"double free or corruption (!prev)" with radicale

[DrElizar]

Crash report

What happened?

Tested with 3.12 and 3.13 on debian testing:
When running the server [radicale] it crashes immediately with

root@Neo:/home/radicale # gdb --args /usr/bin/env python3 -m radicale
(gdb) run
Starting program: /usr/bin/env python3 -m radicale
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
process 119783 is executing new program: /usr/bin/python3
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[2025-04-23 22:21:03 +0200] [119783] [INFO] Logging of backtrace is disabled in this loglevel
[2025-04-23 22:21:03 +0200] [119783] [INFO] Loaded default config
[2025-04-23 22:21:03 +0200] [119783] [INFO] Loaded config file '/etc/radicale/config'
[2025-04-23 22:21:03 +0200] [119783] [INFO] Skipped missing/unreadable config file '/root/.config/radicale/config'
[2025-04-23 22:21:03 +0200] [119783] [INFO] Starting Radicale (python=3.13.2 radicale=3.5.1 vobject=0.9.8 passlib=1.7.4 defusedxml=0.7.1 dateutil=2.9.0 bcrypt=4.2.0 pika=1.3.2 ldap=n/a ldap3=n/a pam=n/a)
[Detaching after vfork from child process 119787]
double free or corruption (!prev)

