https://bugs.kde.org/show_bug.cgi?id=440958
Bug ID: 440958
Summary: ASAN heap-use-after-free on Search Actions bar.
Product: krita
Version: git master (please specify the git hash!)
Platform: Other
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: General
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
SUMMARY
When trying a search in the Search Actions bar (ctrl+enter) in an ASAN build,
ASAN forces a crash:
=================================================================
==2832662==ERROR: AddressSanitizer: heap-use-after-free on address
0x608001275b44 at pc 0x7ff203b66480 bp 0x7ffdad789050 sp 0x7ffdad7887f8
READ of size 50 at 0x608001275b44 thread T0
#0 0x7ff203b6647f (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
#1 0x7ff1fdd31dda in QString::QString(QChar const*, int)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x14fdda)
#2 0x7ff1fdd3a70d in QStringRef::toString() const
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x15870d)
#3 0x7ff1faaa4b2a in CommandBarFilterModel::filterAcceptsRow(int,
QModelIndex const&) const
/home/wolthera/krita/src/libs/widgetutils/katecommandbar.cpp:60
#4 0x7ff1fde65d5a (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x283d5a)
#5 0x7ff1fde697da in QSortFilterProxyModel::columnCount(QModelIndex const&)
const (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2877da)
#6 0x7ff1febfb27d in QHeaderView::initializeSections()
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x3f827d)
#7 0x7ff1febff3ad in QHeaderView::reset()
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x3fc3ad)
#8 0x7ff1febea8b0 (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x3e78b0)
#9 0x7ff1fdecd7af (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2eb7af)
#10 0x7ff1fde38a50 in
QAbstractItemModel::modelReset(QAbstractItemModel::QPrivateSignal)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x256a50)
#11 0x7ff1faaa214b in CommandBarFilterModel::setFilterString(QString
const&) /home/wolthera/krita/src/libs/widgetutils/katecommandbar.cpp:40
#12 0x7ff1faaa29f1 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0>,
QtPrivate::List<QString const&>, void, void (CommandBarFilterModel::*)(QString
const&)>::call(void (CommandBarFilterModel::*)(QString const&),
CommandBarFilterModel*, void**)
/usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:152
#13 0x7ff1faaa29f1 in void QtPrivate::FunctionPointer<void
(CommandBarFilterModel::*)(QString const&)>::call<QtPrivate::List<QString
const&>, void>(void (CommandBarFilterModel::*)(QString const&),
CommandBarFilterModel*, void**)
/usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:185
#14 0x7ff1faaa29f1 in QtPrivate::QSlotObject<void
(CommandBarFilterModel::*)(QString const&), QtPrivate::List<QString const&>,
void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*)
/usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:418
#15 0x7ff1faaa29f1 in QtPrivate::QSlotObject<void
(CommandBarFilterModel::*)(QString const&), QtPrivate::List<QString const&>,
void>::impl(int, QtPrivate::QSlotObjectBase*, QObject*, void**, bool*)
/usr/include/x86_64-linux-gnu/qt5/QtCore/qobjectdefs_impl.h:411
#16 0x7ff1fdecd77d (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2eb77d)
#17 0x7ff1feabb995 in QLineEdit::textChanged(QString const&)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2b8995)
#18 0x7ff1feac22ba (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2bf2ba)
#19 0x7ff1fdecd7af (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2eb7af)
#20 0x7ff1feac2e68 in QWidgetLineControl::textChanged(QString const&)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2bfe68)
#21 0x7ff1feac675c in QWidgetLineControl::finishChange(int, bool, bool)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2c375c)
#22 0x7ff1feac94aa in QWidgetLineControl::processKeyEvent(QKeyEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2c64aa)
#23 0x7ff1feabba9e in QLineEdit::keyPressEvent(QKeyEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2b8a9e)
#24 0x7ff1fe9b41b4 in QWidget::event(QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1b11b4)
