https://bugs.kde.org/show_bug.cgi?id=356649
Bug ID: 356649
Summary: use-after-free crash on closing ark on previewing an
archive
Product: ark
Version: 2.19
Platform: Other
OS: Linux
Status: UNCONFIRMED
Severity: crash
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Ark crashes on a use-after-free on previewing an archive.
Open an archive using ark.
Right click on it and ask for a preview. When the preview window is open, close
ark as
"qdbus `qdbus | grep ark` /ark/MainWindow_1/actions/file_quit trigger"
Reproducible: Always
Steps to Reproduce:
1. Open an archive using ark
2. Right click on the archive and select preview
3. When the preview window is open, from a terminal, issue "qdbus `qdbus | grep
ark` /ark/MainWindow_1/actions/file_quit trigger"
Actual Results:
Ark crashes
Expected Results:
Ark closes smoothly
I investigated this bug by compiling ark with AddressSanitizer instrumentation.
(http://clang.llvm.org/docs/AddressSanitizer.html)
AddressSanitizer flagged this as a use-after-free bug. Please find the stacks
reported by KCrash and AddressSanitizer below.
==========
ark Version
==========
Qt: 4.8.7
KDE Development Platform: 4.14.13
Ark: 2.19
===========
KCrash Stack
===========
Application: Ark (ark), signal: Segmentation fault
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[KCrash Handler]
#6 QWidget::windowType (this=0x91) at
qt/src/gui/../../include/QtGui/../../src/gui/kernel/qwidget.h:938
#7 0x00007f5c464cb6e5 in QWidget::isWindow (this=0x91) at
qt/src/gui/../../include/QtGui/../../src/gui/kernel/qwidget.h:946
#8 0x00007f5c4653b1eb in QWidgetPrivate::setEnabled_helper (this=0x1c08fb0,
enable=true) at kernel/qwidget.cpp:3386
#9 0x00007f5c4653b19d in QWidget::setEnabled (this=0x18cb360, enable=true) at
kernel/qwidget.cpp:3379
#10 0x00007f5c3a3ae9ef in Ark::Part::setReadyGui (this=0x186c440) at
KDE/kde/kdeutils/ark/part/part.cpp:530
#11 0x00007f5c3a3af6fc in Ark::Part::slotPreviewExtracted (this=0x186c440,
job=<optimized out>) at KDE/kde/kdeutils/ark/part/part.cpp:620
#12 0x00007f5c3a3a49c0 in Ark::Part::qt_static_metacall (_o=0x186c440,
_c=<optimized out>, _id=<optimized out>, _a=0x7f5c30001b10) at
KDE/build/kde/kdeutils/ark/part/moc_part.cpp:106
#13 0x00007f5c44a8d69d in QMetaCallEvent::placeMetaCall (this=0x7f5c30002280,
object=0x186c440) at kernel/qobject.cpp:524
#14 0x00007f5c44a8fa10 in QObject::event (this=0x186c440, e=0x7f5c30002280) at
kernel/qobject.cpp:1222
#15 0x00007f5c464c148f in QApplicationPrivate::notify_helper (this=0x16a4450,
receiver=0x186c440, e=0x7f5c30002280) at kernel/qapplication.cpp:4565
#16 0x00007f5c464c3a8e in QApplication::notify (this=0x7fff19c5c2b8,
receiver=0x186c440, e=0x7f5c30002280) at kernel/qapplication.cpp:3947
#17 0x00007f5c47864f7b in KApplication::notify (this=0x7fff19c5c2b8,
receiver=0x186c440, event=0x7f5c30002280) at
KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311
#18 0x00007f5c44a6edc6 in QCoreApplication::notifyInternal
(this=0x7fff19c5c2b8, receiver=0x186c440, event=0x7f5c30002280) at
kernel/qcoreapplication.cpp:955
#19 0x00007f5c44a7354a in QCoreApplication::sendEvent (receiver=0x186c440,
event=0x7f5c30002280) at
qt/src/corelib/../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:231
#20 0x00007f5c44a703f4 in QCoreApplicationPrivate::sendPostedEvents
(receiver=0x0, event_type=0, data=0x16784e0) at
kernel/qcoreapplication.cpp:1609
#21 0x00007f5c44a6f338 in QCoreApplication::sendPostedEvents (receiver=0x0,
event_type=0) at kernel/qcoreapplication.cpp:1477
