Bug 1279152 - libopenraw-pixbuf-loader causes SEGV in nautilus
libopenraw-pixbuf-loader causes SEGV in nautilus
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: libopenraw (Show other bugs)
24
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Debarshi Ray
Fedora Extras Quality Assurance
:
Depends On: 1285604
Blocks: 1279153
  Show dependency treegraph
 
Reported: 2015-11-08 02:44 EST by Yaakov Selkowitz
Modified: 2016-07-09 19:53 EDT (History)
3 users (show)

See Also:
Fixed In Version: libopenraw-0.0.9-18.fc24 libopenraw-0.0.9-18.fc23
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1279153 1285604 (view as bug list)
Environment:
Last Closed: 2016-07-02 11:25:11 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
FreeDesktop.org 93712 None None None 2016-06-29 02:35 EDT

  None (edit)
Description Yaakov Selkowitz 2015-11-08 02:44:55 EST
Version-Release number of selected component (if applicable):
libopenraw-pixbuf-loader-0.0.9-10.fc22.x86_64

How reproducible:
100%

Steps to Reproduce:
1. install libopenraw-pixbuf-loader
2. download (into e.g. ~/Downloads) a RAW file not supported by libopenraw, e.g. http://www.rawsamples.ch/raws/olympus/sp350/RAW_OLYMPUS_SP350.ORF
3. start/open nautilus
4. in Preferences->Preview, make sure "Show thumbnails" is not "Never" and "Only for files smaller than" is set to at least 100MB (the above example is ~12MB)
5. then browse to the folder (e.g. ~/Downloads) containing the RAW file.

Actual results:
Segfault.

Expected results:
Error message to stderr, no thumbnail generated.

Description of problem:
gdk_pixbuf_loader_close is documented to set a non-NULL @error when returning FALSE, but lines 821-831 allow the possibility of returning FALSE without setting @error:

https://git.gnome.org/browse/gdk-pixbuf/tree/gdk-pixbuf/gdk-pixbuf-loader.c?h=gdk-pixbuf-2-32#n766

libgnome-desktop's _gdk_pixbuf_new_from_uri_at_scale (used by Nautilus to generate thumbnails for image formats supported by GdkPixbuf) depends on the documented behaviour by accessing error->message without checking that error != NULL:

https://git.gnome.org/browse/gnome-desktop/tree/libgnome-desktop/gnome-desktop-thumbnail.c?h=gnome-3-18#n552

However, libopenraw's gdk_pixbuf__or_image_stop_load, which is the vfunc called by gdk_pixbuf_loader_close, completely ignores @error:

http://cgit.freedesktop.org/libopenraw/tree/gnome/pixbuf-loader.c#n93

So, when faced with a RAW image that libopenraw does not support (which, at least in 0.0.9 are many, given that there are four years of yet unreleased development in upstream git), libopenraw-pixbuf-loader causes gdk_pixbuf_loader_close to return FALSE but does *not* set @error as promised.  The result is a NULL dereference in libgnome-desktop causing nautilus to SEGV.

Ultimately, there is plenty of blame to go around here:

* libopenraw-0.0.9 does not support many currently available RAW formats.  The possibility of shipping a git snapshot, or even better getting upstream to ship a new release, would make this library much more useful.  I have not investigated the API/ABI compatibility of git master vs. 0.0.9.

* Regardless, libopenraw's gdk_pixbuf__or_image_stop_load should conform with the documented requirement of gdk_pixbuf_loader close along the lines of the following:

--- a/gnome/pixbuf-loader.c
+++ b/gnome/pixbuf-loader.c
@@ -98,7 +98,6 @@ gdk_pixbuf__or_image_stop_load (gpointer

     GdkPixbuf *pixbuf = NULL;
     ORRawFileRef raw_file = NULL;
-    (void)error;

     raw_file = or_rawfile_new_from_memory(context->data->data, context->data->len,
                                           OR_DATA_TYPE_NONE);
@@ -129,6 +128,11 @@ gdk_pixbuf__or_image_stop_load (gpointer
                                       context->user_data);
         }
         result = TRUE;
+    } else if (error) {
+        g_set_error (error,
+                     GDK_PIXBUF_ERROR,
+                     GDK_PIXBUF_ERROR_FAILED,
+                     "Unable to load RAW file");
     }
 
 
* gdk_pixbuf_loader_close must conform with its documentation and assure that (a non-NULL) @error is always set when returning FALSE, in case a(nother) loader's stop_load vfunc does not conform.

* it could be argued that libgnome-desktop should check for error != NULL before error->message, but OTOH gdk-pixbuf's documentation does indicate that it is a safe assumption to make.

I believe this affects all supported versions of Fedora.
Comment 1 Jan Kurik 2016-02-24 08:55:36 EST
This bug appears to have been reported against 'rawhide' during the Fedora 24 development cycle.
Changing version to '24'.

More information and reason for this action is here:
https://fedoraproject.org/wiki/Fedora_Program_Management/HouseKeeping/Fedora24#Rawhide_Rebase
Comment 2 Fedora Update System 2016-06-29 03:26:31 EDT
libopenraw-0.0.9-18.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-9f290d01ea
Comment 3 Fedora Update System 2016-06-29 03:26:58 EDT
libopenraw-0.0.9-18.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-3cb527ae3d
Comment 4 Fedora Update System 2016-06-29 14:25:45 EDT
libopenraw-0.0.9-18.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-3cb527ae3d
Comment 5 Fedora Update System 2016-06-29 18:55:43 EDT
libopenraw-0.0.9-18.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-9f290d01ea
Comment 6 Fedora Update System 2016-07-02 11:25:09 EDT
libopenraw-0.0.9-18.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2016-07-09 19:53:21 EDT
libopenraw-0.0.9-18.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.