Bug#837635: mate-settings-daemon: Segfaults when trying to display OSD notification

Dagfinn Ilmari Mannsåker ilmari at ilmari.org
Tue Sep 13 07:24:55 UTC 2016


Package: mate-settings-daemon
Version: 1.14.1-1
Severity: important

Dear Maintainer,

When pressing any key that would normally cause an OSD notification
(e.g. volume or screen brightness), mate-settings-daemon segfaults.

Here's the stack trace, register dump and disassembly of the offending
code.

(gdb) bt full
#0  0x00007f22727597b6 in __GI_____strtod_l_internal (nptr=nptr at entry=0x7f2274ec821d "10", endptr=endptr at entry=0x7ffc834c1280, group=group at entry=0, loc=0x7f2272ab8b60 <_nl_C_locobj>) at strtod_l.c:481
        negative = <optimized out>
Python Exception <class 'gdb.MemoryError'> Cannot access memory at address 0x7ffc834c0e80: 
        num = #1  0x00007f227275b7ea in __GI___strtod_l (nptr=nptr at entry=0x7f2274ec821d "10", endptr=endptr at entry=0x7ffc834c1280, loc=<optimized out>) at strtod_l.c:1756
#2  0x00007f2272d46e45 in g_ascii_strtod (nptr=nptr at entry=0x7f2274ec821d "10", endptr=endptr at entry=0x7ffc834c1280) at ././glib/gstrfuncs.c:696
#3  0x00007f227435f0fe in parse_size (word=word at entry=0x7f2274ec821d "10", wordlen=2, pango_size=pango_size at entry=0x563831748c30, size_is_absolute=size_is_absolute at entry=0x7ffc834c12cc) at ././pango/fonts.c:1057
        end = 0x563830602d70 "\220\315=08V"
        size = <optimized out>
#4  0x00007f22743607a1 in pango_font_description_from_string (str=str at entry=0x7f2274ec8218 "Sans 10") at ././pango/fonts.c:1120
        size_is_absolute = 32546
        desc = 0x563831748c10
        p = 0x7f2274ec821d "10"
        last = 0x7f2274ec821f ""
        len = <optimized out>
        wordlen = 2
        __func__ = "pango_font_description_from_string"
#5  0x00007f2274b7e2d0 in gtk_style_init (style=0x56383174c370 [GtkStyle])
    at ././gtk/deprecated/gtkstyle.c:384
#6  0x00007f227302236b in g_type_create_instance (type=<optimized out>)
    at ././gobject/gtype.c:1866
        instance = 0x56383174c370 [GtkStyle]
        class = 0x563830602d70
        allocated = <optimized out>
        private_size = <optimized out>
        ivar_size = <optimized out>
        i = <optimized out>
#7  0x00007f227300420b in g_object_new_internal (class=class at entry=0x563830602d70, params=params at entry=0x7ffc834c15a0, n_params=n_params at entry=1) at ././gobject/gobject.c:1783
        nqueue = 0x0
        object = <optimized out>
        __func__ = "g_object_new_internal"
#8  0x00007f227300611e in g_object_new_valist (object_type=object_type at entry=94799327514000, first_property_name=first_property_name at entry=0x7f2274efe66c "context", var_args=var_args at entry=0x7ffc834c16f0) at ././gobject/gobject.c:2042
        stack_params = 
            {{pspec = 0x5638304ff450 [GParamObject], value = 0x7ffc834c14f0}, {pspec = 0x7ffc10000001, value = 0x6393946f16ba6800}, {pspec = 0x0, value = 0x7ffc834c1718}, {pspec = 0x56383174c0e0 [GtkStyle], value = 0x7ffc834c1718}, {pspec = 0x7ffc834c18a0, value = 0x5638304ff450}, {pspec = 0x5638304ff450 [GParamObject], value = 0x7f2273019fcf <g_signal_emit+143>}, {pspec = 0x3000000018, value = 0x7ffc834c16e0}, {pspec = 0x7ffc834c1620, value = 0x6393946f16ba6800}, {pspec = 0x0, value = 0x7f227301036b <handler_insert+635>}, {pspec = 0x2030351120, value = 0x5638304ff450}, {pspec = 0x13, value = 0x10}, {pspec = 0xe7, value = 0x0}, {pspec = 0x0, value = 0x0}, {pspec = 0x7f2274b82c20, value = 0x5638306fda20}, {pspec = 0x1f, value = 0x7f2272d45919 <g_slice_free_chain_with_offset+73>}, {pspec = 0x8, value = 0x0}}
        params = 0x7ffc834c15a0
        name = <optimized out>
        n_params = 1
        class = <optimized out>
        unref_class = <optimized out>
        object = <optimized out>
        __func__ = "g_object_new_valist"
#9  0x00007f22730063c1 in g_object_new (object_type=94799327514000, first_property_name=first_property_name at entry=0x7f2274efe66c "context") at ././gobject/gobject.c:1626
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#10 0x00007f2274b84656 in gtk_widget_get_style (widget=widget at entry=0x5638305863b0 [MsdMediaKeysWindow]) at ././gtk/deprecated/gtkstyle.c:4180
        style = <optimized out>
        __func__ = "gtk_widget_get_style"
