Bug#918815: gimp: fatal error: speicherzugriffsfehler (gimp crash debug)

[Bernhard Übelacker]

Hello Michael Hatzold,
I tried to have a look and guess gimp received from some
plugin feedback in form of a malformed GIMP_PDB_INT16ARRAY.

Unfortunately this may not be enough information
for the maintainer to fix it.

Could you please provide more details on which exact
steps you took to trigger that crash?

Also when forwarding such backtraces it would be highly
appreciated if you could consider installing the debug
symbols for the crashing application, e.g. gimp-dbgsym.
These packages are contained in a special debian repository [1].

Kind regards,
Bernhard


[1] https://wiki.debian.org/HowToGetABacktrace#Installing_the_debugging_symbols


#6  <signal handler called> () at /lib/x86_64-linux-gnu/libpthread.so.0
#7  g_type_check_value_holds () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#8  g_value_get_int () at /usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0
#9  0x00005555558c8b2b plug_in_params_to_args () at plug-in-params.c:145
    0x00005555558bd003 in gimp_plug_in_handle_proc_return () at gimpplugin-message.c:647
#10 gimp_plug_in_handle_message () at gimpplugin-message.c:132
    0x00005555558bbaa1 in gimp_plug_in_recv_message () at gimpplugin.c:210
    gimp_plug_in_recv_message () at gimpplugin.c:178
#11 0x00007ffff6cafcb8 in g_main_dispatch () at ../../../glib/gmain.c:3182
#12 g_main_context_dispatch () at ../../../glib/gmain.c:3847
#13 0x00007ffff6cb00a8 in g_main_context_iterate () at ../../../glib/gmain.c:3920
#14 0x00007ffff6cb03a2 in g_main_loop_run () at ../../../glib/gmain.c:4116
#15 0x0000555555624cb7 in app_run () at app.c:440
#16 0x00005555556245b5 in main () at main.c:524


(gdb) list plug-in-params.c:36,258
...
38      plug_in_params_to_args (GParamSpec **pspecs,
...
94            switch (gimp_pdb_compat_arg_type_from_gtype (type))
...
144             case GIMP_PDB_INT16ARRAY:
145               count = g_value_get_int (gimp_value_array_index (args, i - 1));
   0x00005555558c8b18 <+760>:   lea    -0x1(%rbx),%esi
   0x00005555558c8b1b <+763>:   mov    %r14,%rdi
   0x00005555558c8b1e <+766>:   callq  0x555555619120 <gimp_value_array_index at plt>
   0x00005555558c8b23 <+771>:   mov    %rax,%rdi
   0x00005555558c8b26 <+774>:   callq  0x55555561e3b0 <g_value_get_int at plt>

146               if (full_copy)
   0x00005555558c8b2b <+779>:   mov    0x1c(%rsp),%r11d
   0x00005555558c8b30 <+784>:   mov    0x0(%rbp),%rsi
   0x00005555558c8b34 <+788>:   mov    %r12,%rdi
   0x00005555558c8b37 <+791>:   movslq %eax,%rdx
   0x00005555558c8b3a <+794>:   test   %r11d,%r11d
   0x00005555558c8b3d <+797>:   je     0x5555558c8cd0 <plug_in_params_to_args+1200>

147                 gimp_value_set_int16array (&value,
...