Crash & reboot to recovery (Android 11) upon receival of Pixel 7 screens & photos /w specific ICC profile

hondogitsune commented 11 months ago

[X] I have searched open and closed issues for duplicates
[X] I am submitting a bug report for existing functionality that does not work as intended
[X] I have read https://github.com/signalapp/Signal-Android/wiki/Submitting-useful-bug-reports
[X] This isn't a feature request or a discussion topic

Bug description

Unspecific crashing over the last 14 to 21 days that could be isolated down to receiving images from a Pixel 7 user that have a Google Inc. embedded ICC profile. Stripping the colour profile with EXIF removal tools made the images not trigger their crashing behaviour.

Steps to reproduce

App running in background
your friend sends you a JPEG with the below attached Google Inc. ICC v4.3.0 colour profile
for testing if the rest of the JPEG matter it was swapped to a fox and the profile was attached
it was observed the JPEG contents don't matter and presence or absence of the colour profile matters

test.zip test2.zip There is a catch: The image must be new and have never been generated into a preview thumbnail before.

Actual result: Upon receival, screen flickering, complete and absolute loss of control via hardware keys, the device will flicker until death which means full shutdown to recovery mode. The device is now completely off the net and the recovery ROM runs. Expected result: You receive an image and you scream in glee, if everything was working as it should be.

Screenshots

https://archive.org/download/signalbugissue/output1.mp4 https://archive.org/download/signalbugissue/output2.mp4

Watch both videos please!

color-profile-bug

Device info

Device: Xiaomi Redmi Note 8 Pro 128GB mineral grey Android version: Android 11 Signal-Android version: 6.40.5 (latest as of day of report) Signal-Desktop version: 6.39.1 (latest as of day of report) grafik grafik

Link to debug log

Not applicable, there were no errors at the timestamps when the crash happened.

Probably a new variant of an old bug that affected an older and different colour profile on Android 10

This is a completely different ICC colour profile. The behaviour though is exactly the same on the Android 11 OS that was supposed to fix the bug. Google's patch only handles the old colour profile but still breaks on the new one. These files are in the wild, plenty. I crashed a lot because of active group chats over the last couple of weeks. App running in background. All of this started to happen after recent Signal updates. In the past screens and photos with the ICC did not crash me.

Tests: 2020 (old) JPEG ICC bug -> confirmed fixed on Android 11 and 12. This new bug (2023) report for a different JPEG ICC bug -> only crashes Android 11 on receiving. Setting system notifications to not contain name or message content has no effect. Disabling automatic downloading of images prevents crashes.

Theories: Happens on generating the thumbnail only for new images. Why is still a thumbnail generated when notifications are set to not contain name or message? Likely regression bug in Signal since the Pixel 7, Android 13 and the colour profile far from are anything but new. I suspect notifications in Signal are botched because the notifications trip over them even when privacy of content is on.

Guess I can trash my Android 11 (2022) phone because disabling preloading of images is too cumbersome, even if it is better than having your phone rebooted 40 times a week because other people have new devices that can crash me.

Footnotes about the old bug

Reading material about the old Android 10 JPEG ICC (profile 2.1) bug that likely was never fully fixed in Android 11 for other ICCs (profile 4.3.0): https://riverloopsecurity.com/blog/2020/07/android-systemui-icc/ https://issues.skia.org/issues/40041653 https://twitter.com/evowizz/status/1267165374262411270 https://twitter.com/evowizz/status/1267165376128958465

An old demonstration of the issue: https://twitter.com/seb_mc2/status/1266968321733296138 https://video.twimg.com/ext_tw_video/1266967806635126784/pu/vid/720x1280/7XR_OWsbhu_GKCW0.mp4?tag=10

This is not a feature request, but this nonsense would not even happen if the ICC profile would be stripped by the app itself. Why can we NOT have an option to have EXIF and ICC data removed upon sending and receiving? In a public group keeping EXIF would also leak GPS metadata.

