Yeah, looks like it's either a bad pointer being passed in to curl's buffer location or something, I don't really know what I'm on about so take it with a pinch of salt but my guess is that it's probably a bug with threading - how the app is using curl, by the looks of it.
Most of the segfault reports I see on line seem to be due to threads trying operations on the same handles etc.
https://curl.haxx.se/libcurl/c/libcurl-tutorial.html#Multi-threading
https://curl.haxx.se/libcurl/c/threadsafe.html
Seems that it's always crashing out in the same way when it happens, which is intermittent but affected by ltrace (less likely to segfault if tracing without filtering for the curl lib) so perhaps a bit less racey when running. The maxlength size_t is always topped out at 2049 and there's no such calls of that size to the curl gnutls lib when it runs properly, so probably something being modified by another thread.
Does seem odd though. Interestingly, there's an SSL cert always read in by Spotify which is exactly 2049 in length.
23867 1561368755.293945 <... SYS_read resumed> , "-----BEGIN CERTIFICATE-----\nMIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UE\nBhMCQ0gxFTATBgNVBAoTDFN3a
XNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWdu\nIFNpbHZlciBDQSAtIEcyMB4XDTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0Nlow\nRzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxM
Y\nU3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A\nMIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644N0Mv\nFz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gR
Epzn5/ASLHvGiTSf5YXu6t+WiE7br\nYT7QbNHm+/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieF\nnbAVlDLaYQ1HTWBCrpJH6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH\n6ATK72o
xh9TAtvmUcXtnZLi2kUpCe2UuMGoM9ZDulebyzYLs2aFK7PayS+VFheZt\neJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5hqAaEuSh6XzjZG6k4sIN/\nc8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0m
RmrVn5bi4Y5FZGkECwJ\nMoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRH\nHTBsROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTf\njNFusB3hB48IHpmcc
elM2KX3RxIfdNFRnobzwqIjQAtz20um53MGj
MGg6cFZrEb6\n5i/4z3GcRm25xBWNOHkDRUjvxF3XCO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOB\nrDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU\nF6DNweRBtjpbO8tFnb0cwpj6h
lgwHwYDVR0jBBgwFoAUF6DNweRBtjpbO8tFnb0c\nwpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0\ncDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggI
B\nAHPGgeAn0i0P4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShp\nWJHckRE1qTodvBqlYJ7YH39FkWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9\nxCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/
L3XWgwF15kIwb4FDm3jH+mHtwX6WQ\n2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx/uNncqCxv1yL5PqZ\nIseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFaDGi8\naRl5xB9
+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2X\nem1ZqSqPe97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQR\ndAtq/gsD/KNVV4n+SsuuWxcFyPKNIzFTONItaj+CuY0Ia
vdeQXRuwxF+B6wpYJE/\nOMpXEA29MC/HpeZBoNquBYeaoKRlbEwJDIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+\nhAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ubDgEj8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB
9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\n", 4096) = 2049 <0.000026>
Which is
Certificate:
Data:
Version: 3 (0x2)
Serial Number: 5700383053117599563 (0x4f1bd42f54bb2f4b)
Signature Algorithm: sha1WithRSAEncryption
Issuer: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
Validity
Not Before: Oct 25 08:32:46 2006 GMT
Not After : Oct 25 08:32:46 2036 GMT
Subject: C = CH, O = SwissSign AG, CN = SwissSign Silver CA - G2
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
RSA Public-Key: (4096 bit)
...
I'm wondering whether somehow this is where the 2049 size_t is comming from, passed into curl_mvsnprintf before it's segfaulting. I've tested it again and again and the biggest size_t passed to curl_mvsnprintf normally is 256 when everything is working properly.
When it segfaults there's the reado of that ssl cert, two seconds later there's the curl mvsnprintf with the same size_t and segfault...
