Bug 373295

On my Gentoo system, when opening the PNG bitmap image and pressing the "100%" zoom button, gwenview crashes with a segmentation fault in liblcms.

I'm using gwenview 16.08.3 and lcms 2.8.

Here's a short gdb session showing the error:

$ gdb --args gwenview 'bitmap.png'
GNU gdb (Gentoo 7.12 vanilla) 7.12
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://bugs.gentoo.org/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from gwenview...Reading symbols from /usr/lib64/debug//usr/bin/gwenview.debug...done.
done.
(gdb) run
Starting program: /usr/bin/gwenview bitmap.png
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
[New Thread 0x7fffe1f13700 (LWP 22588)]
[New Thread 0x7fffdbfff700 (LWP 22589)]
[New Thread 0x7fffcb505700 (LWP 22591)]
[New Thread 0x7fffcad04700 (LWP 22592)]
[New Thread 0x7fffca503700 (LWP 22593)]
[New Thread 0x7fffc9d02700 (LWP 22594)]
[New Thread 0x7fffc9501700 (LWP 22595)]
[New Thread 0x7fffbb897700 (LWP 22598)]

Thread 1 "gwenview" received signal SIGSEGV, Segmentation fault.
Unroll3BytesSkip1SwapSwapFirst (info=0x13566c0, wIn=0x7fffffffbf50, accum=0x182c000 <error: Cannot access memory at address 0x182c000>, Stride=1522575)
    at /var/tmp/portage/media-libs/lcms-2.8/work/lcms2-2.8/src/cmspack.c:296
296         wIn[2] = FROM_8_TO_16(*accum); accum++; // B
(gdb) bt full
#0  Unroll3BytesSkip1SwapSwapFirst (info=0x13566c0, wIn=0x7fffffffbf50, accum=0x182c000 <error: Cannot access memory at address 0x182c000>, Stride=1522575)
    at /var/tmp/portage/media-libs/lcms-2.8/work/lcms2-2.8/src/cmspack.c:296
No locals.
#1  0x00007ffff222a552 in PrecalculatedXFORM (p=0x13566c0, in=0x13dbdc0, out=0x13dbdc0, PixelsPerLine=1522575, LineCount=1, Stride=0x7fffffffbfe0)
    at /var/tmp/portage/media-libs/lcms-2.8/work/lcms2-2.8/src/cmsxform.c:404
        accum = 0x182c000 <error: Cannot access memory at address 0x182c000>
        output = 0x182c000 <error: Cannot access memory at address 0x182c000>
        wIn = {0 <repeats 16 times>}
        wOut = {0 <repeats 16 times>}
        i = 0
        j = 1130640
        strideIn = 0
        strideOut = 0
#2  0x00007ffff222b3db in cmsDoTransform (Transform=<optimized out>, InputBuffer=<optimized out>, OutputBuffer=<optimized out>, Size=<optimized out>)
    at /var/tmp/portage/media-libs/lcms-2.8/work/lcms2-2.8/src/cmsxform.c:189
        p = <optimized out>
        stride = {BytesPerLineIn = 0, BytesPerLineOut = 0, BytesPerPlaneIn = 1522575, BytesPerPlaneOut = 1522575}
#3  0x00007ffff769ddaf in Gwenview::RasterImageView::updateFromScaler (this=0x1354de0, zoomedImageLeft=181, zoomedImageTop=1177, image=...)
    at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/rasterimageview.cpp:322
        bytes = 0x13dbdc0 "c\003\300"
        viewportLeft = <optimized out>
        viewportTop = <optimized out>
#4  0x00007ffff769e6b2 in QtPrivate::FunctorCall<QtPrivate::IndexesList<0, 1, 2>, QtPrivate::List<int, int, QImage const&>, void, void (Gwenview::RasterImageView::*)(int, int, QImage const&)>::call (
    arg=<optimized out>, o=<optimized out>, f=<optimized out>) at /usr/include/qt5/QtCore/qobjectdefs_impl.h:501
No locals.
#5  QtPrivate::FunctionPointer<void (Gwenview::RasterImageView::*)(int, int, QImage const&)>::call<QtPrivate::List<int, int, QImage const&>, void> (arg=<optimized out>, o=<optimized out>, f=<optimized out>)
    at /usr/include/qt5/QtCore/qobjectdefs_impl.h:520
No locals.
#6  QtPrivate::QSlotObject<void (Gwenview::RasterImageView::*)(int, int, QImage const&), QtPrivate::List<int, int, QImage const&>, void>::impl (which=<optimized out>, this_=<optimized out>, r=<optimized out>, 
    a=<optimized out>, ret=<optimized out>) at /usr/include/qt5/QtCore/qobject_impl.h:143
No locals.