There are many good arguments to treat images as malicious and sanitize or check them for junk data that can harm the OS: https://blog.cloudflare.com/uncovering-the-hidden-webp-vulnerability-cve-2023-4863/

hondogitsune commented 11 months ago

grafik All are equal but some are more. Signal.org needs to give the heroes of the android repo more co-workers to ease the workload.

greyson-signal commented 11 months ago

Can you tell me more about how viewing these images works on this device? Can you view it in other apps, your phone gallery, etc? I'm personally trying to reproduce this on a stock Android 11 emulator and can't. I'm not sure if this is related to Xioami's specific Android 11 release, but I can try to get the specific model to see.

Setting system notifications to not contain name or message content has no effect.

This in itself indicates a bug, we shouldn't be generating thumbnails for stuff we won't show. This is being fixed in 6.41.3.

but this nonsense would not even happen if the ICC profile would be stripped by the app itself. Why can we NOT have an option to have EXIF and ICC data removed upon sending and receiving?

The android app re-encodes all outgoing images so as to strip off EXIF data (I imagine ICC too, but I'd have to do more research on that), so that should be happening -- I'll investigate what desktop is doing. Regardless, the receiving-side needs to be able to handle any data.

All are equal but some are more. Signal.org needs to give the heroes of the android repo more co-workers to ease the workload.

Heh, don't mistake commit count as a proxy for work being done :) Android favors meatier commits, we're doing fine :p As far as not having a commit for two weeks, that's because of American Thanksgiving, holdups in the Play Store, etc. We publish commits on a per-release basis and have plenty of changes slated for release.

hondogitsune commented 11 months ago

Okay I try to reply to everything in your post, if my attention manages:

Can you tell me more about how viewing these images works on this device?

I don't have to interact with the message or the image to trigger a crash. Did the 2 videos I recorded help a bit? They should show nicely what I experience IRL from my perspective as user. (Look in the corner of the screen, you see my bandwidth spike as the message is fetched)

Can you view it in other apps, your phone gallery, etc?

Oh yes, the media itself is safe to interact with as much as I want after the crash. The automatic download and notification phase is the spicy part. Which is why I only manually download on phone and limit myself to Signal Desktop now. Maybe a small recap:

notfications OFF + media download ON = crash
MINIMAL notifications (sender/content omitted) + media download ON = crash
image download is OFF + FULL notifications = NO crash
REMOVED ICC + image download is ON + FULL notifications = NO crash

There is clearly a causal link between the download, notifications and ICC presence. Without a debugger or break points, for me this is guesswork and frustrating try&error.

The android app re-encodes all outgoing images so as to strip off EXIF data

Indeed there is no EXIF, just ICC of a Pixel 7 with Android 13, for the latter I vouch as the hex editor shows the presence of a profile that is not from my device. My own screenshots&photos on Android 11 have a way older ICC. Do I blame changes to the app or to Android's 11 notifications backend? The Pixel 7 and Android 13 are not that new, the problems are only since ~1 month at a rough estimate. It has to be a change in the code of any involved Signal or Android code. Blaming the (agreeable lousy) Xiaomi phone is hardly possible, as the device is more or less dead since 1.5 years without stock ROM updates. All is vanilla. We owners are considered EOL.

Heh, don't mistake commit count as a proxy for work being done :)

No offense intended, hence the nod to the good work. You are still flooded with issues by the sheer amount of Android users. Based on store reviews the disparity is 2.4 million : 300k for Android vs iOS.

not having a commit for two weeks, that's because of American Thanksgiving

I feel you, we don't have that and I know how important it is. Especially that you have only a few weeks until Christmas right after. It's just that on mere donations and the smallest staff in big tech it is a miracle you operate a non-profit 501(c)(3) org without becoming incapacitated.

Broswons commented 11 months ago

I apologize to simply jump with this message all here from nowhere, but I can also confirm that this exactly bug also happening for last 10 days on my friend's old Xiaomi Mi A2 Lite mobile phone and with Android 10 OS here installed!!!

This bug is especially triggered by receiving messages within Signal for Android app (presently v6.40.5), and especially in moments when receiving Signal messages with .jpeg images in it.

We was first thinking that it is a low data space on Internal Shared Storage or on SD card, but my friend delete 12GB on his Internal Shared storage and the same amount of data space on his SD Card, so he has plenty of free space now, and his Signal database is about 8.7Gb big in its size.