Program received signal SIGABRT, Aborted.
__pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
warning: 44	./nptl/pthread_kill.c: No such file or directory
(gdb) where
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007ffff7cd89ff in __pthread_kill_internal (threadid=<optimized out>, signo=6) at ./nptl/pthread_kill.c:89
#2  0x00007ffff7c83cc2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff7c6c4ac in __GI_abort () at ./stdlib/abort.c:73
#4  0x00007ffff7c6d291 in __libc_message_impl (fmt=fmt@entry=0x7ffff7def32d "%s\n") at ../sysdeps/posix/libc_fatal.c:134
#5  0x00007ffff7ce2465 in malloc_printerr (str=str@entry=0x7ffff7df26f8 "double free or corruption (!prev)") at ./malloc/malloc.c:5829
#6  0x00007ffff7ce456c in _int_free_merge_chunk (av=av@entry=0x7ffff7e2bac0 <main_arena>, p=p@entry=0xfdb970, size=32784) at ./malloc/malloc.c:4721
#7  0x00007ffff7ce46c6 in _int_free_chunk (av=av@entry=0x7ffff7e2bac0 <main_arena>, p=p@entry=0xfdb970, size=<optimized out>, have_lock=<optimized out>, 
    have_lock@entry=0) at ./malloc/malloc.c:4667
#8  0x00007ffff7ce73c0 in _int_free (av=0x7ffff7e2bac0 <main_arena>, p=0xfdb970, have_lock=0) at ./malloc/malloc.c:4699
#9  __GI___libc_free (mem=<optimized out>) at ./malloc/malloc.c:3476
#10 0x000000000052ca78 in PyMem_Free ()
#11 0x00007ffff7866668 in PyCData_clear (self=0x7ffff6618270) at ../Modules/_ctypes/_ctypes.c:2872
#12 PyCData_dealloc (self=0x7ffff6618270) at ../Modules/_ctypes/_ctypes.c:2883
#13 0x00000000005ca776 in ?? ()
#14 0x000000000056a09a in _PyEval_EvalFrameDefault ()
#15 0x000000000064db6c in PyEval_EvalCode ()
#16 0x0000000000667c82 in ?? ()
#17 0x00000000005794ed in ?? ()
#18 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#19 0x0000000000582706 in ?? ()
#20 0x00000000005c1f92 in PyObject_CallMethodObjArgs ()
#21 0x00000000005c0e4b in PyImport_ImportModuleLevelObject ()
#22 0x00000000005621ea in _PyEval_EvalFrameDefault ()
#23 0x000000000064db6c in PyEval_EvalCode ()
#24 0x0000000000667c82 in ?? ()
#25 0x00000000005794ed in ?? ()
#26 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#27 0x0000000000582706 in ?? ()
#28 0x00000000005c1f92 in PyObject_CallMethodObjArgs ()
#29 0x00000000005c0e4b in PyImport_ImportModuleLevelObject ()
#30 0x00000000005794ed in ?? ()
#31 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#32 0x0000000000582706 in ?? ()
#33 0x00000000005c1f92 in PyObject_CallMethodObjArgs ()
#34 0x00000000005c0e4b in PyImport_ImportModuleLevelObject ()
#35 0x00000000005621ea in _PyEval_EvalFrameDefault ()
#36 0x000000000064db6c in PyEval_EvalCode ()
#37 0x0000000000667c82 in ?? ()
#38 0x00000000005794ed in ?? ()
#39 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#40 0x0000000000582706 in ?? ()
#41 0x00000000005c1f92 in PyObject_CallMethodObjArgs ()
#42 0x00000000005c0e4b in PyImport_ImportModuleLevelObject ()
#43 0x00000000005621ea in _PyEval_EvalFrameDefault ()
#44 0x000000000064db6c in PyEval_EvalCode ()
#45 0x0000000000667c82 in ?? ()
#46 0x00000000005794ed in ?? ()
#47 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#48 0x0000000000582706 in ?? ()
#49 0x00000000005c1f92 in PyObject_CallMethodObjArgs ()
#50 0x00000000005c0e4b in PyImport_ImportModuleLevelObject ()
#51 0x00000000005621ea in _PyEval_EvalFrameDefault ()
#52 0x000000000064db6c in PyEval_EvalCode ()
#53 0x0000000000667c82 in ?? ()
#54 0x00000000005794ed in ?? ()
#55 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#56 0x0000000000582706 in ?? ()
#57 0x00000000005c1f92 in PyObject_CallMethodObjArgs ()
#58 0x00000000005c0e4b in PyImport_ImportModuleLevelObject ()
#59 0x00000000005621ea in _PyEval_EvalFrameDefault ()
#60 0x000000000064db6c in PyEval_EvalCode ()
#61 0x0000000000667c82 in ?? ()
#62 0x00000000005794ed in ?? ()
#63 0x00000000005609e8 in _PyEval_EvalFrameDefault ()
#64 0x000000000059976e in ?? ()
#65 0x0000000000543ae5 in _PyObject_MakeTpCall ()
--Type <RET> for more, q to quit, c to continue without paging--
#66 0x000000000055f191 in _PyEval_EvalFrameDefault ()
#67 0x000000000064db6c in PyEval_EvalCode ()
#68 0x0000000000667c82 in ?? ()
#69 0x00000000005794ed in ?? ()
#70 0x0000000000549502 in PyObject_Vectorcall ()
#71 0x000000000055f191 in _PyEval_EvalFrameDefault ()
#72 0x000000000068157a in ?? ()
#73 0x0000000000680cd4 in Py_RunMain ()
#74 0x000000000063d6eb in Py_BytesMain ()
#75 0x00007ffff7c6dca8 in __libc_start_call_main (main=main@entry=0x63d640, argc=argc@entry=3, argv=argv@entry=0x7fffffffe5b8)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#76 0x00007ffff7c6dd65 in __libc_start_main_impl (main=0x63d640, argc=3, argv=0x7fffffffe5b8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7fffffffe5a8) at ../csu/libc-start.c:360
#77 0x000000000063cab1 in _start ()

CPython versions tested on:

3.13

Operating systems tested on:

Linux

Output from running 'python -VV' on the command line:

Python 3.13.2 (main, Mar 29 2025, 10:04:43) [GCC 14.2.0]

[sobolevn]

Do you have a shorter standalone reproducer? 🙏 This way we can be sure that this is not an issue with radicale and it would be much easier to solve.

[ZeroIntensity]

Judging by the backtrace, the crash happens in ctypes. I guess there's a small chance it's our fault, but I would say that around 99% of the time a crash happens with ctypes involved, it's just user-error. Could you report this to Radicale first?