#7  0x00007ffff37a27bb in QtPrivate::QSlotObjectBase::call (a=0x7fffffffc220, r=0x1354de0, this=0x12f6a80) at ../../include/QtCore/../../src/corelib/kernel/qobject_impl.h:124
No locals.
#8  QMetaObject::activate (sender=sender@entry=0xe68300, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=0, argv=argv@entry=0x7fffffffc220) at kernel/qobject.cpp:3715
        obj = {d = 0x12f6a80}
        receiverInSameThread = <optimized out>
        sw = {receiver = 0x1354de0, previousSender = 0x0, currentSender = {sender = 0xe68300, signal = 3, ref = 1}, switched = true}
        callFunction = 0x12f6a80
        receiver = 0x1354de0
        method_relative = <optimized out>
        c = 0x1310b40
        locker = {val = 140737280355120}
        connectionLists = <optimized out>
        list = <optimized out>
        signal_index = <optimized out>
        empty_argv = {0x0}
        currentThreadId = <optimized out>
#9  0x00007ffff37a2d72 in QMetaObject::activate (sender=sender@entry=0xe68300, m=m@entry=0x7ffff7946500 <Gwenview::ImageScaler::staticMetaObject>, local_signal_index=local_signal_index@entry=0, 
    argv=argv@entry=0x7fffffffc220) at kernel/qobject.cpp:3595
No locals.
#10 0x00007ffff7704b44 in Gwenview::ImageScaler::scaledRect (this=this@entry=0xe68300, _t1=181, _t2=1177, _t3=...)
    at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3_build/lib/gwenviewlib_automoc.dir/moc_imagescaler_MWR3CCYMZPWSLJ.cpp:136
        _a = {0x0, 0x7fffffffc21c, 0x7fffffffc218, 0x7fffffffc350}
#11 0x00007ffff76c523b in Gwenview::ImageScaler::scaleRect (this=this@entry=0xe68300, rect=...) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/imagescaler.cpp:132
        tmp = {<QPaintDevice> = {_vptr.QPaintDevice = 0x7ffff3e3e610 <vtable for QImage+16>, painters = 0, reserved = 0x0}, d = 0x1380f30}
        destTopMargin = <optimized out>
        image = {<QPaintDevice> = {_vptr.QPaintDevice = 0x7fffffffc2d0, painters = 2265, reserved = 0x2}, d = 0x8}
        sourceRectF = {xp = 6.9533558070642619e-310, yp = 6.9533453392910757e-310, w = 6.95335580707691e-310, h = 6.9533454560498549e-310}
        needsSmoothMargins = <optimized out>
        destRect = <optimized out>
        tmp = {<QPaintDevice> = {_vptr.QPaintDevice = 0x7fffffffc370, painters = 50882, reserved = 0x30}, d = 0x0}
        zoom = <optimized out>
        sourceRect = {x1 = 56, y1 = 0, x2 = 16, y2 = 0}
        destLeftMargin = <optimized out>
        destRightMargin = <optimized out>
        destBottomMargin = <optimized out>
        destRectF = {xp = 8.6137183332287951e-317, yp = 4.9406564584124654e-324, w = 4.9406564584124654e-324, h = 1176.999999999942}
#12 0x00007ffff76c593b in Gwenview::ImageScaler::doScale (this=this@entry=0xe68300) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/imagescaler.cpp:122
        _container_ = {c = {d = 0x11016b0}, i = <optimized out>, e = 0x11016d8, control = 1}
#13 0x00007ffff76c59fc in Gwenview::ImageScaler::setDestinationRegion (this=0xe68300, region=...) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/imagescaler.cpp:102
No locals.
#14 0x00007ffff769c998 in Gwenview::RasterImageViewPrivate::setScalerRegionToVisibleRect (this=0x134f1a0)
    at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/rasterimageview.cpp:151
No locals.
#15 Gwenview::RasterImageView::updateBuffer (this=this@entry=0x1354de0, region=...) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/rasterimageview.cpp:443
No locals.
#16 0x00007ffff769ca54 in Gwenview::RasterImageView::onZoomChanged (this=0x1354de0) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/rasterimageview.cpp:360
No locals.
#17 0x00007ffff768f97f in Gwenview::AbstractImageView::setZoom (this=0x1354de0, zoom=<optimized out>, _center=..., updateType=<optimized out>)
    at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/abstractimageview.cpp:220
        oldZoom = <optimized out>
        center = <optimized out>
        oldScroll = <optimized out>
        scroll = {xp = 181.00000000000011, yp = 1176.9999999999998}
#18 0x00007ffff769f37c in Gwenview::RasterImageViewAdapter::setZoom (this=<optimized out>, zoom=<optimized out>, center=...)
    at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/rasterimageviewadapter.cpp:103
No locals.
