Open triallax opened 2 months ago
just asan on glib before wasnt that useful, but building kgx with all its deps as subprojects makes asan detect a uaf
==368639==ERROR: AddressSanitizer: heap-use-after-free on address 0x50400025f150 at pc 0x7353c4ec2eeb bp 0x7ffd48ad3630 sp 0x7ffd48ad3628
READ of size 8 at 0x50400025f150 thread T0
#0 0x7353c4ec2eea in g_type_check_instance_is_fundamentally_a /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gtype.c:4151:41
#1 0x7353c4e85bfd in g_object_unref /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:4327:3
#2 0x7353c414eb8f in g_hash_table_remove_internal /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/ghash.c:1717:3
#3 0x7353c36a6bed in gtk_widget_real_destroy /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkwidget.c:7634:17
#4 0x7353c36a6bed in gtk_widget_dispose /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkwidget.c:7497:7
#5 0x7353c4e85f15 in g_object_unref /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:4415:3
#6 0x7353c28878b8 in adw_tab_page_finalize /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/adwaita/src/adw-tab-view.c:380:3
#7 0x7353c4e8625b in g_object_unref /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:4486:3
#8 0x7353c4ecd9cb in g_value_unset /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gvalue.c:197:5
#9 0x7353c4eae697 in signal_emit_valist_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3552:5
#10 0x7353c4eaef10 in g_signal_emit_valist /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3262:7
#11 0x7353c4eaef10 in g_signal_emit /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3582:3
#12 0x7353c2883e73 in adw_tab_view_close_page /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/adwaita/src/adw-tab-view.c:4291:3
#13 0x7353c3283073 in _gtk_marshal_VOID__INT_DOUBLE_DOUBLEv /tmp/bldroot/builddir/gnome-console-46.0/out-d/subprojects/gtk/gtk/gtkmarshalers.c:3688:3
#14 0x7353c4e78ba0 in _g_closure_invoke_va /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gclosure.c:896:7
#15 0x7353c4eacba1 in signal_emit_valist_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3423:8
#16 0x7353c4eaef10 in g_signal_emit_valist /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3262:7
#17 0x7353c4eaef10 in g_signal_emit /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3582:3
#18 0x7353c341e68f in gtk_gesture_click_end /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkgestureclick.c:275:5
#19 0x7353c4e81390 in g_cclosure_marshal_VOID__BOXEDv /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gmarshal.c:1686:3
#20 0x7353c4e78ba0 in _g_closure_invoke_va /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gclosure.c:896:7
#21 0x7353c4eacba1 in signal_emit_valist_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3423:8
#22 0x7353c4eaef10 in g_signal_emit_valist /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3262:7
#23 0x7353c4eaef10 in g_signal_emit /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3582:3
#24 0x7353c3416edd in _gtk_gesture_set_recognized /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkgesture.c
#25 0x7353c3416edd in _gtk_gesture_check_recognized /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkgesture.c
#26 0x7353c341a40f in gtk_gesture_handle_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkgesture.c:686:15
#27 0x7353c3421136 in gtk_gesture_single_handle_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkgesturesingle.c:227:12
#28 0x7353c33ba122 in gtk_event_controller_handle_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkeventcontroller.c:362:12
#29 0x7353c3691310 in gtk_widget_run_controllers /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkwidget.c:4587:30
#30 0x7353c34ab13a in gtk_propagate_event_internal /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkmain.c:1948:29
#31 0x7353c34aa185 in gtk_main_do_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkmain.c:1688:23
#32 0x7353c39fd958 in _gdk_marshal_BOOLEAN__POINTERv /tmp/bldroot/builddir/gnome-console-46.0/out-d/subprojects/gtk/gdk/gdkmarshalers.c:302:14
#33 0x7353c3b28060 in gdk_surface_event_marshallerv /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gdk/gdksurface.c:462:3
#34 0x7353c4e78ba0 in _g_closure_invoke_va /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gclosure.c:896:7
#35 0x7353c4eacba1 in signal_emit_valist_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3423:8
#36 0x7353c4eaef10 in g_signal_emit_valist /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3262:7
#37 0x7353c4eaef10 in g_signal_emit /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gsignal.c:3582:3
#38 0x7353c3b26792 in gdk_surface_handle_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gdk/gdksurface.c:2932:3
#39 0x7353c3a130b1 in gdk_event_source_dispatch /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gdk/wayland/gdkeventsource.c:142:7
#40 0x7353c417e5c2 in g_main_dispatch /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:3348:27
#41 0x7353c417e5c2 in g_main_context_dispatch_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:4197:7
#42 0x7353c417f523 in g_main_context_iterate_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:4262:5
