xfce4-terminal crashed with SIGSEGV in magazine_chain_pop_head()

[pqwoerituytrueiwoq]

[Impact]

When the user opens the encoding menu, xfce4-terminal crashes. This is caused by inappropriate handling of the radio item group used in the menu.

All open xfce4-terminal windows get killed, as they are all the same process. In addition, anything launched from a terminal window, including backgrounded and/or GUI apps, also gets killed. This can lead to a lot of unsaved work getting lost.

The fix does two things: first, simply don't add the non-radio items to the radio item group. Secondly, build the radio item group the way described in the Gtk+ documentation.

[Test Case]

Run xfce4-terminal and click Terminal -> Set Encoding.

[Regression Potential]

Minimal. Currently the crash happens 100% of the time when calling a particular function, and that function is the only one modified by the patch.

The patched xfce4-terminal is available in ppa:a-j-buxton/xfce

--

Tried to open the set encoding menu sub menu under the terminal menu

expected to see a list including UTF-8 bun instead it crashed instead of showing a menu

ProblemType: Crash
DistroRelease: Ubuntu 13.10
Package: xfce4-terminal 0.6.2-3ubuntu1
ProcVersionSignature: Ubuntu 3.10.0-6.17-generic 3.10.3
Uname: Linux 3.10.0-6-generic x86_64
ApportVersion: 2.11-0ubuntu1
Architecture: amd64
Date: Tue Jul 30 20:42:33 2013
ExecutablePath: /usr/bin/xfce4-terminal
InstallationDate: Installed on 2013-07-27 (3 days ago)
InstallationMedia: Xubuntu 13.10 "Saucy Salamander" - Alpha amd64 (20130727)
MarkForUpload: True
ProcCmdline: xfce4-terminal
ProcEnviron:
 LANGUAGE=en_US
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SegvAnalysis:
 Segfault happened at: 0x7f7086d60767 <g_slice_alloc+167>: mov (%rbx),%rax
 PC (0x7f7086d60767) ok
 source "(%rbx)" (0x00000010) not located in a known VMA region (needed readable region)!
 destination "%rax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: xfce4-terminal
StacktraceTop:
 g_slice_alloc () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
 g_slice_alloc0 () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
 ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
 g_type_create_instance () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
Title: xfce4-terminal crashed with SIGSEGV in g_slice_alloc()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo

[Apport retracing service (apport)]

StacktraceTop:
 magazine_chain_pop_head (magazine_chunks=0x7f708add4660) at /build/buildd/glib2.0-2.37.3/./glib/gslice.c:545
 thread_memory_magazine1_alloc (tmem=<optimized out>, ix=0) at /build/buildd/glib2.0-2.37.3/./glib/gslice.c:848
 g_slice_alloc (mem_size=mem_size@entry=16) at /build/buildd/glib2.0-2.37.3/./glib/gslice.c:1007
 g_slice_alloc0 (mem_size=mem_size@entry=16) at /build/buildd/glib2.0-2.37.3/./glib/gslice.c:1042
 g_object_notify_queue_freeze (object=0x7f708afe3db0, conditional=conditional@entry=0) at /build/buildd/glib2.0-2.37.3/./gobject/gobject.c:237

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[David Pires (slickymaster)]

I was able to reproduced it.

System specs:
slickymaster@VirtualBox:~$ lsb_release -a && uname -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu Saucy Salamander (development branch)
Release: 13.10
Codename: saucy
Linux VirtualBox 3.10.0-5-generic #15-Ubuntu SMP Wed Jul 24 19:44:23 UTC 2013 i686 i686 i686 GNU/Linux

Hardware specs:
http://phillw.net/hardware/Ed3c22qV

[Thaddaeus Tintenfisch (thad-fisch-deactivatedaccount)]

I can confirm this reproducible crash. Xubuntu Saucy Beta 2.

[Sergei (sergei-redhat-bugs)]

Description of problem:
I clicked Unmaximized sime times.

Version-Release number of selected component:
xfce4-terminal-0.6.2-2.fc20

Additional info:
reporter: libreport-2.1.7
backtrace_rating: 4
cmdline: /bin/xfce4-terminal
crash_function: magazine_chain_pop_head
executable: /usr/bin/xfce4-terminal
kernel: 3.11.3-301.fc20.i686
runlevel: N 5
type: CCpp
uid: 1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 magazine_chain_pop_head at gslice.c:545
 #1 thread_memory_magazine1_alloc at gslice.c:848
 #2 g_slice_alloc at gslice.c:1007
 #3 g_slice_alloc0 at gslice.c:1042
 #4 g_object_notify_queue_freeze at gobject.c:237
 #5 g_object_init at gobject.c:963
 #6 g_type_create_instance at gtype.c:1862
 #7 g_object_new_internal at gobject.c:1746
 #10 gtk_radio_menu_item_new at gtkradiomenuitem.c:63
 #11 gtk_radio_menu_item_new_with_label at gtkradiomenuitem.c:200

