evolution-rss crashes with SIGSEGV in g_io_stream_get_output_stream()

[Damien]

Evolution-RSS crashes with SIGSEGV when trying to view an item in an RSS feed.

Steps tp reproduce:
- enable the plugin
- add an RSS feed (e.g. https://www.xkcd.com/atom.xml)
- the feed items are properly fetched
- view one item -> crash

The folder ~/.local/share/evolution/mail/rss/ is readable and writable. Content:
total 20
-rw-rw-r-- 1 dam dam 0 Jul 30 13:37 a303bf2dac4bd8e3
-rw-rw-r-- 1 dam dam 10 Jul 30 13:37 a303bf2dac4bd8e3.fav
-rw-rw-r-- 1 dam dam 2166 Jul 30 13:37 a303bf2dac4bd8e3.img
-rw-rw-r-- 1 dam dam 92 Jul 30 13:35 b38f24a7450e1c44
-rw-rw-r-- 1 dam dam 10 Jul 30 13:35 b38f24a7450e1c44.fav
-rw-rw-r-- 1 dam dam 17 Jul 30 13:37 feed_folders

The file "feed_folders" contains 4 lines:
$> more feed_folders
(heU

xkcd com

Which looks a little strange, but not sure what its content should be.

The crash is 100% reproducible, but some feeds do not trigger it. I suspect that feeds containing images are the issue.
This bug is very similar to https://bugs.launchpad.net/ubuntu/+source/evolution-rss/+bug/1652834 but I see no parsing errors. As the author of that bug reports, the renderer is gtkhtml and there is no alternative available on Ubuntu (AFAIK...)

More information:

$> lsb_release -rd:
Description: Ubuntu 22.04.2 LTS
Release: 22.04

$> apt-cache policy evolution-rss
evolution-rss:
  Installed: 0.3.96-4build2
  Candidate: 0.3.96-4build2
  Version table:
 *** 0.3.96-4build2 500
        500 http://jp.archive.ubuntu.com/ubuntu jammy/universe amd64 Packages
        100 /var/lib/dpkg/status

GDB output:

$> gdb evolution
GNU gdb (Ubuntu 12.1-0ubuntu1~22.04) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from evolution...
(No debugging symbols found in evolution)
(gdb) run
Starting program: /usr/bin/evolution
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffe1684640 (LWP 13055)]
[New Thread 0x7fffe0e03640 (LWP 13056)]
[New Thread 0x7fffdbfff640 (LWP 13057)]
[New Thread 0x7fffdb7fe640 (LWP 13058)]
[New Thread 0x7fffdacbe640 (LWP 13059)]
[New Thread 0x7fffda4bd640 (LWP 13062)]
[New Thread 0x7fffd99c0640 (LWP 13063)]
[Detaching after fork from child process 13064]
[New Thread 0x7fffd91bf640 (LWP 13066)]
[New Thread 0x7fffd88fe640 (LWP 13067)]
[New Thread 0x7fffb7fff640 (LWP 13070)]
[New Thread 0x7fffb77fe640 (LWP 13071)]
[New Thread 0x7fffb6ffd640 (LWP 13072)]
[New Thread 0x7fffb67fc640 (LWP 13073)]
[New Thread 0x7fffb5ffb640 (LWP 13074)]
[New Thread 0x7fffb57fa640 (LWP 13075)]
[New Thread 0x7fffb4ff9640 (LWP 13078)]
[New Thread 0x7fff97fff640 (LWP 13079)]
[New Thread 0x7fff977fe640 (LWP 13080)]
[New Thread 0x7fff96ffd640 (LWP 13085)]
[New Thread 0x7fff967fc640 (LWP 13086)]
[New Thread 0x7fff95ffb640 (LWP 13087)]
[New Thread 0x7fff957fa640 (LWP 13088)]
[New Thread 0x7fff94ff9640 (LWP 13089)]
[Detaching after fork from child process 13090]
[New Thread 0x7fff77fff640 (LWP 13091)]
[New Thread 0x7fff777fe640 (LWP 13092)]
[New Thread 0x7fff76ffd640 (LWP 13093)]
[New Thread 0x7fff6dfff640 (LWP 13094)]
[New Thread 0x7fff6d7fe640 (LWP 13095)]
[New Thread 0x7fff6cffd640 (LWP 13096)]
[New Thread 0x7fff1fffd640 (LWP 13097)]
[Detaching after vfork from child process 13098]
[Detaching after vfork from child process 13099]
[Thread 0x7fff6d7fe640 (LWP 13095) exited]
[New Thread 0x7fff6d7fe640 (LWP 13104)]
[New Thread 0x7fff1f7fc640 (LWP 13105)]
[Thread 0x7fff6d7fe640 (LWP 13104) exited]
[Thread 0x7fff1f7fc640 (LWP 13105) exited]
[New Thread 0x7fff1f7fc640 (LWP 13110)]
[New Thread 0x7fff6d7fe640 (LWP 13111)]
[Thread 0x7fff1f7fc640 (LWP 13110) exited]
[Thread 0x7fff6d7fe640 (LWP 13111) exited]
[New Thread 0x7fff6d7fe640 (LWP 13112)]
RSS Plugin enabled (evolution 3.44, evolution-rss 0.3.96)
soup init()
[Detaching after vfork from child process 13116]
[New Thread 0x7fff1f7fc640 (LWP 13118)]
[New Thread 0x7fff1e3ff640 (LWP 13119)]
[Thread 0x7fff1f7fc640 (LWP 13118) exited]
[New Thread 0x7fff1f7fc640 (LWP 13120)]
[New Thread 0x7fff1dbfe640 (LWP 13121)]
[Thread 0x7fff1e3ff640 (LWP 13119) exited]
[Thread 0x7fff1f7fc640 (LWP 13120) exited]
[Thread 0x7fff1dbfe640 (LWP 13121) exited]
[New Thread 0x7fff1dbfe640 (LWP 13122)]
[New Thread 0x7fff1f7fc640 (LWP 13123)]
[Thread 0x7fff1dbfe640 (LWP 13122) exited]
[New Thread 0x7fff1dbfe640 (LWP 13124)]
[New Thread 0x7fff1e3ff640 (LWP 13125)]
[Thread 0x7fff1f7fc640 (LWP 13123) exited]
[Thread 0x7fff1dbfe640 (LWP 13124) exited]
[Thread 0x7fff1e3ff640 (LWP 13125) exited]
[Thread 0x7fff777fe640 (LWP 13092) exited]
[Thread 0x7fff94ff9640 (LWP 13089) exited]
[Thread 0x7fff957fa640 (LWP 13088) exited]
[Thread 0x7fffd99c0640 (LWP 13063) exited]
[Thread 0x7fff96ffd640 (LWP 13085) exited]
[New Thread 0x7fff96ffd640 (LWP 13126)]
[New Thread 0x7fff957fa640 (LWP 13127)]
[New Thread 0x7fffd99c0640 (LWP 13138)]
[Thread 0x7fffd88fe640 (LWP 13067) exited]
[Thread 0x7fff77fff640 (LWP 13091) exited]
[Thread 0x7fffd99c0640 (LWP 13138) exited]
[Thread 0x7fff95ffb640 (LWP 13087) exited]
[Thread 0x7fffb57fa640 (LWP 13075) exited]
[Thread 0x7fffb6ffd640 (LWP 13072) exited]
[Thread 0x7fff977fe640 (LWP 13080) exited]
[Thread 0x7fff97fff640 (LWP 13079) exited]
[Thread 0x7fffb77fe640 (LWP 13071) exited]
[Thread 0x7fffdacbe640 (LWP 13059) exited]
[Thread 0x7fffb5ffb640 (LWP 13074) exited]
[Thread 0x7fff967fc640 (LWP 13086) exited]
[Thread 0x7fffb7fff640 (LWP 13070) exited]
[New Thread 0x7fffb7fff640 (LWP 13141)]
[New Thread 0x7fff967fc640 (LWP 13145)]

