ktnef crashes with a use-after-free bug if it is closed when the error dialog saying cannot open file is being shown Reproducible: Always Steps to Reproduce: 1. Open a non TNEF file from File -> Open 2. When the error dialog saying cannot open file is shown, 3. Quit ktnef from the command line, saying "qdbus `qdbus | grep ktnef` /ktnef/MainWindow_1/actions/file_quit trigger" Actual Results: ktnef crashes Expected Results: ktnef closes smoothly Version information: Qt: 4.8.7 KDE Development Platform: 4.14.13 KTnef: 4.14.10 Here is the backtrace from KCrash: Application: KTnef (ktnef), signal: Segmentation fault Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1". [Current thread is 1 (Thread 0x7f1653389780 (LWP 23215))] Thread 2 (Thread 0x7f164104d700 (LWP 23217)): #0 0x00007f164d82f4ac in send () from /lib/x86_64-linux-gnu/libc.so.6 #1 0x00007f164d82a020 in __vsyslog_chk () from /lib/x86_64-linux-gnu/libc.so.6 #2 0x00007f164d82a3af in syslog () from /lib/x86_64-linux-gnu/libc.so.6 #3 0x00007f164e3aac93 in QMutex::lock (this=0x259d650) at thread/qmutex.cpp:180 #4 0x00007f164e389645 in QMutex::lockInline (this=0x259d650) at ../../include/QtCore/../../src/corelib/thread/qmutex.h:201 #5 0x00007f164e3866c0 in QMutexLocker::QMutexLocker (this=0x7f164104ca20, m=0x259d650) at ../../include/QtCore/../../src/corelib/thread/qmutex.h:109 #6 0x00007f164e58be54 in QThreadData::canWaitLocked (this=0x259d600) at ../../include/QtCore/private/../../../src/corelib/thread/qthread_p.h:236 #7 0x00007f164e58f30b in QEventDispatcherUNIX::processEvents (this=0x7f163c0008f0, flags=...) at kernel/qeventdispatcher_unix.cpp:911 #8 0x00007f164e537f6c in QEventLoop::processEvents (this=0x7f164104cc78, flags=...) at kernel/qeventloop.cpp:149 #9 0x00007f164e538332 in QEventLoop::exec (this=0x7f164104cc78, flags=...) at kernel/qeventloop.cpp:225 #10 0x00007f164e3b00a0 in QThread::exec (this=0x259d7d0) at thread/qthread.cpp:659 #11 0x00007f164e507994 in QInotifyFileSystemWatcherEngine::run (this=0x259d7d0) at io/qfilesystemwatcher_inotify.cpp:265 #12 0x00007f164e3b4b2a in QThreadPrivate::start (arg=0x259d7d0) at thread/qthread_unix.cpp:361 #13 0x00007f164d525e9a in start_thread () from /lib/x86_64-linux-gnu/libpthread.so.0 #14 0x00007f164d82e38d in clone () from /lib/x86_64-linux-gnu/libc.so.6 #15 0x0000000000000000 in ?? () Thread 1 (Thread 0x7f1653389780 (LWP 23215)): [KCrash Handler] #6 QPointer<QItemSelectionModel>::operator QItemSelectionModel* (this=0x2a8) at ../../include/QtCore/../../src/corelib/kernel/qpointer.h:78 #7 0x00007f16501a215b in QAbstractItemView::selectionModel (this=0x22d0eb0) at itemviews/qabstractitemview.cpp:766 #8 0x00007f1650268fa9 in QTreeWidget::clear (this=0x22d0eb0) at itemviews/qtreewidget.cpp:3273 #9 0x000000000041ccf3 in KTNEFView::setAttachments (this=0x22d0eb0, list=...) at KDE/kde/applications/kdepim/ktnef/ktnefview.cpp:90 #10 0x0000000000417c30 in KTNEFMain::loadFile (this=0x2295e10, filename=...) at KDE/kde/applications/kdepim/ktnef/ktnefmain.cpp:204 #11 0x000000000041830e in KTNEFMain::openFile (this=0x2295e10) at KDE/kde/applications/kdepim/ktnef/ktnefmain.cpp:228 #12 0x00007f164e564607 in QMetaObject::activate (sender=0x229b690, m=0x7f1650979540 <QAction::staticMetaObject>, local_signal_index=1, argv=0x7fffb7a04920) at kernel/qobject.cpp:3569 #13 0x00007f164f95b41d in QAction::triggered (this=0x229b690, _t1=false) at .moc/debug-shared/moc_qaction.cpp:277 #14 0x00007f164f95b232 in QAction::activate (this=0x229b690, event=QAction::Trigger) at kernel/qaction.cpp:1257 #15 0x00007f164f95d6ca in QAction::trigger (this=0x229b690) at qt/src/gui/kernel/qaction.h:218 #16 0x00007f16500bbf93 in QToolButton::nextCheckState (this=0x22ee2a0) at widgets/qtoolbutton.cpp:1152 #17 0x00007f164ff761c4 in QAbstractButtonPrivate::click (this=0x22e51c0) at widgets/qabstractbutton.cpp:530 #18 0x00007f164ff7775c in QAbstractButton::mouseReleaseEvent (this=0x22ee2a0, e=0x7fffb7a06278) at widgets/qabstractbutton.cpp:1123 #19 0x00007f16500bb854 in QToolButton::mouseReleaseEvent (this=0x22ee2a0, e=0x7fffb7a06278) at widgets/qtoolbutton.cpp:723 #20 0x00007f164f9f497e in QWidget::event (this=0x22ee2a0, event=0x7fffb7a06278) at kernel/qwidget.cpp:8389 #21 0x00007f164ff77581 in QAbstractButton::event (this=0x22ee2a0, e=0x7fffb7a06278) at widgets/qabstractbutton.cpp:1082 #22 0x00007f16500bc029 in QToolButton::event (this=0x22ee2a0, event=0x7fffb7a06278) at widgets/qtoolbutton.cpp:1168 #23 0x00007f164f96b48f in QApplicationPrivate::notify_helper (this=0x21c4920, receiver=0x22ee2a0, e=0x7fffb7a06278) at kernel/qapplication.cpp:4565 #24 0x00007f164f96e893 in QApplication::notify (this=0x7fffb7a07930, receiver=0x22ee2a0, e=0x7fffb7a06278) at kernel/qapplication.cpp:4108 #25 0x00007f1650f9ef7b in KApplication::notify (this=0x7fffb7a07930, receiver=0x22ee2a0, event=0x7fffb7a06278) at KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311 #26 0x00007f164e53cdc6 in QCoreApplication::notifyInternal (this=0x7fffb7a07930, receiver=0x22ee2a0, event=0x7fffb7a06278) at kernel/qcoreapplication.cpp:955 #27 0x00007f164f97602f in QCoreApplication::sendSpontaneousEvent (receiver=0x22ee2a0, event=0x7fffb7a06278) at qt/src/gui/../../include/QtCore/../../src/corelib/kernel/qcoreapplication.h:234 #28 0x00007f164f96c531 in QApplicationPrivate::sendMouseEvent (receiver=0x22ee2a0, event=0x7fffb7a06278, alienWidget=0x22ee2a0, nativeWidget=0x2295e10, buttonDown=0x7f16509bf050 <qt_button_down>, lastMouseReceiver=..., spontaneous=true) at kernel/qapplication.cpp:3171 #29 0x00007f164fa3d5e5 in QETWidget::translateMouseEvent (this=0x2295e10, event=0x7fffb7a075b8) at kernel/qapplication_x11.cpp:4524 #30 0x00007f164fa38ff6 in QApplication::x11ProcessEvent (this=0x7fffb7a07930, event=0x7fffb7a075b8) at kernel/qapplication_x11.cpp:3520 #31 0x00007f164fa83456 in QEventDispatcherX11::processEvents (this=0x21984c0, flags=...) at kernel/qeventdispatcher_x11.cpp:151 #32 0x00007f164e537f6c in QEventLoop::processEvents (this=0x7fffb7a078b0, flags=...) at kernel/qeventloop.cpp:149 #33 0x00007f164e538332 in QEventLoop::exec (this=0x7fffb7a078b0, flags=...) at kernel/qeventloop.cpp:225 #34 0x00007f164e53d5ee in QCoreApplication::exec () at kernel/qcoreapplication.cpp:1229 #35 0x00007f164f96d526 in QApplication::exec () at kernel/qapplication.cpp:3823 #36 0x000000000041db6b in main (argc=<optimized out>, argv=<optimized out>) at KDE/kde/applications/kdepim/ktnef/main.cpp:63
Created attachment 96137 [details] screenshot showing that the error dialog is not application modal In earlier versions of ktnef, the error can be reproduced by issuing a quit via the GUI rather than the terminal (as the attached screenshot demonstrates). The crash is a use-after-free bug. I built a version of ktnef using AddressSanitizer and here is the report generated by AddressSanitizer for this bug: ================================================================= ==23263==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c0000b9900 at pc 