display-settings: heap-use-after-free in on_output_event
I noticed this crash while testing multiple displays with virt-viewer and a virtual machine. (I was trying to reproduce a crash report from Red Hat's Bugzilla.)
Steps to reproduce
- Ensure two displays are attached
- Open Display Settings
- In virt-viewer, resize the secondary display window a few times
- This step triggers dimension updates on the preview canvas. I'm not sure if there's a good way to simulate similar updates on physical hardware.
- While a resize is occurring, drag the display icon in the preview canvas area to trigger a use-after-free
Backtrace
ERROR: AddressSanitizer: heap-use-after-free on address 0x7b80d40a1fc0
READ of size 4 at 0x7b80d40a1fc0 thread T0
#0 0x562a8adb1b53 in on_output_event xfce4-settings/dialogs/display-settings/main.c:2570:69
#1 0x562a8adc0968 in emit_input xfce4-settings/dialogs/display-settings/scrollarea.c:739:5
#2 0x562a8adc0968 in process_event xfce4-settings/dialogs/display-settings/scrollarea.c:791:21
#3 0x562a8adc15e7 in process_gdk_event xfce4-settings/dialogs/display-settings/scrollarea.c:835:5
#4 0x562a8adbe02e in foo_scroll_area_button_press xfce4-settings/dialogs/display-settings/scrollarea.c:844:5
#5 0x7f10dc5d92c6 in _gtk_marshal_BOOLEAN__BOXEDv gtk3/builddir/gtk/gtkmarshalers.c:130:14
#6 0x7f10d8b0aee9 in g_type_class_meta_marshalv glib/gobject/gclosure.c:1145:5
#7 0x7f10d8b0960d in _g_closure_invoke_va glib/gobject/gclosure.c:980:7
#8 0x7f10d8b761de in signal_emit_valist_unlocked glib/gobject/gsignal.c:3465:8
#9 0x7f10d8b78c07 in g_signal_emit_valist glib/gobject/gsignal.c:3304:7
#10 0x7f10d8b78c07 in g_signal_emit glib/gobject/gsignal.c:3624:3
#11 0x7f10dd35c149 in gtk_widget_event_internal gtk3/gtk/gtkwidget.c:7827:4
#12 0x7f10dd35bb4b in gtk_widget_event gtk3/gtk/gtkwidget.c:7397:10
#13 0x7f10dccdc92e in propagate_event_up gtk3/gtk/gtkmain.c:2591:25
#14 0x7f10dccdc92e in propagate_event gtk3/gtk/gtkmain.c:2694:5
#15 0x7f10dccdb48d in gtk_propagate_event gtk3/gtk/gtkmain.c:2728:3
#16 0x7f10dccd95b6 in gtk_main_do_event gtk3/gtk/gtkmain.c:1924:9
#17 0x7f10daef9a99 in _gdk_event_emit gtk3/gdk/gdkevents.c:73:5
#18 0x7f10db0c209b in gdk_event_source_dispatch gtk3/gdk/x11/gdkeventsource.c:367:7
#19 0x7f10de361fbb in g_main_dispatch glib/glib/gmain.c:3728:27
#20 0x7f10de361fbb in g_main_context_dispatch_unlocked glib/glib/gmain.c:4596:7
#21 0x7f10de3631c8 in g_main_context_iterate_unlocked glib/glib/gmain.c:4665:5
#22 0x7f10de363f04 in g_main_loop_run glib/glib/gmain.c:4870:5
#23 0x7f10dccd8b16 in gtk_main gtk3/gtk/gtkmain.c:1332:7
#24 0x562a8ad9e983 in display_settings_show_main_dialog xfce4-settings/dialogs/display-settings/main.c:3045:9
#25 0x562a8ad9d057 in handle_local_options xfce4-settings/dialogs/display-settings/main.c:3333:13
[...snip...]