23867 1561368755.293945 <... SYS_read resumed> , "-----BEGIN CERTIFICATE-----\nMIIFvTCCA6WgAwIBAgIITxvUL1S7L0swDQYJKoZIhvcNAQEFBQAwRzELMAkGA1UE\nBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMYU3dpc3NTaWdu\nIFNpbHZlciBDQSAtIEcyMB4XDTA2MTAyNTA4MzI0NloXDTM2MTAyNTA4MzI0Nlow\nRzELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFN3aXNzU2lnbiBBRzEhMB8GA1UEAxMY\nU3dpc3NTaWduIFNpbHZlciBDQSAtIEcyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8A\nMIICCgKCAgEAxPGHf9N4Mfc4yfjDmUO8x/e8N+dOcbpLj6VzHVxumK4DV644N0Mv\nFz0fyM5oEMF4rhkDKxD6LHmD9ui5aLlV8gREpzn5/ASLHvGiTSf5YXu6t+WiE7br\nYT7QbNHm+/pe7R20nqA1W6GSy/BJkv6FCgU+5tkL4k+73JU3/JHpMjUi0R86TieF\nnbAVlDLaYQ1HTWBCrpJH6INaUFjpiou5XaHc3ZlKHzZnu0jkg7Y360g6rw9njxcH\n6ATK72oxh9TAtvmUcXtnZLi2kUpCe2UuMGoM9ZDulebyzYLs2aFK7PayS+VFheZt\neJMELpyCbTapxDFkH4aDCyr0NQp4yVXPQbBH6TCfmb5hqAaEuSh6XzjZG6k4sIN/\nc8HDO0gqgg8hm7jMqDXDhBuDsz6+pJVpATqJAHgE2cn0mRmrVn5bi4Y5FZGkECwJ\nMoBgs5PAKrYYC51+jUnyEEp/+dVGLxmSo5mnJqy7jDzmDrxHB9xzUfFwZC8I+bRH\nHTBsROopN4WSaGa8gzj+ezku01DwH/teYLappvonQfGbGHLy9YR0SslnxFSuSGTf\njNFusB3hB48IHpmccelM2KX3RxIfdNFRnobzwqIjQAtz20um53MGjMGg6cFZrEb6\n5i/4z3GcRm25xBWNOHkDRUjvxF3XCO6HOSKGsg0PWEP3calILv3q1h8CAwEAAaOB\nrDCBqTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU\nF6DNweRBtjpbO8tFnb0cwpj6hlgwHwYDVR0jBBgwFoAUF6DNweRBtjpbO8tFnb0c\nwpj6hlgwRgYDVR0gBD8wPTA7BglghXQBWQEDAQEwLjAsBggrBgEFBQcCARYgaHR0\ncDovL3JlcG9zaXRvcnkuc3dpc3NzaWduLmNvbS8wDQYJKoZIhvcNAQEFBQADggIB\nAHPGgeAn0i0P4JUw4ppBf1AsX19iYamGamkYDHRJ1l2E6kFSGG9YrVBWIGrGvShp\nWJHckRE1qTodvBqlYJ7YH39FkWnZfrt4csEGDyrOj4VwYaygzQu4OSlWhDJOhrs9\nxCrZ1x9y7v5RoSJBsXECYxqCsGKrXlcSH9/L3XWgwF15kIwb4FDm3jH+mHtwX6WQ\n2K34ArZv02DdQEsixT2tOnqfGhpHkXkzuoLcMmkDlm4fS/Bx/uNncqCxv1yL5PqZ\nIseEuRuNI5c/7SXgz2W79WEE790eslpBIlqhn10s6FvJbakMDHiqYMZWjwFaDGi8\naRl5xB9+lwW/xekkUV7U1UtT7dkjWjYDZaPBA61BMPNGG4WQr2W11bHkFlt4dR2X\nem1ZqSqPe97Dh4kQmUlzeMg9vVE1dCrV8X5pGyq7O70luJpaPXJhkGaH7gzWTdQR\ndAtq/gsD/KNVV4n+SsuuWxcFyPKNIzFTONItaj+CuY0IavdeQXRuwxF+B6wpYJE/\nOMpXEA29MC/HpeZBoNquBYeaoKRlbEwJDIm6uNO5wJOKMPqN5ZprFQFOZ6raYlY+\nhAhm0sQ2fac+EPyI4NSA5QC9qvNOBqN6avlicuMJT+ubDgEj8Z+7fNzcbBGXJbLy\ntGMU0gYqZ4yD9c7qB9iaah7s5Aq7KkzrCWA5zspi2C5u\n-----END CERTIFICATE-----\n", 4096) = 2049 <0.000026>
23867 1561368758.455309 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffc8e0, 2049, 0x7fc1c10db588, 0x7fc157ffc8c8 <unfinished ...>
Looking at the "good" trace, there seems to be a pattern of a 7, 128 and a 256 maxlength which repeats for a while...
