Control: tags -1 upstream
Control: forwarded -1 https://github.com/viking-gps/viking/issues/393
On 2026-08-12 13:27:16 +0100, Simon McVittie wrote:
> On Wed, 12 Aug 2026 at 12:36:34 +0200, Vincent Lefevre wrote:
> > In Viking, when moving the map with the mouse, I got a
> > segmentation fault in gdk_pixbuf_get_n_channels.
>
> Here is the entire code for gdk_pixbuf_get_n_channels():
>
> int
> gdk_pixbuf_get_n_channels (const GdkPixbuf *pixbuf)
> {
> g_return_val_if_fail (GDK_IS_PIXBUF (pixbuf), -1);
> return pixbuf->n_channels;
> }
>
> The only way I can see for this to segfault is if pixbuf is not a valid
> pointer, meaning that dereferencing its GTypeInstance->g_class or
> GdkPixbuf->n_channels fails. This would point to a memory-management problem
> in the calling program, most likely an uninitialized or dangling pointer,
> perhaps involving a use-after-free of some larger object.
>
> In the backtrace, the GdkPixbuf pointer can be seen to be 0x55683841303d,
> which cannot possibly be a validly allocated GdkPixbuf: you'll notice the
> numeric value of the pointer is an odd number, but every instance of a
> GObject subclass is allocated at a "naturally aligned" address (at least 8
> bytes alignment, but more likely 16 on amd64) so the last hex-digit of any
> valid object pointer needs to be 0, or perhaps rarely 8. This looks like
> uninitialized or corrupted memory being interpreted as though it was a
> pointer to GdkPixbuf.
Thanks. Since the viking Debian package only has unrelated patches,
this is an upstream bug, which I've just reported.
--
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)