#22 0x00007f5c465c8b48 in QCoreApplication::sendPostedEvents () at
qt/src/gui/../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:236
#23 0x00007f5c465d9082 in QEventDispatcherX11::processEvents (this=0x167fbc0,
flags=...) at kernel/qeventdispatcher_x11.cpp:82
#24 0x00007f5c44a69f6c in QEventLoop::processEvents (this=0x7fff19c5c080,
flags=...) at kernel/qeventloop.cpp:149
#25 0x00007f5c44a6a332 in QEventLoop::exec (this=0x7fff19c5c080, flags=...) at
kernel/qeventloop.cpp:225
#26 0x00007f5c44a6f5ee in QCoreApplication::exec () at
kernel/qcoreapplication.cpp:1229
#27 0x00007f5c464c3526 in QApplication::exec () at kernel/qapplication.cpp:3823
#28 0x0000000000412a4e in main (argc=<optimized out>, argv=<optimized out>) at
KDE/kde/kdeutils/ark/app/main.cpp:206
====================
Address Sanitizer Stack
====================
==23363==ERROR: AddressSanitizer: heap-use-after-free on address 0x60f000016328
at pc 0x7f4ef3d534e6 bp 0x7fff4cc92ef0 sp 0x7fff4cc92ee8
WRITE of size 1 at 0x60f000016328 thread T0
#0 0x7f4ef3d534e5 in Ark::Part::setReadyGui()
KDE/kde/kdeutils/ark/part/part.cpp:529
#1 0x7f4ef3d55885 in Ark::Part::slotPreviewExtracted(KJob*)
KDE/kde/kdeutils/ark/part/part.cpp:620
#2 0x7f4ef3d38644 in Ark::Part::qt_static_metacall(QObject*,
QMetaObject::Call, int, void**)
KDE/build-asan/kde/kdeutils/ark/part/moc_part.cpp:106
#3 0x7f4f02cdc3cc in QMetaCallEvent::placeMetaCall(QObject*)
(install/qt4/lib/libQtCore.so.4+0x24c3cc)
#4 0x7f4f02cde73f in QObject::event(QEvent*)
(install/qt4/lib/libQtCore.so.4+0x24e73f)
#5 0x7f4f0422329e in QApplicationPrivate::notify_helper(QObject*, QEvent*)
(install/qt4/lib/libQtGui.so.4+0x23529e)
#6 0x7f4f0422589d in QApplication::notify(QObject*, QEvent*)
(install/qt4/lib/libQtGui.so.4+0x23789d)
#7 0x7f4f05ae5340 in KApplication::notify(QObject*, QEvent*)
KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311
#8 0x7f4f02cbdb15 in QCoreApplication::notifyInternal(QObject*, QEvent*)
(install/qt4/lib/libQtCore.so.4+0x22db15)
#9 0x7f4f02cc2279 in QCoreApplication::sendEvent(QObject*, QEvent*)
(install/qt4/lib/libQtCore.so.4+0x232279)
#10 0x7f4f02cbf123 in QCoreApplicationPrivate::sendPostedEvents(QObject*,
int, QThreadData*) (install/qt4/lib/libQtCore.so.4+0x22f123)
#11 0x7f4f02cbe087 in QCoreApplication::sendPostedEvents(QObject*, int)
(install/qt4/lib/libQtCore.so.4+0x22e087)
#12 0x7f4f0432a957 in QCoreApplication::sendPostedEvents()
(install/qt4/lib/libQtGui.so.4+0x33c957)
#13 0x7f4f0433ae91 in
QEventDispatcherX11::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtGui.so.4+0x34ce91)
#14 0x7f4f02cb8edb in
QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x228edb)
#15 0x7f4f02cb91ed in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x2291ed)
#16 0x7f4f02cbe316 in QCoreApplication::exec()
(install/qt4/lib/libQtCore.so.4+0x22e316)
#17 0x7f4f04225335 in QApplication::exec()
(install/qt4/lib/libQtGui.so.4+0x237335)
#18 0x461a30 in main (KDE/install-asan/bin/ark+0x461a30)
#19 0x7f4f018b476c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
#20 0x44e9dc in _start (KDE/install-asan/bin/ark+0x44e9dc)
0x60f000016328 is located 136 bytes inside of 176-byte region
[0x60f0000162a0,0x60f000016350)
freed by thread T0 here:
#0 0x439ffa in operator delete(void*) (KDE/install-asan/bin/ark+0x439ffa)
#1 0x7f4ef3d40a49 in Ark::Part::~Part()
KDE/kde/kdeutils/ark/part/part.cpp:141
#2 0x46a0fc in MainWindow::~MainWindow()
(KDE/install-asan/bin/ark+0x46a0fc)
#3 0x469963 in MainWindow::~MainWindow()
(KDE/install-asan/bin/ark+0x469963)