#43 0x7353c417f895 in g_main_context_iteration /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:4327:12
#44 0x7353c4684921 in g_application_run /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gio/gapplication.c:2715:7
#45 0x630eb033f405 in main /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/main.c:44:10
0x50400025f150 is located 0 bytes inside of 40-byte region [0x50400025f150,0x50400025f178)
freed by thread T0 here:
#0 0x630eb02fff26 in free (/tmp/bldroot/builddir/gnome-console-46.0/out-d/src/kgx+0xfdf26) (BuildId: 13695e40556ebeab)
#1 0x7353c4eb895d in g_type_free_instance /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gtype.c:2030:5
#2 0x630eb03427d8 in glib_autoptr_clear_GObject /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject-autocleanups.h:31:1
#3 0x630eb03427d8 in glib_autoptr_clear_KgxDropTarget /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/kgx-drop-target.h:27:1
#4 0x630eb03427d8 in glib_autoptr_cleanup_KgxDropTarget /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/kgx-drop-target.h:27:1
#5 0x630eb03427d8 in got_text /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/kgx-drop-target.c:337:1
#6 0x7353c462f45b in g_task_return_now /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gio/gtask.c:1361:7
#7 0x7353c462c90e in g_task_return /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gio/gtask.c:1430:15
#8 0x7353c3ad5e20 in gdk_drop_read_value_done /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gdk/gdkdrop.c:734:5
#9 0x7353c3aa92be in gdk_content_deserializer_emit_callback /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gdk/gdkcontentdeserializer.c:341:7
#10 0x7353c417e5c2 in g_main_dispatch /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:3348:27
#11 0x7353c417e5c2 in g_main_context_dispatch_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:4197:7
#12 0x7353c417f523 in g_main_context_iterate_unlocked /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:4262:5
#13 0x7353c417f895 in g_main_context_iteration /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmain.c:4327:12
#14 0x7353c4684921 in g_application_run /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gio/gapplication.c:2715:7
#15 0x630eb033f405 in main /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/main.c:44:10
#16 0x7353c505826c (/lib/ld-musl-x86_64.so.1+0x5826c) (BuildId: 0aa49ea1e4957acd)
#17 0x630eb027d8e5 in _start (/tmp/bldroot/builddir/gnome-console-46.0/out-d/src/kgx+0x7b8e5) (BuildId: 13695e40556ebeab)
previously allocated by thread T0 here:
#0 0x630eb0300209 in calloc (/tmp/bldroot/builddir/gnome-console-46.0/out-d/src/kgx+0xfe209) (BuildId: 13695e40556ebeab)
#1 0x7353c419295a in g_malloc0 /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/glib/gmem.c:133:13
#2 0x7353c4eb7ab9 in g_type_create_instance /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gtype.c:1933:17
#3 0x7353c4e88d7d in g_object_new_internal /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:2606:24
#4 0x7353c4e874bb in g_object_new_with_properties /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:2769:14
#5 0x7353c4e874bb in g_object_new /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:2415:12
#6 0x7353c3332bee in _gtk_builder_construct /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilder.c:999:15
#7 0x7353c334834a in builder_construct /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderparser.c:474:16
#8 0x7353c3343db1 in end_element /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderparser.c:1948:29
#9 0x7353c334001f in proxy_end_element /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderparser.c:104:5
#10 0x7353c36fe61b in replay_end_element /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderprecompile.c:660:3
#11 0x7353c36fe61b in _gtk_buildable_parser_replay_precompiled /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderprecompile.c:742:17
#12 0x7353c333f95e in gtk_buildable_parse_context_parse /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderparser.c:191:13
#13 0x7353c333f95e in _gtk_builder_parser_parse_buffer /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilderparser.c:2203:8
#14 0x7353c3335d2c in gtk_builder_extend_with_template /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkbuilder.c:1561:3
#15 0x7353c369f8e4 in gtk_widget_init_template /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkwidget.c:11225:8
#16 0x630eb03506fe in kgx_tab_init /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/kgx-tab.c:846:3
#17 0x7353c4eb7c01 in g_type_create_instance /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gtype.c:1945:4
#18 0x7353c4e88d7d in g_object_new_internal /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:2606:24
#19 0x7353c4e887d7 in g_object_new_valist /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:2945:16
#20 0x7353c4e8747b in g_object_new /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gobject.c:2418:12
#21 0x630eb033f8f9 in kgx_application_add_terminal /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/kgx-application.c:785:9