Potential duplicate: bug 1005444

[Sergei (sergei-redhat-bugs)]

Created attachment 808421
File: backtrace

[Sergei (sergei-redhat-bugs)]

Created attachment 808422
File: cgroup

[Sergei (sergei-redhat-bugs)]

Created attachment 808423
File: core_backtrace

[Sergei (sergei-redhat-bugs)]

Created attachment 808424
File: dso_list

[Sergei (sergei-redhat-bugs)]

Created attachment 808425
File: environ

[Sergei (sergei-redhat-bugs)]

Created attachment 808426
File: exploitable

[Sergei (sergei-redhat-bugs)]

Created attachment 808427
File: limits

[Sergei (sergei-redhat-bugs)]

Created attachment 808428
File: maps

[Sergei (sergei-redhat-bugs)]

Created attachment 808429
File: open_fds

[Sergei (sergei-redhat-bugs)]

Created attachment 808430
File: proc_pid_status

[Sergei (sergei-redhat-bugs)]

Created attachment 808431
File: var_log_messages

[Kevin (kevin-redhat-bugs)]

Can you duplicate the crash? How many times did you click unminimize?

[Jackson Doak (noskcaj)]

There appears to be a patch in upstream. The next steps would be adding the patch to ubuntu and seeing if it affects debian

[Alistair Buxton (a-j-buxton)]

That patch is available in one of my ppas - ppa:a-j-buxton/xfce - use at
your own risk of course.
On 28 Oct 2013 07:01, "Jackson Doak" <email address hidden> wrote:

> ** Bug watch added: Red Hat Bugzilla #1015850
> https://bugzilla.redhat.com/show_bug.cgi?id=1015850
>
> ** Also affects: xfce4-terminal (Fedora) via
> https://bugzilla.redhat.com/show_bug.cgi?id=1015850
> Importance: Unknown
> Status: Unknown
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/1206739
>
> Title:
> xfce4-terminal crashed with SIGSEGV in magazine_chain_pop_head()
>
> Status in XFCE4 Terminal Emulator:
> Unknown
> Status in “xfce4-terminal” package in Ubuntu:
> Confirmed
> Status in “xfce4-terminal” package in Fedora:
> Unknown
>
> Bug description:
> Tried to open the set encoding menu sub menu under the termianl menu
>
> expected to see a list including UTF-8 bun instead it crashed instead
> of showowing a menu
>
> ProblemType: Crash
> DistroRelease: Ubuntu 13.10
> Package: xfce4-terminal 0.6.2-3ubuntu1
> ProcVersionSignature: Ubuntu 3.10.0-6.17-generic 3.10.3
> Uname: Linux 3.10.0-6-generic x86_64
> ApportVersion: 2.11-0ubuntu1
> Architecture: amd64
> Date: Tue Jul 30 20:42:33 2013
> ExecutablePath: /usr/bin/xfce4-terminal
> InstallationDate: Installed on 2013-07-27 (3 days ago)
> InstallationMedia: Xubuntu 13.10 "Saucy Salamander" - Alpha amd64
> (20130727)
> MarkForUpload: True
> ProcCmdline: xfce4-terminal
> ProcEnviron:
> LANGUAGE=en_US
> PATH=(custom, no user)
> XDG_RUNTIME_DIR=<set>
> LANG=en_US.UTF-8
> SHELL=/bin/bash
> SegvAnalysis:
> Segfault happened at: 0x7f7086d60767 <g_slice_alloc+167>: mov
> (%rbx),%rax
> PC (0x7f7086d60767) ok
> source "(%rbx)" (0x00000010) not located in a known VMA region (needed
> readable region)!
> destination "%rax" ok
> SegvReason: reading NULL VMA
> Signal: 11
> SourcePackage: xfce4-terminal
> StacktraceTop:
> g_slice_alloc () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
> g_slice_alloc0 () from /lib/x86_64-linux-gnu/libglib-2.0.so.0
> ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
> ?? () from /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
> g_type_create_instance () from
> /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
> Title: xfce4-terminal crashed with SIGSEGV in g_slice_alloc()
> UpgradeStatus: No upgrade log present (probably fresh install)
> UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/xfce4-terminal/+bug/1206739/+subscriptions
>

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "fix-encoding-menu.diff" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Launchpad Janitor (janitor)]

This bug was fixed in the package xfce4-terminal - 0.6.2-3ubuntu2

---------------
xfce4-terminal (0.6.2-3ubuntu2) trusty; urgency=low

  * Fix encoding menu crash. (LP: #1206739)
    - Don't add non-radio items to the radio item group.
    - Don't leak list nodes by prepending twice to the same list.
 -- Alistair Buxton <email address hidden> Thu, 24 Oct 2013 01:01:14 +0100

[Julian Taylor (jtaylor)]

I have uploaded the fix to saucy-proposed, thanks for the patch

please test it when it has been accepted, the release team will post instructions in this bug.