#4 0x7f4f02cdeb6d in qDeleteInEventHandler(QObject*)
(install/qt4/lib/libQtCore.so.4+0x24eb6d)
#5 0x7f4f02cde6d7 in QObject::event(QEvent*)
(install/qt4/lib/libQtCore.so.4+0x24e6d7)
#6 0x7f4f042ae155 in QWidget::event(QEvent*)
(install/qt4/lib/libQtGui.so.4+0x2c0155)
#7 0x7f4f048cfd82 in QMainWindow::event(QEvent*)
(install/qt4/lib/libQtGui.so.4+0x8e1d82)
#8 0x7f4f05e05133 in KMainWindow::event(QEvent*)
KDE/kde/kdelibs/kdeui/widgets/kmainwindow.cpp:1126
#9 0x7f4f05f0b0b2 in KXmlGuiWindow::event(QEvent*)
KDE/kde/kdelibs/kdeui/xmlgui/kxmlguiwindow.cpp:126
#10 0x7f4f0422329e in QApplicationPrivate::notify_helper(QObject*, QEvent*)
(install/qt4/lib/libQtGui.so.4+0x23529e)
#11 0x7f4f0422913b in QApplication::notify(QObject*, QEvent*)
(install/qt4/lib/libQtGui.so.4+0x23b13b)
#12 0x7f4f05ae5340 in KApplication::notify(QObject*, QEvent*)
KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311
#13 0x7f4f02cbdb15 in QCoreApplication::notifyInternal(QObject*, QEvent*)
(install/qt4/lib/libQtCore.so.4+0x22db15)
#14 0x7f4f02cc2279 in QCoreApplication::sendEvent(QObject*, QEvent*)
(install/qt4/lib/libQtCore.so.4+0x232279)
#15 0x7f4f02cbf123 in QCoreApplicationPrivate::sendPostedEvents(QObject*,
int, QThreadData*) (install/qt4/lib/libQtCore.so.4+0x22f123)
#16 0x7f4f02d10026 in
QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x280026)
#17 0x7f4f0433b479 in
QEventDispatcherX11::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtGui.so.4+0x34d479)
#18 0x7f4f02cb8edb in
QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x228edb)
#19 0x7f4f02cb91ed in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x2291ed)
#20 0x7f4f049d7a9a in QDialog::exec()
(install/qt4/lib/libQtGui.so.4+0x9e9a9a)
#21 0x7f4f058719dc in KMessageBox::createKMessageBox(KDialog*, QIcon
const&, QString const&, QStringList const&, QString const&, bool*,
QFlags<KMessageBox::Option>, QString const&, QMessageBox::Icon)
KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:344
#22 0x7f4f0586efe1 in KMessageBox::createKMessageBox(KDialog*,
QMessageBox::Icon, QString const&, QStringList const&, QString const&, bool*,
QFlags<KMessageBox::Option>, QString const&)
KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:158
#23 0x7f4f0587c361 in KMessageBox::warningContinueCancelListWId(unsigned
long, QString const&, QStringList const&, QString const&, KGuiItem const&,
KGuiItem const&, QString const&, QFlags<KMessageBox::Option>)
KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:714
#24 0x7f4f0587adae in QFlags install/qt4/include/QtCore/qglobal.h:2434
#25 0x7f4f0587adae in QFlags install/qt4/include/QtCore/qglobal.h:2434
#26 0x7f4f0587adae in QStringList
KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:676
#27 0x7f4f0587adae in KMessageBox::warningContinueCancel(QWidget*, QString
const&, QString const&, KGuiItem const&, KGuiItem const&, QString const&,
QFlags<KMessageBox::Option>) KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:652
#28 0x7f4ef3d796a1 in ArkViewer::view(QString const&, QWidget*)
KDE/kde/kdeutils/ark/part/arkviewer.cpp:135
#29 0x7f4ef3d5544f in Ark::Part::slotPreviewExtracted(KJob*)
KDE/kde/kdeutils/ark/part/part.cpp:609
#30 0x7f4ef3d38644 in Ark::Part::qt_static_metacall(QObject*,
QMetaObject::Call, int, void**)
KDE/build-asan/kde/kdeutils/ark/part/moc_part.cpp:106
#31 0x7f4f02cdc3cc in QMetaCallEvent::placeMetaCall(QObject*)
(install/qt4/lib/libQtCore.so.4+0x24c3cc)
#32 0x7f4f02cde73f in QObject::event(QEvent*)
(install/qt4/lib/libQtCore.so.4+0x24e73f)