#19 0x00007ffff76964e0 in Gwenview::DocumentView::zoomActualSize (this=0x10bbb10) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/lib/documentview/documentview.cpp:497
No locals.
#20 0x00007ffff7707543 in Gwenview::DocumentView::qt_static_metacall (_o=<optimized out>, _c=<optimized out>, _id=<optimized out>, _a=<optimized out>)
    at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3_build/lib/gwenviewlib_automoc.dir/moc_documentview_IWRQYBCZN4Q53Y.cpp:235
        _t = <optimized out>
#21 0x00007ffff37a28cf in QMetaObject::activate (sender=sender@entry=0xb667a0, signalOffset=<optimized out>, local_signal_index=local_signal_index@entry=1, argv=argv@entry=0x7fffffffc730)
    at kernel/qobject.cpp:3730
        receiverInSameThread = <optimized out>
        sw = {receiver = 0x10bbb10, previousSender = 0x0, currentSender = {sender = 0xb667a0, signal = 4, ref = 1}, switched = true}
        callFunction = 0x7ffff77073b4 <Gwenview::DocumentView::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>
        receiver = 0x10bbb10
        method_relative = 25
        c = 0xe34eb0
        locker = {val = 140737280354768}
        connectionLists = <optimized out>
        list = <optimized out>
        signal_index = <optimized out>
        empty_argv = {0x0}
        currentThreadId = <optimized out>
#22 0x00007ffff37a2d72 in QMetaObject::activate (sender=0xb667a0, m=<optimized out>, local_signal_index=1, argv=0x7fffffffc730) at kernel/qobject.cpp:3595
No locals.
#23 0x00007ffff49993a2 in QAction::triggered(bool) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#24 0x00007ffff499c4fd in QAction::activate(QAction::ActionEvent) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#25 0x00007ffff4aa0902 in ?? () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#26 0x00007ffff4aa0a64 in QAbstractButton::mouseReleaseEvent(QMouseEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#27 0x00007ffff4b82f9a in QToolButton::mouseReleaseEvent(QMouseEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#28 0x00007ffff49f0c46 in QWidget::event(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#29 0x00007ffff4b830ee in QToolButton::event(QEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#30 0x00007ffff49a0bbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#31 0x00007ffff49a8c01 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#32 0x00007ffff377b8c6 in QCoreApplication::notifyInternal2 (receiver=0x90bbd0, event=0x7fffffffccc0) at kernel/qcoreapplication.cpp:1015
        threadData = 0x69a760
        loopLevelCounter = {threadData = 0x69a760}
        selfRequired = true
        result = false
        cbdata = {0x90bbd0, 0x7fffffffccc0, 0x7fffffffcaef}
        d = <optimized out>
#33 0x00007ffff49a7b36 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#34 0x00007ffff4a0f9c6 in ?? () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#35 0x00007ffff4a12100 in ?? () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#36 0x00007ffff49a0bbc in QApplicationPrivate::notify_helper(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#37 0x00007ffff49a8672 in QApplication::notify(QObject*, QEvent*) () from /usr/lib64/libQt5Widgets.so.5
No symbol table info available.
#38 0x00007ffff377b8c6 in QCoreApplication::notifyInternal2 (receiver=receiver@entry=0xd11a10, event=event@entry=0x7fffffffd0f0) at kernel/qcoreapplication.cpp:1015
        threadData = 0x69a760
        loopLevelCounter = {threadData = 0x69a760}
        selfRequired = true
        result = false
        cbdata = {0xd11a10, 0x7fffffffd0f0, 0x7fffffffcfcf}
        d = <optimized out>
#39 0x00007ffff3a92a72 in QCoreApplication::sendSpontaneousEvent (event=0x7fffffffd0f0, receiver=0xd11a10) at ../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:228
No locals.
#40 QGuiApplicationPrivate::processMouseEvent (e=0xe47780) at kernel/qguiapplication.cpp:1877
        type = QEvent::MouseButtonRelease
        stateChange = <optimized out>
        window = 0xd11a10
        globalPoint = {xp = 3600, yp = 1021}
        button = Qt::LeftButton
        doubleClick = false
        localPoint = {xp = 1435, yp = 15}
        frameStrut = false
        ev = {<QInputEvent> = {<QEvent> = {_vptr.QEvent = 0x7ffff3e3d770 <vtable for QMouseEvent+16>, static staticMetaObject = {d = {superdata = 0x0, stringdata = 0x7ffff392fc80 <qt_meta_stringdata_QEvent>, 
                  data = 0x7ffff392f6c0 <qt_meta_data_QEvent>, static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}, d = 0x0, t = 3, posted = 0, spont = 1, m_accept = 1, reserved = 0}, 
            modState = {i = 0}, ts = 229563003}, l = {xp = 1435, yp = 15}, w = {xp = 1435, yp = 15}, s = {xp = 3600, yp = 1021}, b = Qt::LeftButton, mouseState = {i = 0}, caps = 0, velocity = {xp = 0, yp = 0}}
#41 0x00007ffff3a93af4 in QGuiApplicationPrivate::processWindowSystemEvent (e=e@entry=0xe47780) at kernel/qguiapplication.cpp:1661
No locals.