So, that was not resolve his problem at all.

Then he figured out by himself in a few days, that receiving messages within Signal app. and just after the Signal message receive produce a sound beep on his mobile phone (and especially Signal messages containing .jpeg images), very often triggering this mass flickering Mobile LCD screen then (so you do not have any control over your mobile phone in all that...), which leads at the very end of this flickering to a forced Mobile phone Shut down process just after it. However, instead of Shutting down process really happening here, this will leads to an Android Recovery mode screen instead and with two major options here:

a) Try again (to try again to search Android OS...)

b) Do a Factory data reset (please do not do that if you are not absolutely sure and informed what that means!)

Of course, my friend pick up the Try again option here, and most of the time this really boot his mobile phone back to his normal Android 10 OS environment. But few times, it immediately upon boot normally, again leads to a second Android Recovery mode screen scenario then, but thank Goodness, from a second Try again approach here, it finally works for my friend!

In addition to add, Android Recovery mode screen by default force your mobile LCD screen to be always ON, while you finally decide the option you want to pick it up from here. So, if you are sleeping for e.g., and this Signal bug all of the sudden happens while you are sleeping, you will find yourself in the morning with completely drain mobile battery first, and when you finally charge your phone a little, you will be again in Android Recovery mode screen, just waiting that you press the Try again option from here to "miraculously" engage your mobile phone back normally.

And on this Android Recovery mode screen, the default option that it is already pre-set is Try again option, and you can pick up right this option, just by pressing the ON/OFF button on your Android mobile phone. However, with the Volume Up & Down button on your Android mobile phone you can change your options here. But, like I already said, please do not pick up a Factory data reset option here, if you are not know what you are really doing and did not prior inform yourself what this operation will really do to your mobile phone!

Thank you for reading, all the help and best regards!

hondogitsune commented 11 months ago

@Broswons Your message is excellent. Receiving info from someone with both a different model and Android version is good confirmation, and you can also help your friend by telling him to disable automatic download of images. It is painful to manually click them, but at least you are not put in something worse than airplane mode.

greyson-signal commented 11 months ago

Ok, based on what you're describing, it seems like some recent changes to how we generate notification thumbnails is triggering this system crash (haven't gotten a repro yet on our end). I do want to point out that we simply use system-standard image decoding tools, and nothing an app does should be able to crash the entire phone. This is very much a problem with the OS, but it appears to be a problem we should be able to circumvent if it's true that this issue just started recently.

Looks like both affected phones are older Xiaomi's, I'll see if I can get one and see what's happening.

hondogitsune commented 11 months ago

I do want to point out that we simply use system-standard image decoding tools

Which is why I was worried it could be a new variant of the old JPEG ICC bug, if the fix in Android OS was incomplete. Google, doesn't seem to bother anymore, they just outsource everything as a bug bounty.

but it appears to be a problem we should be able to circumvent

I'd really be happy not to migrate all my data to a new device. Of course the burden should not lie on Signal developers if Google messes up! Either way this will be my last Xiaomi, just in case if they are at fault.

Broswons commented 11 months ago

@hondogitsune Well, I was just trying to be most thorough as possible, and even chronologically most detailed, because I am aware how much that can help in resolving any software bugs, errors, etc., and especially when something is rare & serious like now, that even give as this terrible Android Recovery mode screen bug nightmare to all here. :(

I am also aware that all this great posts here, will quite possibly read many IT Tech layman persons Worldwide, which are also in a huge panic by seeing this strange, black Android Recovery mode screen and are unable to boot normally their mobile phones..., and that in that same screen they can so seriously and so extremely easy, completely mess up their mobile phones, especially in a light if they really do not know for e.g. what Factory data reset operation actually do, so I was also most detailed for all those people...

Now, I am also posting this of my second post here now, because today I found out that now even one of my working colleague on my job has that same Android Recovery mode screen bug, and he also has..., well well..., Xiaomi Mi A2 Lite mobile phone model, and with Android 10 OS on it! :) :(

He has this Android Recovery mode screen bug for last 7 days on this mobile phone, he says to me today..., but he was initially thinking that this bug might happening to him, because this of his old mobile phone battery is maybe malfunctioning here..., but then maybe because he uses an old version of NOVA Launcher app. on this of his mobile phone...