24146 1561369233.774199 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff91e1, 7, 0x7f1172fcb1e0,
0x7f111dff90d0 <unfinished ...>
24146 1561369233.776327 <... curl_mvsnprintf resumed> ) = 3 <0.002121>
24146 1561369233.796293 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9180, 128, 0x7f1172fcbb0a, 0x7f111dff90a0 <unfinished ...>
24146 1561369233.797648 <... curl_mvsnprintf resumed> ) = 26 <0.001349>
24146 1561369234.085892 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9260, 256, 0x7f1172fc6be8, 0x7f111dff9170 <unfinished ...>
24146 1561369234.087576 <... curl_mvsnprintf resumed> ) = 57 <0.001677>
24146 1561369234.145964 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff91e1, 7, 0x7f1172fcb1e0,
0x7f111dff90d0 <unfinished ...>
24146 1561369234.147276 <... curl_mvsnprintf resumed> ) = 3 <0.001305>
24146 1561369234.161595 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9180, 128, 0x7f1172fcbb0a, 0x7f111dff90a0 <unfinished ...>
24146 1561369234.162919 <... curl_mvsnprintf resumed> ) = 26 <0.001318>
24146 1561369234.464201 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9260, 256, 0x7f1172fc6be8, 0x7f111dff9170 <unfinished ...>
24146 1561369234.465540 <... curl_mvsnprintf resumed> ) = 57 <0.001332>
24146 1561369235.416065 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff91e1, 7, 0x7f1172fcb1e0,
0x7f111dff90d0 <unfinished ...>
24146 1561369235.417466 <... curl_mvsnprintf resumed> ) = 3 <0.001388>
24146 1561369235.437715 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9180, 128, 0x7f1172fcbb0a, 0x7f111dff90a0 <unfinished ...>
24146 1561369235.446180 <... curl_mvsnprintf resumed> ) = 26 <0.008463>
24146 1561369235.847103 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9260, 256, 0x7f1172fc6be8, 0x7f111dff9170 <unfinished ...>
24146 1561369235.849220 <... curl_mvsnprintf resumed> ) = 57 <0.002108>
24146 1561369238.366226 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff91e1, 7, 0x7f1172fcb1e0,
0x7f111dff90d0 <unfinished ...>
24146 1561369238.367640 <... curl_mvsnprintf resumed> ) = 3 <0.001404>
24146 1561369238.385993 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9180, 128, 0x7f1172fcbb0a, 0x7f111dff90a0 <unfinished ...>
24146 1561369238.388487 <... curl_mvsnprintf resumed> ) = 26 <0.002487>
24146 1561369238.748475 libcurl-gnutls.so.4->curl_mvsnprintf(0x7f111dff9260, 256, 0x7f1172fc6be8, 0x7f111dff9170 <unfinished ...>
24146 1561369238.750093 <... curl_mvsnprintf resumed> ) = 57 <0.001612>
but on a segfault one, this jumps from 128 to 2049....
23867 1561368758.042046 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffd1e1, 7, 0x7fc1c10da1e0,
0x7fc157ffd0d0 <unfinished ...>
23867 1561368758.043383 <... curl_mvsnprintf resumed> ) = 3 <0.001331>
23867 1561368758.062192 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffd180, 128, 0x7fc1c10dab0a, 0x7fc157ffd0a0 <unfinished ...>
23867 1561368758.065569 <... curl_mvsnprintf resumed> ) = 26 <0.003370>
23867 1561368758.364087 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffd260, 256, 0x7fc1c10d5be8, 0x7fc157ffd170 <unfinished ...>
23867 1561368758.365942 <... curl_mvsnprintf resumed> ) = 57 <0.001848>
23867 1561368758.435456 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffd1e1, 7, 0x7fc1c10da1e0,
0x7fc157ffd0d0 <unfinished ...>
23867 1561368758.438399 <... curl_mvsnprintf resumed> ) = 3 <0.002934>
23867 1561368758.452583 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffd180, 128, 0x7fc1c10dab0a, 0x7fc157ffd0a0 <unfinished ...>
23867 1561368758.454919 <... curl_mvsnprintf resumed> ) = 26 <0.002331>
23867 1561368758.455309 libcurl-gnutls.so.4->curl_mvsnprintf(0x7fc157ffc8e0, 2049, 0x7fc1c10db588, 0x7fc157ffc8c8 <unfinished ...>