eXeC64/imv

Segfault on loading a gif from a list (with support for it disabled)

lanodan opened this issue · 1 comments

Setup:

  • Gentoo Linux, glibc
  • imv 4.1.0(-r1)
  • Pure wayland (not even libX11) in sway
  • x86_64
  • Support for GIF files via libnsgif is disabled

I merely get FreeImage_Load returned NULL when I directly load only one gif but when it's going through a whole directory or simply putting a gif two times I get the following segfault:

Backtrace:


$ ldb imv -- hacks/images/win10_spinner.gif{,}
(lldb) target create "imv"
Current executable set to 'imv' (x86_64).
(lldb) settings set -- target.run-args  "hacks/images/win10_spinner.gif" "hacks/images/win10_spinner.gif"
(lldb) r
Process 25091 launched: '/home/haelwenn/.local/bin/imv' (x86_64)
/home/haelwenn/tmp/xscreensaver-5.44/hacks/images/win10_spinner.gif: Not a TIFF or MDI file, bad magic number 18759 (0x4947).
FreeImage_Load returned NULL/home/haelwenn/tmp/xscreensaver-5.44/hacks/images/win10_spinner.gif: Not a TIFF or MDI file, bad magic number 18759 (0x4947).
Process 25091 stopped
* thread #20, name = 'imv', stop reason = signal SIGSEGV: invalid address (fault address: 0x5573aea8)
    frame #0: 0x00007ffff784e39c libc.so.6`__GI___libc_free(mem=0x000000005573aeb0) at malloc.c:3124:7
(lldb) bt
* thread #20, name = 'imv', stop reason = signal SIGSEGV: invalid address (fault address: 0x5573aea8)
  * frame #0: 0x00007ffff784e39c libc.so.6`__GI___libc_free(mem=0x000000005573aeb0) at malloc.c:3124:7
    frame #1: 0x00005555555648c1 imv`free_private at backend_freeimage.c:31:3
    frame #2: 0x00005555555648b9 imv`free_private(raw_private=0x00005555555d3cb0) at backend_freeimage.c:23
    frame #3: 0x00005555555638e1 imv`imv_source_free(src=0x00005555555d2ef0) at source.c:77:3
    frame #4: 0x0000555555563909 imv`free_thread(src=) at source.c:38:3
    frame #5: 0x00007ffff794ffde libpthread.so.0`start_thread(arg=0x00007fffab7fe640) at pthread_create.c:463:8
    frame #6: 0x00007ffff78b735f libc.so.6`__clone at clone.S:95

Same backtrace but in gdb:


$ gdb imv
[…]
(gdb) r hacks/images/win10_spinner.gif hacks/images/win10_spinner.gif                                                                                                                                                                                                                                                          
[…]
/home/haelwenn/tmp/xscreensaver-5.44/hacks/images/win10_spinner.gif: Not a TIFF or MDI file, bad magic number 18759 (0x4947).
[New Thread 0x7fffaf7fe640 (LWP 26582)]
FreeImage_Load returned NULL[Thread 0x7fffaf7fe640 (LWP 26582) exited]
/home/haelwenn/tmp/xscreensaver-5.44/hacks/images/win10_spinner.gif: Not a TIFF or MDI file, bad magic number 18759 (0x4947).
[New Thread 0x7fffaf7fe640 (LWP 26583)]
[New Thread 0x7fffaeffd640 (LWP 26584)]

Thread 21 "imv" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffaf7fe640 (LWP 26583)]
__GI___libc_free (mem=0x5573aec0) at malloc.c:3122
3122    malloc.c: No such file or directory.
(gdb) bt
#0  __GI___libc_free (mem=0x5573aec0) at malloc.c:3122
#1  0x00005555555648c1 in free_private (raw_private=0x5555555d3cb0) at ../src/backend_freeimage.c:31
#2  free_private (raw_private=0x5555555d3cb0) at ../src/backend_freeimage.c:23
#3  0x00005555555638e1 in imv_source_free (src=0x5555555d2ef0) at ../src/source.c:77
#4  0x0000555555563909 in free_thread (src=) at ../src/source.c:38
#5  0x00007ffff794ffde in start_thread (arg=0x7fffaf7fe640) at pthread_create.c:463
#6  0x00007ffff78b735f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

Is this for any gif, or is there a particular one that's problematic? Can you share the gif file triggering this so I can reproduce?