#42 0x00007ffff3a7754f in QWindowSystemInterface::sendWindowSystemEvents (flags=...) at kernel/qwindowsysteminterface.cpp:653
        event = 0xe47780
        nevents = 1
#43 0x00007fffe3ea003c in userEventSourceDispatch (source=<optimized out>) at eventdispatchers/qeventdispatcher_glib.cpp:70
        userEventSource = <optimized out>
        dispatcher = <optimized out>
#44 0x00007fffecc0eead in g_main_context_dispatch () from /usr/lib64/libglib-2.0.so.0
No symbol table info available.
#45 0x00007fffecc0f1b0 in ?? () from /usr/lib64/libglib-2.0.so.0
No symbol table info available.
#46 0x00007fffecc0f25c in g_main_context_iteration () from /usr/lib64/libglib-2.0.so.0
No symbol table info available.
#47 0x00007ffff37c5d90 in QEventDispatcherGlib::processEvents (this=0x711490, flags=...) at kernel/qeventdispatcher_glib.cpp:417
        d = 0x7051c0
        canWait = true
        savedFlags = {i = 0}
        result = <optimized out>
#48 0x00007fffe3ea01b0 in QPAEventDispatcherGlib::processEvents (this=<optimized out>, flags=...) at eventdispatchers/qeventdispatcher_glib.cpp:115
No locals.
#49 0x00007ffff377a3c2 in QEventLoop::processEvents (this=this@entry=0x7fffffffd4d0, flags=..., flags@entry=...) at kernel/qeventloop.cpp:128
        d = <optimized out>
#50 0x00007ffff377a7d9 in QEventLoop::exec (this=this@entry=0x7fffffffd4d0, flags=..., flags@entry=...) at kernel/qeventloop.cpp:206
        locker = {val = 6924368}
        ref = {d = 0xdd1b10, locker = @0x7fffffffd450, exceptionCaught = true}
        d = 0xdd1b10
#51 0x00007ffff3781c0f in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1285
        threadData = 0x69a760
        eventLoop = {<QObject> = {_vptr.QObject = 0x7ffff3999ad0 <vtable for QEventLoop+16>, static staticMetaObject = {d = {superdata = 0x0, stringdata = 0x7ffff38d0880 <qt_meta_stringdata_QObject>, 
                data = 0x7ffff38d0740 <qt_meta_data_QObject>, static_metacall = 0x7ffff37a9a5e <QObject::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, 
                extradata = 0x0}}, d_ptr = {d = 0xdd1b10}, static staticQtMetaObject = {d = {superdata = 0x0, stringdata = 0x7ffff3918580 <qt_meta_stringdata_Qt>, data = 0x7ffff3915b00 <qt_meta_data_Qt>, 
                static_metacall = 0x0, relatedMetaObjects = 0x0, extradata = 0x0}}}, static staticMetaObject = {d = {superdata = 0x7ffff399bec0 <QObject::staticMetaObject>, 
              stringdata = 0x7ffff392f280 <qt_meta_stringdata_QEventLoop>, data = 0x7ffff392f200 <qt_meta_data_QEventLoop>, 
              static_metacall = 0x7ffff380bf44 <QEventLoop::qt_static_metacall(QObject*, QMetaObject::Call, int, void**)>, relatedMetaObjects = 0x0, extradata = 0x0}}}
        returnCode = <optimized out>
#52 0x00007ffff3a89b14 in QGuiApplication::exec () at kernel/qguiapplication.cpp:1607
No locals.
#53 0x000000000044c318 in main (argc=2, argv=<optimized out>) at /var/tmp/portage/kde-apps/gwenview-16.08.3/work/gwenview-16.08.3/app/main.cpp:167
        parser = {d = 0x74f300}
        app = <incomplete type>
        aboutData = {d = 0x6a6ce0}
        startHelper = {mUrl = {d = 0x791440}, mFullScreen = false, mSlideShow = false, mMultipleUrlsDir = std::unique_ptr<QTemporaryDir> containing 0x0, mMainWindow = 
    std::unique_ptr<Gwenview::MainWindow> containing 0x0}