Control: affects -1 src:nautilus

On Fri, Dec 19, 2014 at 6:31 PM, Simon McVittie <[email protected]> wrote:
[...]
> On 19/12/14 15:17, Mathieu Malaterre wrote:
>> Just for reference, chromium crashed:
>>
>> [86573.137553] chromium[2233]: segfault at 0 ip 00007fce4aeeb785 sp
>> 00007fff21991b20 error 6 in libjasper.so.1.0.0[7fce4aebc000+4f000]
> ...
>> dmesg actually shows two types of crashes [for Nautilus]:
>>
>> [69727.744833] nautilus[11822]: segfault at 7ff85cb2d510 ip
>> 00007ffb50d17d87 sp 00007ffb26eaa6a8 error 4 in
>> libgdk_pixbuf-2.0.so.0.3100.1[7ffb50d03000+20000]
>> [71582.118170] nautilus[13187]: segfault at 0 ip 00007f60f1f56785
>> sp 00007f610c0c55b0 error 6 in libjasper.so.1.0.0[7f60f1f27000+4f000]
>
> Based on this, and on libjasper.so being implicated in your backtrace,
> I think this is at least one bug and one feature request, and possibly
> a second bug:
>
> * bug A: libjasper should not crash when presented with a malformed or
>   truncated .jp2 file

Just for clarification. The file attached 'white.jp2' is a valid JP2
file. It is enormous but still a valid file. For those reading this,
`white.jp2` does contains *lots* of resolution levels therefore
generating a thumbnail out of this file should be trivial (requires
proper implementation though).

> * feature request B: nautilus should run thumbnailers in a subprocess
>   so that a crashing thumbnailer does not bring down all of nautilus

Sorry, I thought that was the case already, when I saw the `clone`
function. But reading the backtrace again it seems to be run in
another thread.

> * bug C: libgdk_pixbuf's JP2 loader might also have a separate crash
>   bug (or it might be dying from memory corruption caused by bug A,
>   in which case this is not its fault)

I haven't been able to reproduce this one. I /think/ this may be
caused by the openjpeg thumbnailer mecanism, but I would need more
nautilus knowledge to check that.

> I'm somewhat sceptical about the feature request, and it might end up
> tagged wontfix with "no, we should fix the decoding libraries instead"
> if people agree with my point of view, but I'll give you the benefit
> of the doubt and clone the bug.

If the source code for nautilus contains code to check for file magic
number it may also be possible to discard JP2 completely
(post-jessie?), or simply discard JP2 with enormous canvas size.

2cts


-- 
To UNSUBSCRIBE, email to [email protected]
with a subject of "unsubscribe". Trouble? Contact [email protected]

Reply via email to