Bug 352856

Summary:	Baloo file extractor crashes in libexiv2 in Exiv2::ValueType()
Product:	[Frameworks and Libraries] frameworks-kfilemetadata	Reporter:	Brad Hubbard <bhubbard>
Component:	general	Assignee:	Pinak Ahuja <pinak.ahuja>
Status:	RESOLVED FIXED
Severity:	crash	CC:	aspotashev, jr.linux, nate, strobel, vhradice, zhuravlov.ip
Priority:	NOR	Keywords:	drkonqi
Version:	unspecified
Target Milestone:	---
Platform:	unspecified
OS:	Linux
Latest Commit:	https://commits.kde.org/kfilemetadata/5eee9ac75b7d6bb19795c2d3b964fe05fd8fc47c	Version Fixed In:	5.52
Sentry Crash Report:

Description Brad Hubbard 2015-09-17 20:38:56 UTC

Application: baloo_file_extractor (5.13.0)

Qt Version: 5.5.0
Operating System: Linux 4.1.6-201.fc22.x86_64 x86_64
Distribution: "Fedora release 22 (Twenty Two)"

-- Information about the crash:
- What I was doing when the application crashed: Every time I log in I get a Dr. Konqi eport about a crash in  Baloo file extractor. I'm not even sure why this is running at log in?

The crash can be reproduced every time.

-- Backtrace:
Application: Baloo File Extractor (baloo_file_extractor), signal: Segmentation fault
Using host libthread_db library "/lib64/libthread_db.so.1".
[KCrash Handler]
#5  0x00007fbb6096d238 in Exiv2::ValueType<std::pair<unsigned int, unsigned int> >::toFloat(long) const () at /lib64/libexiv2.so.13
#6  0x00007fbb60d6c2e0 in (anonymous namespace)::toVariantDouble(Exiv2::Value const&) [clone .constprop.34] () at /usr/lib64/qt5/plugins/kf5/kfilemetadata/kfilemetadata_exiv2extractor.so
#7  0x00007fbb60d6dba0 in KFileMetaData::Exiv2Extractor::add(KFileMetaData::ExtractionResult*, Exiv2::ExifData const&, KFileMetaData::Property::Property, char const*, QVariant::Type) [clone .constprop.28] () at /usr/lib64/qt5/plugins/kf5/kfilemetadata/kfilemetadata_exiv2extractor.so
#8  0x00007fbb60d6e123 in KFileMetaData::Exiv2Extractor::extract(KFileMetaData::ExtractionResult*) () at /usr/lib64/qt5/plugins/kf5/kfilemetadata/kfilemetadata_exiv2extractor.so
#9  0x000000000040bf53 in Baloo::App::index(Baloo::Transaction*, QString const&, unsigned long long) ()
#10 0x000000000040ca81 in Baloo::App::slotNewInput() ()
#11 0x00007fbb72b28fe7 in QMetaObject::activate(QObject*, int, int, void**) () at /lib64/libQt5Core.so.5
#12 0x00007fbb72ba866e in QSocketNotifier::activated(int, QSocketNotifier::QPrivateSignal) () at /lib64/libQt5Core.so.5
#13 0x00007fbb72b3563b in QSocketNotifier::event(QEvent*) () at /lib64/libQt5Core.so.5
#14 0x00007fbb72afa5fc in QCoreApplication::notifyInternal(QObject*, QEvent*) () at /lib64/libQt5Core.so.5
#15 0x00007fbb72b5125d in socketNotifierSourceDispatch(_GSource*, int (*)(void*), void*) () at /lib64/libQt5Core.so.5
#16 0x00007fbb6ce7fa8a in g_main_context_dispatch () at /lib64/libglib-2.0.so.0
#17 0x00007fbb6ce7fe20 in g_main_context_iterate.isra () at /lib64/libglib-2.0.so.0
#18 0x00007fbb6ce7fecc in g_main_context_iteration () at /lib64/libglib-2.0.so.0
#19 0x00007fbb72b50dab in QEventDispatcherGlib::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#20 0x00007fbb72af7daa in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) () at /lib64/libQt5Core.so.5
#21 0x00007fbb72affe6c in QCoreApplication::exec() () at /lib64/libQt5Core.so.5
#22 0x000000000040b0e5 in main ()

Reported using DrKonqi

Comment 1 Igor Poboiko 2018-10-16 13:56:15 UTC

Git commit 5eee9ac75b7d6bb19795c2d3b964fe05fd8fc47c by Igor Poboiko.
Committed on 16/10/2018 at 13:56.
Pushed by poboiko into branch 'master'.

Don't crash on invalid exiv2 data

Summary:
The file from bug 375131 crashes `baloo_file_extractor`.
The problem is that its EXIF data contains a key `Exif.Photo.FocalLength`,
whose type is `Exiv2::unsignedRational`, and whose value is empty.
On the other hand, the `Exiv2::Value::toFloat()` call relies on at least single component of a value,
causing undefined behavior (i.e. crash) if there is none.

This is simple workaround: if we got a property with no value, just return an empty QVariant().
(unfortunately, didn't manage to reproduce the hang reported in the bug originally)
Related: bug 353848, bug 361259, bug 375131

Test Plan: `baloo_file_extractor` no longer crashes on the file, it processes the file and extracts all the necessary data

Reviewers: #baloo, #frameworks, astippich

Reviewed By: astippich

Subscribers: bruns, astippich, kde-frameworks-devel

Tags: #frameworks, #baloo

Differential Revision: https://phabricator.kde.org/D16165

M  +3    -0    src/extractors/exiv2extractor.cpp

https://commits.kde.org/kfilemetadata/5eee9ac75b7d6bb19795c2d3b964fe05fd8fc47c

Comment 2 Nate Graham 2018-11-26 19:48:47 UTC

*** Bug 372235 has been marked as a duplicate of this bug. ***

Comment 3 Nate Graham 2018-11-26 19:48:50 UTC

*** Bug 369522 has been marked as a duplicate of this bug. ***

Comment 4 Nate Graham 2018-11-26 19:48:53 UTC

*** Bug 375950 has been marked as a duplicate of this bug. ***

Comment 5 Nate Graham 2018-11-26 19:56:02 UTC

*** Bug 384607 has been marked as a duplicate of this bug. ***