Getting segmentation fault after python upgrade

[nikhil-sec]

I'm trying to upgrade Python to the latest Python version, but even with a minor Python version upgrade getting segmentation fault error. Current python version: 3.9.12 Next Python upgrade plan: >=3.9.17

In the below Dockerfile, if we replace ARG CONDA_VERSION & ARG SHA256SUM with the previous Python version(mentioned in the comment of Dockerfile) then everything is working fine.

Steps to reproduce:

1. create a Dockerfile

FROM alpine:latest
USER root
RUN apk update && apk upgrade && apk add --no-cache bash && apk add --no-cache coreutils

ENV LANG=C.UTF-8
ENV LC_ALL=en_US.utf8

ARG CONDA_VERSION=py39_23.5.2-0
ARG SHA256SUM=9829d95f639bd0053b2ed06d1204e60644617bf37dd5cc57523732e0e8d64516

# Replace the below args for the previous Python version
#ARG CONDA_VERSION=py39_4.12.0
#ARG SHA256SUM=78f39f9bae971ec1ae7969f0516017f2413f17796670f7040725dd83fcff5689

ENV PATH /opt/python/bin:$PATH
SHELL ["/bin/ash", "-eo", "pipefail", "-c"]

RUN apk add -q --no-cache --virtual=.build-dependencies wget ca-certificates procps && \
    wget -q -O /etc/apk/keys/sgerrand.rsa.pub https://alpine-pkgs.sgerrand.com/sgerrand.rsa.pub && \
    wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.33-r0/glibc-2.33-r0.apk && \
    wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.33-r0/glibc-bin-2.33-r0.apk && \
    wget https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.33-r0/glibc-i18n-2.33-r0.apk && \
    apk add -q --no-cache --force-overwrite\
      "glibc-2.33-r0.apk" \
      "glibc-bin-2.33-r0.apk" \
      "glibc-i18n-2.33-r0.apk" && \
    \
    rm "/etc/apk/keys/sgerrand.rsa.pub" && \
    /usr/glibc-compat/bin/localedef --force --inputfile POSIX --charmap UTF-8 "$LANG" || true && \
    echo "export LANG=$LANG" > /etc/profile.d/locale.sh && \
    \
    apk del -q glibc-i18n && \
    \
    apk del -q .build-dependencies && \
    rm \
        "glibc-2.33-r0.apk" \
        "glibc-bin-2.33-r0.apk" \
        "glibc-i18n-2.33-r0.apk" && \
    wget --quiet https://repo.anaconda.com/miniconda/Miniconda3-${CONDA_VERSION}-Linux-x86_64.sh -O miniconda.sh && \
    echo "${SHA256SUM}  miniconda.sh" > miniconda.sha256 && \
    if ! sha256sum -c miniconda.sha256; then exit 1; fi && \
    sh miniconda.sh -b -p /opt/python && \
    rm miniconda.sh miniconda.sha256 && \
    conda install -c anaconda pip && \
    /opt/python/bin/conda clean -afy

CMD [ "python" ]

2. Create docker image using: docker build -t python39:test .
3. Access container: docker run -it --entrypoint bash python39:test
4. Inside container execute python command: python
5. Getting segmentation fault error:

   Python 3.9.17 (main, Jul  5 2023, 20:41:20)
   [GCC 11.2.0] :: Anaconda, Inc. on linux
   Type "help", "copyright", "credits" or "license" for more information.
   Segmentation fault (core dumped)

@sgerrand please check.

[nikhil-sec]

If I try to upgrade glibc to the latest version: 2.35-r1, during miniconda installation I start to get the below errors:

Error relocating /opt/python/conda.exe: __strcat_chk: symbol not found
Error relocating /opt/python/conda.exe: __snprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __vfprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __realpath_chk: symbol not found
Error relocating /opt/python/conda.exe: __strdup: symbol not found
Error relocating /opt/python/conda.exe: __stpcpy_chk: symbol not found
Error relocating /opt/python/conda.exe: __vsnprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __strncpy_chk: symbol not found
Error relocating /opt/python/conda.exe: __strcpy_chk: symbol not found
Error relocating /opt/python/conda.exe: __fprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __strncat_chk: symbol not found
Error relocating /opt/python/conda.exe: __strcat_chk: symbol not found
Error relocating /opt/python/conda.exe: __snprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __vfprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __realpath_chk: symbol not found
Error relocating /opt/python/conda.exe: __strdup: symbol not found
Error relocating /opt/python/conda.exe: __stpcpy_chk: symbol not found
Error relocating /opt/python/conda.exe: __vsnprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __strncpy_chk: symbol not found
Error relocating /opt/python/conda.exe: __strcpy_chk: symbol not found
Error relocating /opt/python/conda.exe: __fprintf_chk: symbol not found
Error relocating /opt/python/conda.exe: __strncat_chk: symbol not found

[sgerrand]

Thanks for filing this detailed bug report. I'll be able to review it this weekend and create any related patches.

[nikhil-sec]

@sgerrand did you get a chance to look into this?

[frol]

2.35 is mostly broken (https://github.com/sgerrand/alpine-pkg-glibc/issues/210), as reported in https://github.com/sgerrand/alpine-pkg-glibc/issues/204#issuecomment-1682139068, upgrade to the latest version should just fix the issue