0x46e008 bp 0x7fff05913b70 sp 0x7fff05913b68 READ of size 8 at 0x60c0000b9900 thread T0 #0 0x46e007 in KTNEFMain::loadFile(QString const&) (KDE/install-asan/bin/ktnef+0x46e007) #1 0x46f807 in KTNEFMain::openFile() (KDE/install-asan/bin/ktnef+0x46f807) #2 0x494412 in KTNEFMain::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (KDE/install-asan/bin/ktnef+0x494412) #3 0x7f9f84909606 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (install/qt4/lib/libQtCore.so.4+0x255606) #4 0x7f9f85e3741c in QAction::triggered(bool) (install/qt4/lib/libQtGui.so.4+0x22541c) #5 0x7f9f85e37231 in QAction::activate(QAction::ActionEvent) (install/qt4/lib/libQtGui.so.4+0x225231) #6 0x7f9f85e396c9 in QAction::trigger() (install/qt4/lib/libQtGui.so.4+0x2276c9) #7 0x7f9f86597f92 in QToolButton::nextCheckState() (install/qt4/lib/libQtGui.so.4+0x985f92) #8 0x7f9f864521c3 in QAbstractButtonPrivate::click() (install/qt4/lib/libQtGui.so.4+0x8401c3) #9 0x7f9f8645375b in QAbstractButton::mouseReleaseEvent(QMouseEvent*) (install/qt4/lib/libQtGui.so.4+0x84175b) #10 0x7f9f86597853 in QToolButton::mouseReleaseEvent(QMouseEvent*) (install/qt4/lib/libQtGui.so.4+0x985853) #11 0x7f9f85ed097d in QWidget::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x2be97d) #12 0x7f9f86453580 in QAbstractButton::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x841580) #13 0x7f9f86598028 in QToolButton::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x986028) #14 0x7f9f85e4748e in QApplicationPrivate::notify_helper(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x23548e) #15 0x7f9f85e4a892 in QApplication::notify(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x238892) #16 0x7f9f87709340 in KApplication::notify(QObject*, QEvent*) KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311 #17 0x7f9f848e1dc5 in QCoreApplication::notifyInternal(QObject*, QEvent*) (install/qt4/lib/libQtCore.so.4+0x22ddc5) #18 0x7f9f85e5202e in QCoreApplication::sendSpontaneousEvent(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x24002e) #19 0x7f9f85e48530 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) (install/qt4/lib/libQtGui.so.4+0x236530) #20 0x7f9f85f195e4 in QETWidget::translateMouseEvent(_XEvent const*) (install/qt4/lib/libQtGui.so.4+0x3075e4) #21 0x7f9f85f14ff5 in QApplication::x11ProcessEvent(_XEvent*) (install/qt4/lib/libQtGui.so.4+0x302ff5) #22 0x7f9f85f5f455 in QEventDispatcherX11::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtGui.so.4+0x34d455) #23 0x7f9f848dcf6b in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x228f6b) #24 0x7f9f848dd331 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x229331) #25 0x7f9f848e25ed in QCoreApplication::exec() (install/qt4/lib/libQtCore.so.4+0x22e5ed) #26 0x7f9f85e49525 in QApplication::exec() (install/qt4/lib/libQtGui.so.4+0x237525) #27 0x483563 in main (KDE/install-asan/bin/ktnef+0x483563) #28 0x7f9f834d876c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c) #29 0x454e7c in _start (KDE/install-asan/bin/ktnef+0x454e7c) 0x60c0000b9900 is located 64 bytes inside of 128-byte region [0x60c0000b98c0,0x60c0000b9940) freed by thread T0 here: #0 0x44049a in operator delete(void*) (KDE/install-asan/bin/ktnef+0x44049a) #1 0x46bf34 in KTNEFMain::~KTNEFMain() (KDE/install-asan/bin/ktnef+0x46bf34) #2 0x7f9f84902e3d in qDeleteInEventHandler(QObject*) (install/qt4/lib/libQtCore.so.4+0x24ee3d) #3 0x7f9f849029a7 in QObject::event(QEvent*) (install/qt4/lib/libQtCore.so.4+0x24e9a7) #4 0x7f9f85ed2345 in