(evolution:13051): camel-CRITICAL **: 13:40:32.050: camel_data_cache_get_filename: assertion 'CAMEL_IS_DATA_CACHE (cdc)' failed

(evolution:13051): GLib-CRITICAL **: 13:40:32.050: g_file_test: assertion 'filename != NULL' failed

(evolution:13051): GLib-CRITICAL **: 13:40:32.050: g_file_test: assertion 'filename != NULL' failed

(evolution:13051): camel-CRITICAL **: 13:40:32.050: camel_data_cache_get_filename: assertion 'CAMEL_IS_DATA_CACHE (cdc)' failed

(evolution:13051): GLib-CRITICAL **: 13:40:32.050: g_file_test: assertion 'filename != NULL' failed

(evolution:13051): camel-CRITICAL **: 13:40:32.051: camel_data_cache_get_filename: assertion 'CAMEL_IS_DATA_CACHE (cdc)' failed

(evolution:13051): GLib-CRITICAL **: 13:40:32.051: g_filename_to_uri: assertion 'filename != NULL' failed

(evolution:13051): evolution-module-rss-CRITICAL **: 13:40:32.051: file_is_image: assertion 'image != NULL' failed
[New Thread 0x7fffb5ffb640 (LWP 13151)]
[New Thread 0x7fffdacbe640 (LWP 13152)]
[New Thread 0x7fffd99c0640 (LWP 13153)]
[New Thread 0x7fffd88fe640 (LWP 13154)]
[New Thread 0x7fffb77fe640 (LWP 13155)]
[Thread 0x7fffb67fc640 (LWP 13073) exited]
[Thread 0x7fffb7fff640 (LWP 13141) exited]

(evolution:13051): camel-CRITICAL **: 13:40:32.265: camel_data_cache_add: assertion 'CAMEL_IS_DATA_CACHE (cdc)' failed

Thread 1 "evolution" received signal SIGSEGV, Segmentation fault.
0x00007ffff719c824 in g_io_stream_get_output_stream () from /lib/x86_64-linux-gnu/libgio-2.0.so.0
(gdb) bt
#0 0x00007ffff719c824 in g_io_stream_get_output_stream () at /lib/x86_64-linux-gnu/libgio-2.0.so.0
#1 0x00007fffe005b288 in finish_image () at /usr/lib/evolution/modules/evolution-module-rss.so
#2 0x00007fffe005bbaf in finish_image_feedback () at /usr/lib/evolution/modules/evolution-module-rss.so
#3 0x00007ffff23e4efb in () at /lib/x86_64-linux-gnu/libsoup-2.4.so.1
#4 0x00007ffff23d9bf5 in () at /lib/x86_64-linux-gnu/libsoup-2.4.so.1
#5 0x00007ffff23d9c4a in () at /lib/x86_64-linux-gnu/libsoup-2.4.so.1
#6 0x00007ffff703bc44 in g_main_context_dispatch () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7 0x00007ffff7091258 in () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#8 0x00007ffff703b2b3 in g_main_loop_run () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#9 0x00007ffff7648cfd in gtk_main () at /lib/x86_64-linux-gnu/libgtk-3.so.0
#10 0x000055555555984b in main ()
(gdb)

[Damien (takahara)]

After checking more feeds I can confirm that the crash happens when viewing a post that has a picture in it. So it's not a problem with specific feeds, rather it's an issue with images. Which given the crash in finish_image() reported bu GDB above is not surprising ;)