0x7b80d40a1fc0 is located 0 bytes inside of 80-byte region [0x7b80d40a1fc0,0x7b80d40a2010)
freed by thread T0 here:
#0 0x7f10de7853d1 in free
#1 0x7f10de388c58 in g_free glib/glib/gmem.c:208:3
#2 0x562a8ad94b01 in free_output xfce4-settings/dialogs/display-settings/display-settings.c:114:5
#3 0x7f10de345163 in g_list_foreach glib/glib/glist.c:1008:7
#4 0x7f10de345163 in g_list_free_full glib/glib/glist.c:162:3
#5 0x562a8ad939cf in xfce_display_settings_set_outputs xfce4-settings/dialogs/display-settings/display-settings.c:239:5
#6 0x562a8ad96ddf in xfce_display_settings_reload xfce4-settings/dialogs/display-settings/display-settings.c:659:9
#7 0x562a8adc276e in screen_on_event xfce4-settings/dialogs/display-settings/display-settings-x11.c:197:5
#8 0x7f10db0c1851 in gdk_event_apply_filters gtk3/gdk/x11/gdkeventsource.c:79:16
#9 0x7f10db0bfd5f in gdk_event_source_translate_event gtk3/gdk/x11/gdkeventsource.c:205:16
#10 0x7f10db0bfd5f in _gdk_x11_display_queue_events gtk3/gdk/x11/gdkeventsource.c:341:15
#11 0x7f10daee3106 in gdk_display_get_event gtk3/gdk/gdkdisplay.c:442:5
#12 0x7f10db0c208b in gdk_event_source_dispatch gtk3/gdk/x11/gdkeventsource.c:363:11
#13 0x7f10de361fbb in g_main_dispatch glib/glib/gmain.c:3728:27
#14 0x7f10de361fbb in g_main_context_dispatch_unlocked glib/glib/gmain.c:4596:7
#15 0x7f10de3631c8 in g_main_context_iterate_unlocked glib/glib/gmain.c:4665:5
#16 0x7f10de363f04 in g_main_loop_run glib/glib/gmain.c:4870:5
#17 0x7f10dccd8b16 in gtk_main gtk3/gtk/gtkmain.c:1332:7
#18 0x562a8ad9e983 in display_settings_show_main_dialog xfce4-settings/dialogs/display-settings/main.c:3045:9
#19 0x562a8ad9d057 in handle_local_options xfce4-settings/dialogs/display-settings/main.c:3333:13
[...snip...]
previously allocated by thread T0 here:
#0 0x7f10de786759 in calloc
#1 0x7f10de388baa in g_malloc0 glib/glib/gmem.c:133:13
#2 0x562a8adc5321 in xfce_display_settings_x11_get_output xfce4-settings/dialogs/display-settings/display-settings-x11.c:457:26
#3 0x562a8ad93a6d in xfce_display_settings_set_outputs xfce4-settings/dialogs/display-settings/display-settings.c:244:30
#4 0x562a8ad9db2b in display_settings_show_main_dialog xfce4-settings/dialogs/display-settings/main.c:2995:9
#5 0x562a8ad9d057 in handle_local_options xfce4-settings/dialogs/display-settings/main.c:3333:13
#6 0x7f10d93ecfb3 in _g_cclosure_marshal_INT__BOXED glib/gio/gmarshal-internal.c:714:14
#7 0x7f10d8b08d5a in g_closure_invoke glib/gobject/gclosure.c:916:7
#8 0x7f10d8b7be14 in signal_emit_unlocked_R glib/gobject/gsignal.c:3929:8
#9 0x7f10d8b7782f in signal_emit_valist_unlocked glib/gobject/gsignal.c:3574:7
#10 0x7f10d8b78c07 in g_signal_emit_valist glib/gobject/gsignal.c:3304:7
#11 0x7f10d8b78c07 in g_signal_emit glib/gobject/gsignal.c:3624:3
#12 0x7f10d9582a31 in g_application_real_local_command_line glib/gio/gapplication.c:1161:3
#13 0x7f10dc6a13a3 in gtk_application_local_command_line gtk3/gtk/gtkapplication.c:382:10
#14 0x7f10d9577f40 in g_application_run glib/gio/gapplication.c:2712:8
#15 0x562a8ad9c82a in main xfce4-settings/dialogs/display-settings/main.c:3447:5Version info
2fc61630 compiled on Arch Linux