https://bugs.kde.org/show_bug.cgi?id=525207

            Bug ID: 525207
           Summary: Crash in wallpaper() D-Bus API: cannot add a null
                    QDBusVariant
    Classification: Plasma
           Product: plasmashell
      Version First 6.7.4
       Reported In:
          Platform: Arch Linux
                OS: Linux
            Status: REPORTED
          Severity: crash
          Priority: NOR
         Component: general
          Assignee: [email protected]
          Reporter: [email protected]
                CC: [email protected]
  Target Milestone: 1.0

SUMMARY
Querying org.kde.PlasmaShell.wallpaper() via D-Bus while the wallpaper settings
dialog is open and switching wallpaper plugins crashes plasmashell with
SIGABRT.

STEPS TO REPRODUCE
1. Run a script or tool that queries wallpaper over D-Bus (e.g. qdbus
org.kde.plasmashell /PlasmaShell org.kde.PlasmaShell.wallpaper 0)
2. Open Desktop and Wallpaper settings
3. Change wallpaper plugin (e.g. Picture of the Day to Image)

OBSERVED RESULT
plasmashell aborts immediately (SIGABRT).

>From journalctl:
plasmashell[PID]: QDBusMarshaller: cannot add a null QDBusVariant
plasmashell[PID]: process PID: arguments to dbus_message_iter_close_container()
were incorrect
systemd[1174]: plasma-plasmashell.service: Main process exited, code=killed,
status=6/ABRT

>From coredumpctl gdb:
#0  __pthread_kill_implementation (threadid=..., signo=6) at pthread_kill.c:44
#1  raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:27
#2  abort () at abort.c:81
#3  qt_message_fatal (...) at global/qlogging.cpp
#4  QDBusMarshaller::appendVariant (customVariant=...) at
/usr/src/debug/qt6-base/src/dbus/qdbusmarshaller.cpp:580
#5  QDBusMarshaller::addBasicType (...)
#6  dbus_message_iter_close_container (...) at libdbus-1.so.3

EXPECTED RESULT
D-Bus method returns the available properties or an empty map without crashing.

ADDITIONAL INFORMATION
In plasma-workspace/shell/shellcorona.cpp (ShellCorona::wallpaper):
- config is not null-checked before accessing keys.
- config->value(itemName) can return an invalid QVariant during plugin
transitions.
Passing an invalid QVariant to QVariantMap causes QDBusMarshaller to fail when
serializing, which triggers the libdbus assertion abort.

-- 
You are receiving this mail because:
You are watching all bug changes.

Reply via email to