#25 0x7ff1feac1b11 in QLineEdit::event(QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x2beb11)
#26 0x7ff1fe970dc2 in QApplicationPrivate::notify_helper(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x16ddc2)
#27 0x7ff1fe97a365 in QApplication::notify(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x177365)
#28 0x7ff202dfb3b4 in KisApplication::notify(QObject*, QEvent*)
/home/wolthera/krita/src/libs/ui/KisApplication.cpp:703
#29 0x7ff1fde96759 in QCoreApplication::notifyInternal2(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b4759)
#30 0x7ff1fe9d228d (/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x1cf28d)
#31 0x7ff1fe970dc2 in QApplicationPrivate::notify_helper(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x16ddc2)
#32 0x7ff1fe979bb7 in QApplication::notify(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Widgets.so.5+0x176bb7)
#33 0x7ff202dfb3b4 in KisApplication::notify(QObject*, QEvent*)
/home/wolthera/krita/src/libs/ui/KisApplication.cpp:703
#34 0x7ff1fde96759 in QCoreApplication::notifyInternal2(QObject*, QEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b4759)
#35 0x7ff1fe27695a in
QGuiApplicationPrivate::processKeyEvent(QWindowSystemInterfacePrivate::KeyEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Gui.so.5+0x13c95a)
#36 0x7ff1fe27bb3a in
QGuiApplicationPrivate::processWindowSystemEvent(QWindowSystemInterfacePrivate::WindowSystemEvent*)
(/usr/lib/x86_64-linux-gnu/libQt5Gui.so.5+0x141b3a)
#37 0x7ff1fe2537ab in
QWindowSystemInterface::sendWindowSystemEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(/usr/lib/x86_64-linux-gnu/libQt5Gui.so.5+0x1197ab)
#38 0x7ff1f279ae7d (/usr/lib/x86_64-linux-gnu/libQt5XcbQpa.so.5+0x77e7d)
#39 0x7ff1f911917c in g_main_context_dispatch
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x5217c)
#40 0x7ff1f91193ff (/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x523ff)
#41 0x7ff1f91194a2 in g_main_context_iteration
(/usr/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x524a2)
#42 0x7ff1fdef0fb1 in
QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x30efb1)
#43 0x7ff1fde9525a in
QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2b325a)
#44 0x7ff1fde9d413 in QCoreApplication::exec()
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2bb413)
#45 0x559bb82612b7 in main /home/wolthera/krita/src/krita/main.cc:677
#46 0x7ff1fd8180b2 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x270b2)
#47 0x559bb82648ad in _start (/home/wolthera/krita/inst/bin/krita+0x1c8ad)
0x608001275b44 is located 36 bytes inside of 88-byte region
[0x608001275b20,0x608001275b78)
freed by thread T0 here:
#0 0x7ff203bd87cf in __interceptor_free
(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
#1 0x7ff1fdedff4d (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x2fdf4d)
#2 0x7ff1fde65d5a (/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0x283d5a)
previously allocated by thread T0 here:
#0 0x7ff203bd8bc8 in malloc
(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x10dbc8)
#1 0x7ff1fdcbb690 in QArrayData::allocate(unsigned long, unsigned long,
unsigned long, QFlags<QArrayData::AllocationOption>)
(/usr/lib/x86_64-linux-gnu/libQt5Core.so.5+0xd9690)
SUMMARY: AddressSanitizer: heap-use-after-free
(/usr/lib/x86_64-linux-gnu/libasan.so.5+0x9b47f)
Shadow bytes around the buggy address:
0x0c1080246b10: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c1080246b20: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c1080246b30: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1080246b40: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c1080246b50: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c1080246b60: fa fa fa fa fd fd fd fd[fd]fd fd fd fd fd fd fa
0x0c1080246b70: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c1080246b80: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1080246b90: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c1080246ba0: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa
0x0c1080246bb0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==2832662==ABORTING
--
You are receiving this mail because:
You are watching all bug changes.
