Bug 346123 - Ksnapshot crashes/segfaults when dragging screenshot to web browser window
Summary: Ksnapshot crashes/segfaults when dragging screenshot to web browser window
Status: RESOLVED FIXED
Alias: None
Product: kdelibs
Classification: Frameworks and Libraries
Component: kimgio (show other bugs)
Version: unspecified
Platform: Ubuntu Linux
: NOR crash
Target Milestone: ---
Assignee: Aaron J. Seigo
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-13 03:42 UTC by V字龍(Vdragon)
Modified: 2016-09-05 18:33 UTC (History)
4 users (show)

See Also:
Latest Commit:
Version Fixed In:


Attachments
fix the stride value for RGB case (no alpha) (541 bytes, patch)
2016-09-05 14:14 UTC, pascal.massimino
Details

Note You need to log in before you can comment on or make changes to this bug.
Description V字龍(Vdragon) 2015-04-13 03:42:38 UTC
When I drag the screenshot image from Ksnapshot to Google Chrome to share Ksnapshot crashed.

gdb stacktrace:
`````
Program received signal SIGSEGV, Segmentation fault.
0xb2d7192f in ?? () from /usr/lib/i386-linux-gnu/libwebp.so.5
(gdb) backtrack
Undefined command: "backtrack".  Try "help".
(gdb) backtrace
#0  0xb2d7192f in ?? () from /usr/lib/i386-linux-gnu/libwebp.so.5
#1  0xb2d726d8 in ?? () from /usr/lib/i386-linux-gnu/libwebp.so.5
#2  0xb2d7274f in WebPPictureImportRGB ()
   from /usr/lib/i386-linux-gnu/libwebp.so.5
#3  0xb2d73462 in ?? () from /usr/lib/i386-linux-gnu/libwebp.so.5
#4  0xb2dc6c73 in ?? () from /usr/lib/kde4/plugins/imageformats/kimg_webp.so
#5  0xb68e0b3d in QImageWriter::write (this=this@entry=0xbfffda58, 
    image=...) at image/qimagewriter.cpp:606
#6  0xb68cd24c in QImageData::doImageIO (this=0x818d970, 
    image=image@entry=0xbfffdb00, writer=writer@entry=0xbfffda58, 
    quality=quality@entry=-1) at image/qimage.cpp:5240
#7  0xb68cd3e5 in QImage::save (this=this@entry=0xbfffdb00, 
    device=device@entry=0xbfffdaf0, format=0x80ae640 "WEBP", 
    quality=quality@entry=-1) at image/qimage.cpp:5228
#8  0xb68199d6 in QInternalMimeData::renderDataHelper (mimeType=..., 
    data=data@entry=0x831e0d0) at kernel/qdnd.cpp:482
#9  0xb689a277 in QX11Data::xdndMimeDataForAtom (this=0x809da00, a=927, 
    mimeData=0x831e0d0, data=data@entry=0xbfffdc98, 
    atomFormat=atomFormat@entry=0xbfffdc90, 
    dataFormat=dataFormat@entry=0xbfffdc94) at kernel/qdnd_x11.cpp:488
#10 0xb689affe in QX11Data::xdndHandleSelectionRequest (this=0x809da00, 
    req=req@entry=0xbfffde9c) at kernel/qdnd_x11.cpp:1868
#11 0xb688e253 in QApplication::x11ProcessEvent (this=0xbfffed34, 
    event=event@entry=0xbfffde9c) at kernel/qapplication_x11.cpp:3946
#12 0xb68b9524 in x11EventSourceDispatch (s=s@entry=0x809c3e0, 
    callback=0x0, user_data=0x0) at kernel/qguieventdispatcher_glib.cpp:146
#13 0xb5d941e3 in g_main_dispatch (context=0x80a3f70, 
    context@entry=0x809c3e0)
    at /build/buildd/glib2.0-2.40.2/./glib/gmain.c:3064
#14 g_main_context_dispatch (context=context@entry=0x80a3f70)
    at /build/buildd/glib2.0-2.40.2/./glib/gmain.c:3663
#15 0xb5d94468 in g_main_context_iterate (context=context@entry=0x80a3f70, 
    block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at /build/buildd/glib2.0-2.40.2/./glib/gmain.c:3734
#16 0xb5d94528 in g_main_context_iteration (context=0x80a3f70, may_block=1)
    at /build/buildd/glib2.0-2.40.2/./glib/gmain.c:3795
#17 0xb732793b in QEventDispatcherGlib::processEvents (this=this@entry=
    0x807bdf0, flags=...) at kernel/qeventdispatcher_glib.cpp:434
#18 0xb68b95de in QGuiEventDispatcherGlib::processEvents (this=0x807bdf0, 
    flags=...) at kernel/qguieventdispatcher_glib.cpp:204
#19 0xb72f6823 in QEventLoop::processEvents (this=this@entry=0x833c918, 
    flags=...) at kernel/qeventloop.cpp:149
#20 0xb72f6b49 in QEventLoop::exec (this=this@entry=0x833c918, flags=...)
    at kernel/qeventloop.cpp:204
#21 0xb689f3a6 in QDragManager::drag (this=0x81cd138, o=o@entry=0x817c770)
    at kernel/qdnd_x11.cpp:2032
#22 0xb6817677 in QDrag::start (this=0x817c770, request=...)
    at kernel/qdrag.cpp:316
#23 0x080580f2 in _start ()
`````