[Stéphane Graber (stgraber)]

Hello pqwoerituytrueiwoq, or anyone else affected,

Accepted xfce4-terminal into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xfce4-terminal/0.6.2-3ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Germán (germn-redhat-bugs)]

Another user experienced a similar problem:

This happens always:
1) Open xfce4-terminal (enable menubar if it is disabled, with right click)
2) Click Terminal -> Set Encoding
2) Segmentation fault (core dumped)

reporter: libreport-2.1.10
backtrace_rating: 4
cmdline: xfce4-terminal
crash_function: magazine_chain_pop_head
executable: /usr/bin/xfce4-terminal
kernel: 3.12.5-302.fc20.x86_64
package: xfce4-terminal-0.6.2-3.fc20
reason: xfce4-terminal killed by SIGSEGV
runlevel: N 5
type: CCpp
uid: 1000

[Kevin (kevin-redhat-bugs)]

This is https://bugzilla.xfce.org/show_bug.cgi?id=10395 upstream already with a patch. ;)

I will look at pushing updates...

[Kevin (kevin-redhat-bugs)]

*** Bug 1005444 has been marked as a duplicate of this bug. ***

[Germán (germn-redhat-bugs)]

(In reply to Kevin Fenzi from comment #14)
> This is https://bugzilla.xfce.org/show_bug.cgi?id=10395 upstream already
> with a patch. ;)
>
> I will look at pushing updates...

Thanks for your prompt reply Kevin! :)

[Fedora (fedora-redhat-bugs)]

xfce4-terminal-0.6.2-4.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/xfce4-terminal-0.6.2-4.fc20

[Fedora (fedora-redhat-bugs)]

xfce4-terminal-0.6.2-4.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/xfce4-terminal-0.6.2-4.fc19

[Konstantin (konstantin-redhat-bugs)]

Another user experienced a similar problem:

I was browsing Terminal menu options, didn't press anything at the moment of crash

reporter: libreport-2.1.10
backtrace_rating: 4
cmdline: xfce4-terminal
crash_function: magazine_chain_pop_head
executable: /usr/bin/xfce4-terminal
kernel: 3.12.5-302.fc20.x86_64
package: xfce4-terminal-0.6.2-3.fc20
reason: xfce4-terminal killed by SIGSEGV
runlevel: N 5
type: CCpp
uid: 1000

[Fedora (fedora-redhat-bugs)]

Package xfce4-terminal-0.6.2-4.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing xfce4-terminal-0.6.2-4.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-23914/xfce4-terminal-0.6.2-4.fc19
then log in and leave karma (feedback).

[Kevin (kevin-redhat-bugs)]

*** Bug 1046449 has been marked as a duplicate of this bug. ***

[Fedora (fedora-redhat-bugs)]

xfce4-terminal-0.6.3-1.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/xfce4-terminal-0.6.3-1.fc20

[Fedora (fedora-redhat-bugs)]

xfce4-terminal-0.6.3-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/xfce4-terminal-0.6.3-1.fc19

[Fedora (fedora-redhat-bugs)]

xfce4-terminal-0.6.3-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.

[Fedora (fedora-redhat-bugs)]

xfce4-terminal-0.6.3-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.

[Thaddaeus Tintenfisch (thad-fisch-deactivatedaccount)]

Package from saucy-proposed (0.6.2-3ubuntu1.1) fixed this bug for me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xfce4-terminal - 0.6.2-3ubuntu1.1

---------------
xfce4-terminal (0.6.2-3ubuntu1.1) saucy-proposed; urgency=low

  * Fix encoding menu crash. (LP: #1206739)
    - Don't add non-radio items to the radio item group.
    - Don't leak list nodes by prepending twice to the same list.
 -- Alistair Buxton <email address hidden> Thu, 24 Oct 2013 01:01:14 +0100

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for xfce4-terminal has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Sergei (sergei-redhat-bugs)]

I write this comment because I receive email with subj "[Red Hat Bugzilla] Your Outstanding Requests" periodically.
I have not additional info because I use Arch Linux now.