Linux store reads GError.message from the wrong offset on 64-bit, so every libsecret failure yields a garbage message (or a crash)

[matt-edmondson]

What's wrong

LinuxSecretServiceCredentialStore.ThrowIfError (CredentialCache/Storage/LinuxSecretServiceCredentialStore.cs:142) reads the error message like this:

IntPtr messagePtr = Marshal.ReadIntPtr(error, IntPtr.Size * 2);

The glib layout is GError { GQuark domain /*uint32*/; gint code /*int32*/; gchar *message; }. So on 64-bit the message pointer is at offset 8, and the struct is 16 bytes long. IntPtr.Size * 2 is 16, which reads the word after the end of the struct. On 32-bit, IntPtr.Size * 2 happens to equal 8, which is why the bug is easy to miss.

Failure scenario (verified)

• A C program built against the system glib headers prints sizeof(GError)=16 offsetof(message)=8.
• A .NET app created a real GError with g_error_new_literal:
  • reading at offset 8 returned the correct message;
  • reading at offset 16 returned 0x20, which is the next malloc chunk's header;
  • a verbatim copy of the ThrowIfError extraction produced failed: ��.

The most common trigger is the one the class docs tell consumers to handle: a headless machine or container with no Secret Service running. The real libsecret error text is lost, the CredentialStoreException message is heap garbage, and if the stray value points at unmapped memory, PtrToStringUTF8 faults the process.

Suggested fix

Declare the struct and marshal it:

[StructLayout(LayoutKind.Sequential)]
private struct GError { public uint Domain; public int Code; public IntPtr Message; }
...
GError e = Marshal.PtrToStructure<GError>(error);
message = Marshal.PtrToStringUTF8(e.Message);

The minimal alternative is to read at sizeof(uint) + sizeof(int), which is 8 on both architectures.

Acceptance: on Linux x64 with no D-Bus session, the thrown exception carries libsecret's real message. For example, "Cannot autolaunch D-Bus without X11 $DISPLAY", or whatever the host reports.

[matt-edmondson]

Triage

• Category: Bug
• Priority: High. This is an out-of-bounds native read on every libsecret failure on 64-bit Linux, the only Linux architecture that matters. At best the error message is heap garbage. At worst PtrToStringUTF8 faults and takes the process down. The most common trigger is the case the docs tell consumers to handle: a headless machine or container with no Secret Service.
• Area: LinuxSecretServiceCredentialStore.ThrowIfError (P/Invoke marshalling)
• Suggested assignment: CredentialCache maintainer, Linux/native interop area
• Duplicates: None. It is separate from TryGet throws NotSupportedException when a stored entry is JSON without a $type discriminator, instead of returning false #164 (JSON deserialization).
• In progress: No open PR covers this.

Notes: Prefer the [StructLayout(Sequential)] GError struct over a hard-coded offset of 8. It documents the layout and stays correct if glib ever pads differently. Worth a quick look at other Marshal.ReadIntPtr offsets in the Linux store for the same IntPtr.Size * n pattern. An acceptance test on the Linux CI leg with no D-Bus session would stop this regressing.

---

Generated by Claude Code