Control: retitle -1 viking: Segmentation fault in gdk_pixbuf_get_n_channels
Control: reassign -1 viking
Control: severity -1 important
On Wed, 12 Aug 2026 at 12:36:34 +0200, Vincent Lefevre wrote:
In Viking, when moving the map with the mouse, I got a
segmentation fault in gdk_pixbuf_get_n_channels.
Here is the entire code for gdk_pixbuf_get_n_channels():
int
gdk_pixbuf_get_n_channels (const GdkPixbuf *pixbuf)
{
g_return_val_if_fail (GDK_IS_PIXBUF (pixbuf), -1);
return pixbuf->n_channels;
}
The only way I can see for this to segfault is if pixbuf is not a valid
pointer, meaning that dereferencing its GTypeInstance->g_class or
GdkPixbuf->n_channels fails. This would point to a memory-management
problem in the calling program, most likely an uninitialized or dangling
pointer, perhaps involving a use-after-free of some larger object.
In the backtrace, the GdkPixbuf pointer can be seen to be
0x55683841303d, which cannot possibly be a validly allocated GdkPixbuf:
you'll notice the numeric value of the pointer is an odd number, but
every instance of a GObject subclass is allocated at a "naturally
aligned" address (at least 8 bytes alignment, but more likely 16 on
amd64) so the last hex-digit of any valid object pointer needs to be 0,
or perhaps rarely 8. This looks like uninitialized or corrupted memory
being interpreted as though it was a pointer to GdkPixbuf.
At the risk of stating the obvious, passing a pointer that is not a
valid GdkPixbuf * to gdk_pixbuf_get_n_channels() is undefined behaviour,
and gdk-pixbuf cannot guarantee any specific result if that happens.
Since images come from the network, this is potentially a
security issue
Modern versions of gdk-pixbuf delegate parsing of
potentially-attacker-controlled image data to glycin, which carries out
this parsing in a sandboxed subprocess, and then operate on uncompressed
images in a simpler format, so this seems unlikely to be a security
issue in gdk-pixbuf's image parsing: if that was crashing anything, it
would be the sandboxed subprocess that crashed.
(And if you believe you have found an undisclosed security
vulnerability, immediately reporting it in public is probably not a
great idea.)
smcv