Reproducible: Always

Steps to Reproduce:
N/A

Actual Results:  
N/A

Expected Results:  
N/A

OS: Ubuntu 14.04LTS x86(32-bit)
Qt: 4.8.6
KDE : 4.14.2 from Kubuntu Backports
KSnapshot: 0.8.2
Comment 1 Christoph Feck 2015-05-03 09:32:28 UTC
Crash is in libwebp.
Comment 2 V字龍(Vdragon) 2015-05-03 21:39:56 UTC
@Christoph
I redirected the bug to [libwebp upstream](https://code.google.com/p/webp/issues/detail?can=2&start=0&num=100&q=&colspec=ID%20Type%20Status%20Priority%20Milestone%20Owner%20Summary&groupby=&sort=&id=247) but it seems that the crash in libwebp is caused by improper call from kimgio:

`````````````````````````````
Looks like an invalid pointer calling the libwebp library.

Looking at the KDE code for webp support, i think there's a potential bug in file kimgio/webp.cpp:119

It reads:
size = WebPEncodeRGB(imageData, image.width(), image.height(), image.width() * 4, quality, &output);

but i think it should be:

size = WebPEncodeRGB(imageData, image.width(), image.height(), image.width() * 3, quality, &output);
https://projects.kde.org/projects/kde/kde-runtime/repository/revisions/master/entry/kimgio/webp.cpp
`````````````````````````````
Comment 3 Christoph Feck 2015-05-16 21:37:41 UTC
The analysis looks right, adding Martin to confirm.
Comment 4 teancum144 2015-06-29 23:48:11 UTC
According to webp maintainers:
https://code.google.com/p/webp/issues/detail?id=252
This issue may be related to this one: 
https://bugs.kde.org/show_bug.cgi?id=349730
Comment 5 pascal.massimino 2016-09-05 14:14:05 UTC
Created attachment 100938 [details]
fix the stride value for RGB case (no alpha)

Please find attached a simple patch to fix the stride value in case the format is RGB (without alpha).

Hope it helps,
skal/
Comment 6 Martin Koller 2016-09-05 18:33:06 UTC
Git commit 1eb8bc91fc720235bbd4c95665453ca7d065d0b9 by Martin Koller.
Committed on 05/09/2016 at 18:27.
Pushed by mkoller into branch 'Applications/16.08'.

Fix writing of webp data

M  +5    -0    kimgio/CMakeLists.txt
M  +1    -1    kimgio/webp.cpp

http://commits.kde.org/kde-runtime/1eb8bc91fc720235bbd4c95665453ca7d065d0b9