NSS.
Comment 6 Commit Notification 2018-11-21 21:00:25 UTC
Andras Timar committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/online/+/9606c29d64bc7526a4a65848613b8ee288936ed2%5E%21

tdf#121429 PDF writing needs NSS libs in systemplate
Comment 7 Commit Notification 2018-11-22 13:55:36 UTC
Andras Timar committed a patch related to this issue.
It has been pushed to "master":

https://git.libreoffice.org/online/+/052c033e920cf6906a9e0c9b27381b2ae234f231%5E%21

tdf#121429 PDF writing needs NSS libs in systemplate (2)
Comment 8 Commit Notification 2018-11-22 15:40:28 UTC
Andras Timar committed a patch related to this issue.
It has been pushed to "libreoffice-6-2":

https://git.libreoffice.org/online/+/b58c2b75f516f39fdf6ba9a63227836415c6bcf9%5E%21

tdf#121429 PDF writing needs NSS libs in systemplate
Comment 9 Commit Notification 2018-11-22 15:40:36 UTC
Andras Timar committed a patch related to this issue.
It has been pushed to "libreoffice-6-1":

https://git.libreoffice.org/online/+/ae005d654c4b2304e41231b76ccd08ebc27ca55c%5E%21

tdf#121429 PDF writing needs NSS libs in systemplate