#33 0x7f4f0422329e in QApplicationPrivate::notify_helper(QObject*, QEvent*)
(install/qt4/lib/libQtGui.so.4+0x23529e)
#34 0x7f4f0422589d in QApplication::notify(QObject*, QEvent*)
(install/qt4/lib/libQtGui.so.4+0x23789d)
#35 0x7f4f05ae5340 in KApplication::notify(QObject*, QEvent*)
KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311
#36 0x7f4f02cbdb15 in QCoreApplication::notifyInternal(QObject*, QEvent*)
(install/qt4/lib/libQtCore.so.4+0x22db15)
#37 0x7f4f02cc2279 in QCoreApplication::sendEvent(QObject*, QEvent*)
(install/qt4/lib/libQtCore.so.4+0x232279)
#38 0x7f4f02cbf123 in QCoreApplicationPrivate::sendPostedEvents(QObject*,
int, QThreadData*) (install/qt4/lib/libQtCore.so.4+0x22f123)
#39 0x7f4f02cbe087 in QCoreApplication::sendPostedEvents(QObject*, int)
(install/qt4/lib/libQtCore.so.4+0x22e087)
#40 0x7f4f0432a957 in QCoreApplication::sendPostedEvents()
(install/qt4/lib/libQtGui.so.4+0x33c957)
#41 0x7f4f0433ae91 in
QEventDispatcherX11::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtGui.so.4+0x34ce91)
#42 0x7f4f02cb8edb in
QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x228edb)
#43 0x7f4f02cb91ed in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
(install/qt4/lib/libQtCore.so.4+0x2291ed)
#44 0x7f4f02cbe316 in QCoreApplication::exec()
(install/qt4/lib/libQtCore.so.4+0x22e316)
#45 0x7f4f04225335 in QApplication::exec()
(install/qt4/lib/libQtGui.so.4+0x237335)
#46 0x461a30 in main (KDE/install-asan/bin/ark+0x461a30)
#47 0x7f4f018b476c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
#48 0x44e9dc in _start (KDE/install-asan/bin/ark+0x44e9dc)
previously allocated by thread T0 here:
#0 0x439d7a in operator new(unsigned long)
(KDE/install-asan/bin/ark+0x439d7a)
#1 0x7f4ef3d6ac49 in QObject*
KPluginFactory::createPartInstance<Ark::Part>(QWidget*, QObject*,
QList<QVariant> const&) KDE/install-asan/include/kpluginfactory.h:483
#2 0x7f4f03b160cc in KPluginFactory::create(char const*, QWidget*,
QObject*, QList<QVariant> const&, QString const&)
KDE/kde/kdelibs/kdecore/util/kpluginfactory.cpp:203
#3 0x4704f4 in KParts::ReadWritePart*
KPluginFactory::create<KParts::ReadWritePart>(QObject*, QList<QVariant> const&)
(KDE/install-asan/bin/ark+0x4704f4)
#4 0x46bc23 in MainWindow::loadPart() (KDE/install-asan/bin/ark+0x46bc23)
#5 0x46133c in main (KDE/install-asan/bin/ark+0x46133c)
#6 0x7f4f018b476c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c)
#7 0x44e9dc in _start (KDE/install-asan/bin/ark+0x44e9dc)
SUMMARY: AddressSanitizer: heap-use-after-free
KDE/kde/kdeutils/ark/part/part.cpp:529 Ark::Part::setReadyGui()
Shadow bytes around the buggy address:
0x0c1e7fffac10: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
0x0c1e7fffac20: fd fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa
0x0c1e7fffac30: fa fa fa fa fa fa fd fd fd fd fd fd fd fd fd fd
0x0c1e7fffac40: fd fd fd fd fd fd fd fd fd fd fd fd fa fa fa fa
0x0c1e7fffac50: fa fa fa fa fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c1e7fffac60: fd fd fd fd fd[fd]fd fd fd fd fa fa fa fa fa fa
0x0c1e7fffac70: fa fa 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1e7fffac80: 00 00 00 00 00 00 00 fa fa fa fa fa fa fa fa fa
0x0c1e7fffac90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c1e7fffaca0: 00 00 00 00 00 fa fa fa fa fa fa fa fa fa 00 00
0x0c1e7fffacb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap right redzone: fb
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
==23363==ABORTING
--
You are receiving this mail because:
You are watching all bug changes.
