xfdesktop crashes when showing a corrupt JPEG

Issue Description

When attempting to display a corrupted JPEG file, xfdesktop crashes.

Steps to Reproduce Issue

1. Configure xfdesktop so that it will show a corrupted image. In my case, I set it to cycle through a wallpaper folder that contained a corrupted JPEG.

Expected Behavior

Either (a) it shows a partial image, or (b) it shows the default gradient/solid background.

Additional Information

Stack trace from the crash:

Thread 1 "xfdesktop" received signal SIGSEGV, Segmentation fault.
0x000055555558658c in render_finished (surface=0x0, width=-1, height=<optimized out>, error=0x5555560fda40, user_data=0x555557481310) at xfdesktop-backdrop-manager.c:855
855	            ridata->callback(NULL, NULL, NULL, error, ridata->callback_user_data);
(gdb) bt
#0  0x000055555558658c in render_finished (surface=0x0, width=-1, height=<optimized out>, error=0x5555560fda40, user_data=0x555557481310)
    at xfdesktop-backdrop-manager.c:855
#1  0x000055555558855b in image_data_error (image_data=<optimized out>, error=0x5555560fda40) at xfdesktop-backdrop-renderer.c:78
#2  0x0000555555588788 in file_input_stream_ready_cb (source_object=0x7fffd0000e20, res=<optimized out>, user_data=0x55555590adc0) at xfdesktop-backdrop-renderer.c:535
#3  0x00007ffff6ec1f4e in async_ready_callback_wrapper () at /usr/lib64/libgio-2.0.so.0
#4  0x00007ffff6ef7543 in g_task_return_now () at /usr/lib64/libgio-2.0.so.0
#5  0x00007ffff6ef757d in complete_in_idle_cb () at /usr/lib64/libgio-2.0.so.0
#6  0x00007ffff6cf0fc2 in g_main_dispatch () at /usr/lib64/libglib-2.0.so.0
#7  0x00007ffff6cf4487 in g_main_context_iterate_unlocked.isra () at /usr/lib64/libglib-2.0.so.0
#8  0x00007ffff6cf4ae0 in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#9  0x00007ffff6f27c0d in g_application_run () at /usr/lib64/libgio-2.0.so.0
#10 0x000055555557e416 in main (argc=1, argv=0x7fffffffd258) at main.c:64

I've also got a Valgrind log in case that's useful.

Environment & Versions

• OS distribution and version: Gentoo
• Overall Xfce version: 4.20.0
• xfdesktop version (git hash if not a release): Occurs in both 4.20.0 and 65df08d4
• Windowing system (X11/Wayland): X11

changed the description

When it crashes in gdb, can you run print *ridata?

(gdb) print *ridata
Cannot access memory at address 0x555002198b15

Argh, was afraid of that. Thank you!

Is it possible for you to share the corrupt file you are using? I created a file with random data in it, and I do get a crash when I try to set it as the background, but it's a different crash from what you get...

I just tried a few more runs, and it's not always the same crash for me, either. The other stack trace I get is

Thread 1 "xfdesktop" received signal SIGSEGV, Segmentation fault.
0x00007ffff7369a0e in gdk_cairo_surface_create_from_pixbuf () from /usr/lib64/libgdk-3.so.0
(gdb) bt
#0  0x00007ffff7369a0e in gdk_cairo_surface_create_from_pixbuf () at /usr/lib64/libgdk-3.so.0
#1  0x0000555555588580 in image_data_error (image_data=0x5555573e4cb0, error=0x55555750e9a0) at xfdesktop-backdrop-renderer.c:75
#2  0x0000555555588788 in file_input_stream_ready_cb (source_object=0x7fffc00123f0, res=<optimized out>, user_data=0x5555573e4cb0) at xfdesktop-backdrop-renderer.c:535
#3  0x00007ffff6ec1f4e in async_ready_callback_wrapper () at /usr/lib64/libgio-2.0.so.0
#4  0x00007ffff6ef7543 in g_task_return_now () at /usr/lib64/libgio-2.0.so.0
#5  0x00007ffff6ef757d in complete_in_idle_cb () at /usr/lib64/libgio-2.0.so.0
#6  0x00007ffff6cf0fc2 in g_main_dispatch () at /usr/lib64/libglib-2.0.so.0
#7  0x00007ffff6cf4487 in g_main_context_iterate_unlocked.isra () at /usr/lib64/libglib-2.0.so.0
#8  0x00007ffff6cf4ae0 in g_main_context_iteration () at /usr/lib64/libglib-2.0.so.0
#9  0x00007ffff6f27c0d in g_application_run () at /usr/lib64/libgio-2.0.so.0
#10 0x000055555557e416 in main (argc=1, argv=0x7fffffffd258) at main.c:64

I've uploaded a Valgrind log of a crash at https://pastebin.com/vKQF60eY showing a third stack trace, and a clear use-after-free issue.

added 1. Crash / Freeze 5. Background Backtrace / Log labels

Ah, that's the same stack trace I saw. In that case, this should be fixed by b7a9595b

I can confirm that it fixes things.

closed