However, he temporary disable NOVA Launcher app., and among any other 3rd party software which he installs and it's running just after or throughout the Android OS boot process and launching (the Earthquake Network Pro app., Data Monitor app., & Transparent clock & weather app.), well everything except ESET Mobile Security app. here which he did not touch, and the AdGuard VPN and AdGuard AdBlocker for Android apps, that he leaves normally engaged just as they are on his mobile phone.

... And even after all this disablings which are just been mentioned here, the Android Recovery mode screen bug still happens to him, and he also have Signal app. for Android v6.40.5 installed on his mobile phone for years by now.

So, I told him today that he is certainly not the only one anymore, that has this Android Recovery mode screen bug. :) :(

And at the very end, I please need your confirmation, if I correctly understand you, that you advice for this temporary Android Recovery mode screen bug circumvent action, is to go via Signal app. for Android, then via 3 dots on the upper right screen -> Settings -> Data and storage:

a) When using mobile data: Just temporary remove check-mark for Images option here.

b) When using Wi-Fi: Just temporary remove check-mark for Images option here.

Once more thank you for all the help and best regards!

greyson-signal commented 11 months ago

I tried repro'ing on my Xiaomi Redmi Note 8, no luck (both on an older and then most recent version of MIUI). I imagine I'll have to get one of these other devices to test.

hondogitsune commented 11 months ago

@greyson-signal What plant or flowername does your device have? I assume you meant Redmi Note 8 (ginkgo) I have Redmi Note 8 Pro (begonia) Broswons mentions Xiaomi Mi A2 Lite (daisy)

Edit: https://miui-germany.de/forum/index.php?thread/20559-xiaomi-smartphone-codename-liste/

Edit 2: https://xiaomifirmwareupdater.com/archive/miui/ginkgo/ https://xiaomifirmwareupdater.com/archive/miui/begonia/ https://xiaomifirmwareupdater.com/archive/miui/daisy/

Just for reference and an overview of MIUI versioning and Android version, if of any use.

Broswons commented 11 months ago

Maybe also needed information here: I call my both friends just an hour ago, and they both confirming to me that they have Xiaomi Mi A2 Lite (Daisy/Daisy_sprout) mobile phones with Android 10 build number QKQ1.191002.002.V11.0.21.0.QDLMIXM, and with Android security update from July 1, 2021..., well, the last one existing for this "old-timer".

And I am writing all this here on their both behalf now, because they do not know English language very well, so they "hire" me here as they advocate and their humble presenter. :)

P.S. They both today early morning stop automatic download of Movies and Images via Mobile data and the Wi-Fi in Signal's app settings. From then there were no more Android Recovery mode screen for now. I will report another post here, if they are still having it.

greyson-signal commented 11 months ago

@hondogitsune Yeah it's ginkgo.

FYI for now, in 6.42, I'm going to put some code to simply disable notification thumbnails for specific models. It's not something I like to do, but at minimum we'll need it as a stop-gap while we try to figure out the actual issue.

hondogitsune commented 11 months ago

@greyson-signal Thunderbird just synced this very minute and I saw your message drop! I am extremely excited that you prioritize this issue so much and that it could be proven many different models may be affected. I believe some people may not be able to make the association to Signal triggering it, as the screen instantly flashes causing confusion.

Very offtop, but I think even if unrelated people here should know: https://www.reuters.com/technology/cybersecurity/governments-spying-apple-google-users-through-push-notifications-us-senator-2023-12-06/

https://www.wyden.senate.gov/imo/media/doc/wyden_smartphone_push_notification_surveillance_letter.pdf

Edit: https://support.signal.org/hc/en-us/articles/360007318711-Troubleshooting-Notifications Even though websockets are probably safe anyway. On iOS it's however simply called "push". /offtop end

stale[bot] commented 9 months ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

stale[bot] commented 8 months ago

This issue has been closed due to inactivity.

signalapp / Signal-Android