QWidget::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x2c0345) #5 0x7f9f864f3f72 in QMainWindow::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x8e1f72) #6 0x7f9f87a29133 in KMainWindow::event(QEvent*) KDE/kde/kdelibs/kdeui/widgets/kmainwindow.cpp:1126 #7 0x7f9f87b2f0b2 in KXmlGuiWindow::event(QEvent*) KDE/kde/kdelibs/kdeui/xmlgui/kxmlguiwindow.cpp:126 #8 0x7f9f85e4748e in QApplicationPrivate::notify_helper(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x23548e) #9 0x7f9f85e4d32b in QApplication::notify(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x23b32b) #10 0x7f9f87709340 in KApplication::notify(QObject*, QEvent*) KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311 #11 0x7f9f848e1dc5 in QCoreApplication::notifyInternal(QObject*, QEvent*) (install/qt4/lib/libQtCore.so.4+0x22ddc5) #12 0x7f9f848e6549 in QCoreApplication::sendEvent(QObject*, QEvent*) (install/qt4/lib/libQtCore.so.4+0x232549) #13 0x7f9f848e33f3 in QCoreApplicationPrivate::sendPostedEvents(QObject*, int, QThreadData*) (install/qt4/lib/libQtCore.so.4+0x22f3f3) #14 0x7f9f849342f6 in QEventDispatcherUNIX::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x2802f6) #15 0x7f9f85f5f669 in QEventDispatcherX11::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtGui.so.4+0x34d669) #16 0x7f9f848dcf6b in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x228f6b) #17 0x7f9f848dd331 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x229331) #18 0x7f9f865fbc8a in QDialog::exec() (install/qt4/lib/libQtGui.so.4+0x9e9c8a) #19 0x7f9f874959dc in KMessageBox::createKMessageBox(KDialog*, QIcon const&, QString const&, QStringList const&, QString const&, bool*, QFlags<KMessageBox::Option>, QString const&, QMessageBox::Icon) KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:344 #20 0x7f9f87492fe1 in KMessageBox::createKMessageBox(KDialog*, QMessageBox::Icon, QString const&, QStringList const&, QString const&, bool*, QFlags<KMessageBox::Option>, QString const&) KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:158 #21 0x7f9f874a3d4a in KMessageBox::errorListWId(unsigned long, QString const&, QStringList const&, QString const&, QFlags<KMessageBox::Option>) KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:854 #22 0x7f9f874a340b in KMessageBox::error(QWidget*, QString const&, QString const&, QFlags<KMessageBox::Option>) KDE/kde/kdelibs/kdeui/dialogs/kmessagebox.cpp:821 #23 0x46db45 in KTNEFMain::loadFile(QString const&) (KDE/install-asan/bin/ktnef+0x46db45) #24 0x46f807 in KTNEFMain::openFile() (KDE/install-asan/bin/ktnef+0x46f807) #25 0x494412 in KTNEFMain::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (KDE/install-asan/bin/ktnef+0x494412) #26 0x7f9f84909606 in QMetaObject::activate(QObject*, QMetaObject const*, int, void**) (install/qt4/lib/libQtCore.so.4+0x255606) #27 0x7f9f85e3741c in QAction::triggered(bool) (install/qt4/lib/libQtGui.so.4+0x22541c) #28 0x7f9f85e37231 in QAction::activate(QAction::ActionEvent) (install/qt4/lib/libQtGui.so.4+0x225231) #29 0x7f9f85e396c9 in QAction::trigger() (install/qt4/lib/libQtGui.so.4+0x2276c9) #30 0x7f9f86597f92 in QToolButton::nextCheckState() (install/qt4/lib/libQtGui.so.4+0x985f92) #31 0x7f9f864521c3 in QAbstractButtonPrivate::click() (install/qt4/lib/libQtGui.so.4+0x8401c3) #32 0x7f9f8645375b in QAbstractButton::mouseReleaseEvent(QMouseEvent*) (install/qt4/lib/libQtGui.so.4+0x84175b) #33 0x7f9f86597853 in QToolButton::mouseReleaseEvent(QMouseEvent*) (install/qt4/lib/libQtGui.so.4+0x985853) #34 