indicator-applet-complete crashed with SIGSEGV in libindicator's indicator-image-helper

[Sal Inski]

Indicator applet crashed when changing themes

ProblemType: Crash
DistroRelease: Ubuntu 12.04
Package: indicator-applet-complete 0.4.91-0ubuntu1
ProcVersionSignature: Ubuntu 3.2.0-17.27-generic 3.2.6
Uname: Linux 3.2.0-17-generic x86_64
NonfreeKernelModules: nvidia
ApportVersion: 1.94-0ubuntu1
Architecture: amd64
Date: Sun Mar 4 17:23:39 2012
ExecutablePath: /usr/lib/indicator-applet/indicator-applet-complete
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Alpha amd64 (20120303)
ProcCmdline: /usr/lib/indicator-applet/indicator-applet-complete
ProcEnviron:
 SHELL=/bin/bash
 LC_MESSAGES=bg_BG.UTF-8
 PATH=(custom, no user)
 LANGUAGE=bg:en_US:en
 LANG=bg_BG.UTF-8
SegvAnalysis:
 Segfault happened at: 0x7f1d1e12c0c0: mov 0x18(%rdi),%rax
 PC (0x7f1d1e12c0c0) ok
 source "0x18(%rdi)" (0x00000018) not located in a known VMA region (needed readable region)!
 destination "%rax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: indicator-applet
StacktraceTop:
 ?? () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
 gtk_image_clear () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
 gtk_image_set_from_pixbuf () from /usr/lib/x86_64-linux-gnu/libgtk-3.so.0
 ?? () from /usr/lib/libindicator3.so.7
 indicator_image_helper_update () from /usr/lib/libindicator3.so.7
Title: indicator-applet-complete crashed with SIGSEGV in gtk_image_clear()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 _gtk_icon_helper_get_storage_type (self=0x0) at /build/buildd/gtk+3.0-3.3.16/./gtk/gtkiconhelper.c:482
 gtk_image_reset (image=0x1ccfa80) at /build/buildd/gtk+3.0-3.3.16/./gtk/gtkimage.c:1430
 gtk_image_clear (image=0x1ccfa80) at /build/buildd/gtk+3.0-3.3.16/./gtk/gtkimage.c:1486
 gtk_image_set_from_pixbuf (image=0x1ccfa80, pixbuf=0x7f1d040388a0) at /build/buildd/gtk+3.0-3.3.16/./gtk/gtkimage.c:851
 refresh_image (image=0x1ccfa80) at /build/buildd/libindicator-0.4.92/./libindicator/indicator-image-helper.c:92

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Charles Kerr (charlesk)]

I can't confirm this ticket, but the information in the original description and in the Stacktrace is enough detail to investigate a fix...

[Charles Kerr (charlesk)]

Looks like possibly a destroyed GtkImage is being passed to image-helper's refresh_image() function

In that stacktrace, the GtkImage's icon_helper is NULL. In GTK+'s code, that field initialized with a call to _gtk_icon_helper_new() when the GtkImage is created, and then cleared and set to NULL in gtk_image_destroy().

[Charles Kerr (charlesk)]

Judging from these traces, some client code is passing an invalid GtkImage pointer into indicator_image_helper_update(). Even if we're not sure who the caller is, we can safeguard against crashes like this somewhat by adding a GTK_IS_IMAGE test to the image argument that gets passed in.

It would be better to find the client code that's passing in an invalid GtkImage, but none of the Stacktraces have that information.

[Launchpad Janitor (janitor)]

This bug was fixed in the package libindicator - 0.5.0-0ubuntu1

---------------
libindicator (0.5.0-0ubuntu1) precise; urgency=low

  * New upstream release.
    * Validate images in image_helper_update() (LP: #946408)
 -- Charles Kerr <email address hidden> Wed, 11 Apr 2012 10:54:42 -0500

[Bob Bib (bobbib)]

charlesk,
it's useless to add a 'need-smth-retrace' tag to bugs without a coredump.