#22 0x630eb035d455 in new_tab_activated /tmp/bldroot/builddir/gnome-console-46.0/out-d/../src/kgx-window.c:490:3
#23 0x7353c36f00c7 in gtk_action_muxer_activate_action /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkactionmuxer.c:861:23
#24 0x7353c3564e13 in gtk_named_action_activate /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkshortcutaction.c:1116:3
#25 0x7353c35673b5 in gtk_shortcut_controller_run_controllers /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkshortcutcontroller.c:428:11
#26 0x7353c35673b5 in gtk_shortcut_controller_handle_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkshortcutcontroller.c:473:10
#27 0x7353c33ba122 in gtk_event_controller_handle_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkeventcontroller.c:362:12
#28 0x7353c3691310 in gtk_widget_run_controllers /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkwidget.c:4587:30
#29 0x7353c3691823 in _gtk_widget_captured_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkwidget.c:4748:16
#30 0x7353c34ab040 in gtk_propagate_event_internal /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkmain.c:1916:25
#31 0x7353c34aa185 in gtk_main_do_event /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gtk/gtkmain.c:1688:23
#32 0x7353c39fd958 in _gdk_marshal_BOOLEAN__POINTERv /tmp/bldroot/builddir/gnome-console-46.0/out-d/subprojects/gtk/gdk/gdkmarshalers.c:302:14
#33 0x7353c3b28060 in gdk_surface_event_marshallerv /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/gtk/gdk/gdksurface.c:462:3
SUMMARY: AddressSanitizer: heap-use-after-free /tmp/bldroot/builddir/gnome-console-46.0/out-d/../subprojects/glib/gobject/gtype.c:4151:41 in g_type_check_instance_is_fundamentally_a
Shadow bytes around the buggy address:
0x50400025ee80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
0x50400025ef00: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x50400025ef80: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x50400025f000: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
0x50400025f080: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 00
=>0x50400025f100: fa fa fd fd fd fd fd fd fa fa[fd]fd fd fd fd fa
0x50400025f180: fa fa 00 00 00 00 00 fa fa fa 00 00 00 00 00 fa
0x50400025f200: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
0x50400025f280: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fd
0x50400025f300: fa fa fd fd fd fd fd fd fa fa fd fd fd fd fd fa
0x50400025f380: fa fa fd fd fd fd fd fa fa fa fd fd fd fd fd fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==368639==ABORTING
unsurprisingly dropping the autoptr cleanup in src/kgx-drop-target.c:321 fixes it
that indeed fixes it and seems correct, does this mean that konsole's issue originates from a different place?
i don't think it seems correct, it probably leaks memory or something. but i don't know anything about the code :D
and yeah for all i know konsole is unrelated..
it does leak memory, something is using the drop target object after the callback finishes (perhaps some nonsense with async callbacks, you can never know about their order)
then we want to copy the pointer data instead?
though not sure if the pointer being used after the callback finishes is intended in the first place
it would be nice to test gnome-console master since it might just be fixed but that requires to first patch vte in subproject since it has from_chars float and i wasn't bothered
i looked a bit more into konsole, the call to extractDroppedText
at line 3034 of src/terminalDisplay/TerminalDisplay.cpp calls some exec
thing at line 2977, which calls into whatever event loop thing qt has, and on gnome that somehow results in QtWaylandClient::QWaylandDataDevice::data_device_leave
getting called, which frees mimeData
. this causes the mimeData
access on 3066 to fail
this patch resolves it, but i'm not sure how good of an idea it is:
diff --git a/src/terminalDisplay/TerminalDisplay.cpp b/src/terminalDisplay/TerminalDisplay.cpp
index fa7e67958..b810e172a 100644
--- a/src/terminalDisplay/TerminalDisplay.cpp
+++ b/src/terminalDisplay/TerminalDisplay.cpp
@@ -3029,6 +3029,7 @@ void TerminalDisplay::dropEvent(QDropEvent *event)
}
auto urls = mimeData->urls();
+ bool canBePasted = mimeData->hasFormat(QStringLiteral("text/plain")) || mimeData->hasFormat(QStringLiteral("text/uri-list"));
QString dropText;
if (!urls.isEmpty()) {
dropText = extractDroppedText(urls);
@@ -3063,7 +3064,7 @@ void TerminalDisplay::dropEvent(QDropEvent *event)
dropText = mimeData->text();
}
- if (mimeData->hasFormat(QStringLiteral("text/plain")) || mimeData->hasFormat(QStringLiteral("text/uri-list"))) {
+ if (canBePasted) {
doPaste(dropText, false);
}
it seems correct to me by your reasoning (the data is actually freed after so using it earlier is correct). but i think you'd want to at least make a bz issue (open it against product:konsole on bugs.kde i guess)
Reproduction steps:
backtrace:
this crash is during memory cleanup so it didn't really help me find where the corruption actually happens
the same issue also occurs with konsole running in gnome (but instead konsole immediately crashes):
i suspect that the root issue is somewhere in glib but i'm not entirely certain