0x7f9f85ed097d in QWidget::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x2be97d) #35 0x7f9f86453580 in QAbstractButton::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x841580) #36 0x7f9f86598028 in QToolButton::event(QEvent*) (install/qt4/lib/libQtGui.so.4+0x986028) #37 0x7f9f85e4748e in QApplicationPrivate::notify_helper(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x23548e) #38 0x7f9f85e4a892 in QApplication::notify(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x238892) #39 0x7f9f87709340 in KApplication::notify(QObject*, QEvent*) KDE/kde/kdelibs/kdeui/kernel/kapplication.cpp:311 #40 0x7f9f848e1dc5 in QCoreApplication::notifyInternal(QObject*, QEvent*) (install/qt4/lib/libQtCore.so.4+0x22ddc5) #41 0x7f9f85e5202e in QCoreApplication::sendSpontaneousEvent(QObject*, QEvent*) (install/qt4/lib/libQtGui.so.4+0x24002e) #42 0x7f9f85e48530 in QApplicationPrivate::sendMouseEvent(QWidget*, QMouseEvent*, QWidget*, QWidget*, QWidget**, QPointer<QWidget>&, bool) (install/qt4/lib/libQtGui.so.4+0x236530) #43 0x7f9f85f195e4 in QETWidget::translateMouseEvent(_XEvent const*) (install/qt4/lib/libQtGui.so.4+0x3075e4) #44 0x7f9f85f14ff5 in QApplication::x11ProcessEvent(_XEvent*) (install/qt4/lib/libQtGui.so.4+0x302ff5) #45 0x7f9f85f5f455 in QEventDispatcherX11::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtGui.so.4+0x34d455) #46 0x7f9f848dcf6b in QEventLoop::processEvents(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x228f6b) #47 0x7f9f848dd331 in QEventLoop::exec(QFlags<QEventLoop::ProcessEventsFlag>) (install/qt4/lib/libQtCore.so.4+0x229331) #48 0x7f9f848e25ed in QCoreApplication::exec() (install/qt4/lib/libQtCore.so.4+0x22e5ed) #49 0x7f9f85e49525 in QApplication::exec() (install/qt4/lib/libQtGui.so.4+0x237525) #50 0x483563 in main (KDE/install-asan/bin/ktnef+0x483563) #51 0x7f9f834d876c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c) #52 0x454e7c in _start (KDE/install-asan/bin/ktnef+0x454e7c) previously allocated by thread T0 here: #0 0x44021a in operator new(unsigned long) (KDE/install-asan/bin/ktnef+0x44021a) #1 0x4833b4 in main (KDE/install-asan/bin/ktnef+0x4833b4) #2 0x7f9f834d876c (/lib/x86_64-linux-gnu/libc.so.6+0x2176c) #3 0x454e7c in _start (KDE/install-asan/bin/ktnef+0x454e7c) SUMMARY: AddressSanitizer: heap-use-after-free ??:0 KTNEFMain::loadFile(QString const&) Shadow bytes around the buggy address: 0x0c188000f2d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c188000f2e0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd 0x0c188000f2f0: fd fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c188000f300: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c188000f310: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd =>0x0c188000f320:[fd]fd fd fd fd fd fd fd fa fa fa fa fa fa fa fa 0x0c188000f330: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0c188000f340: fa fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 0x0c188000f350: 00 00 00 00 00 00 00 07 fa fa fa fa fa fa fa fa 0x0c188000f360: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd 0x0c188000f370: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Heap right redzone: fb Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack partial redzone: f4 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 ASan internal: fe ==23263==ABORTING
Why did you open the same bug as 356351 that I fixed ???
Oops, really sorry, forgot I'd already filed this one. *** This bug has been marked as a duplicate of bug 356351 ***