Ubuntu 17.10: gnome-paint crashes on "copy"

Bug #1728360 reported by Martin Rosenau
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
gnome-paint
New
Undecided
Unassigned

Bug Description

Symptom:

When selecting a part of the image and performing Edit -> Copy gnome-paint crashes with SIGSEGV.

Analysis of the disassembly:

If a C function is not declared (e.g. in an #include file) many compilers assume the function returns a 32-bit integer. Some other (64-bit) compilers seem to assume a 64-bit return value.

The function "gp_selection_get_pixbuf()" is used by the function "Edit -> Copy" but it is not declared in any #include file (nor in the .c file where it is used).

The function returns a pointer (64-bit).

The compiler which was used to compile the binaries distributed with Ubuntu 17.10 seem to be one of the compilers assuming a signed 32-bit integer.

Therefore the compiler will sign-extend the value returned by "gp_selection_get_pixbuf()" to 64 bits (instead of using the 64-bit pointer)!

The result will be an invalid pointer and therefore a SIGSEGV when this pointer is used.

Disassembly for reference:

    18dc0 <on_menu_copy_activate@@Base>:
       18dc0: 55 : push %rbp
       18dc1: 53 : push %rbx
       ...
       18e55: 48 89 c5 : mov %rax,%rbp
       18e58: 31 c0 : xor %eax,%eax
       18e5a: e8 51 1a 00 00 : callq <gp_selection_get_pixbuf@@Base>
       18e5f: 48 89 ee : mov %rbp,%rsi

       # This line must be "mov %eax,%rdi" (48 89 C7):
       18e62: 48 63 f8 : movslq %eax,%rdi

       18e65: e8 b6 23 ff ff : callq <g_type_check_instance_cast@plt>
       ...

To check if this is really the problem I replaced the bytes 0x63 F8 by the bytes 0x89 C7 in the file /usr/bin/gnome-paint using a hex-editor.

Result: After this patch Edit -> Copy works without problems.

A really correct solution would be adding the function "gp_selection_get_pixbuf()" to a header file and re-compiling.

description: updated
description: updated
description: updated
Revision history for this message
Dominik (dominikdanelski) wrote :

I'll try to investigate that. I did not manage to reproduce it with Linux Mint 18.2, maybe it only affects newest Ubuntu release.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.