GitLab

Submitted by Nils Philippsen

Link to original bug (#766181)

Description

This bug was filed against the Fedora 22 package of GIMP 2.8.16, I'm filing it because the tile code is largely mysterious to me ;):

https://bugzilla.redhat.com/show_bug.cgi?id=1332207 Description of problem: I was using gimp doing a big copy-paste between 2 files (BMP 3480x1680 pixels RVB) and moving the floating canvas to align pictures lead to this SEGV

Version-Release number of selected component:
gimp-2.8.16-1.fc22

Additional info:
reporter:       libreport-2.6.4
backtrace_rating: 4
cmdline:        gimp-2.8 /home/teddy/brscan/brscan_2016-05-02-15-12-02.pnm
crash_function: tile_idle_preswap_run
executable:     /usr/bin/gimp-2.8
global_pid:     5966
kernel:         4.4.6-201.fc22.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (2 frames)
 #0 tile_idle_preswap_run at tile-cache.c:379
 #6 app_run at app.c:263

There are backtraces and various other automatically collected data on the original bug report which I won't copy here wholesale, unless you request it ;).

Here's the affected code:

 app/base/tile-cache.c: 379
  while (tile)
    {
      if (PENDING_WRITE (tile))     <-- SIGSEGV
        {
          idle_scan_last = tile->next;

"tile" is not NULL, and PENDING_WRITE() accesses its dirty and swap_offset members, so it seems like a previously freed tile object is used.

Version: 2.8.16

See also

• https://bugzilla.redhat.com/show_bug.cgi?id=1332207