#11 0x00007f2256cefb04 in msd_osd_window_style_set (widget=0x5638305863b0 [MsdMediaKeysWindow], previous_style=0x0) at msd-osd-window.c:512
        style = <optimized out>
#12 0x00007f2273002010 in g_cclosure_marshal_VOID__OBJECTv (closure=0x563830420fc0, return_value=<optimized out>, instance=0x5638305863b0, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56383046cf80)
    at ././gobject/gmarshal.c:2102
        cc = 0x563830420fc0
        data1 = <optimized out>
        data2 = <optimized out>
        callback = 0x7f2256cefad0 <msd_osd_window_style_set>
        arg0 = 0x0
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#13 0x00007f2272fff102 in _g_closure_invoke_va (closure=closure at entry=0x563830420fc0, return_value=return_value at entry=0x0, instance=instance at entry=0x5638305863b0, args=args at entry=0x7ffc834c1a90, n_params=1, param_types=0x56383046cf80) at ././gobject/gclosure.c:867
        marshal = <optimized out>
        marshal_data = <optimized out>
        in_marshal = 1
        real_closure = 0x563830420fa0
        __func__ = "_g_closure_invoke_va"
#14 0x00007f22730198dd in g_signal_emit_valist (instance=0x5638305863b0, signal_id=<optimized out>, detail=0, var_args=var_args at entry=0x7ffc834c1a90)
    at ././gobject/gsignal.c:3300
        return_accu = <optimized out>
        accu = 
              {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = 0x0
        emission = 
          {next = 0x7ffc834c1d40, instance = 0x5638305863b0, ihint = {signal_id = 70, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 94799332034496}
        signal_id = <optimized out>
        instance_type = <optimized out>
        emission_return = 
              {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = 4
        static_scope = 0
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        l = <optimized out>
        fastpath = <optimized out>
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#15 0x00007f2273019fcf in g_signal_emit (instance=instance at entry=0x5638305863b0, signal_id=<optimized out>, detail=detail at entry=0) at ././gobject/gsignal.c:3447
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#16 0x00007f2274e7e883 in _gtk_widget_set_style (widget=widget at entry=0x5638305863b0 [MsdMediaKeysWindow], style=style at entry=0x56383174c0e0 [GtkStyle])
    at ././gtk/gtkwidget.c:16622
#17 0x00007f2274b84666 in gtk_widget_get_style (widget=widget at entry=0x5638305863b0 [MsdMediaKeysWindow]) at ././gtk/deprecated/gtkstyle.c:4183
        style = 0x56383174c0e0 [GtkStyle]
        __func__ = "gtk_widget_get_style"
#18 0x00007f2256cefb04 in msd_osd_window_style_set (widget=0x5638305863b0 [MsdMediaKeysWindow], previous_style=0x0) at msd-osd-window.c:512
        style = <optimized out>
#19 0x00007f2273002010 in g_cclosure_marshal_VOID__OBJECTv (closure=0x563830420fc0, return_value=<optimized out>, instance=0x5638305863b0, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56383046cf80)
    at ././gobject/gmarshal.c:2102
        cc = 0x563830420fc0
        data1 = <optimized out>
        data2 = <optimized out>
        callback = 0x7f2256cefad0 <msd_osd_window_style_set>
        arg0 = 0x0
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#20 0x00007f2272fff102 in _g_closure_invoke_va (closure=closure at entry=0x563830420fc0, return_value=return_value at entry=0x0, instance=instance at entry=0x5638305863b0, args=args at entry=0x7ffc834c1e40, n_params=1, param_types=0x56383046cf80) at ././gobject/gclosure.c:867
        marshal = <optimized out>
        marshal_data = <optimized out>
        in_marshal = 1
        real_closure = 0x563830420fa0
        __func__ = "_g_closure_invoke_va"
#21 0x00007f22730198dd in g_signal_emit_valist (instance=0x5638305863b0, signal_id=<optimized out>, detail=0, var_args=var_args at entry=0x7ffc834c1e40)
    at ././gobject/gsignal.c:3300
        return_accu = <optimized out>
        accu = 
              {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        accumulator = 0x0
        emission = 
          {next = 0x7ffc834c20f0, instance = 0x5638305863b0, ihint = {signal_id = 70, detail = 0, run_type = G_SIGNAL_RUN_FIRST}, state = EMISSION_RUN, chain_type = 94799332034496}
        signal_id = <optimized out>
        instance_type = <optimized out>
        emission_return = 
              {g_type = 0, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
        rtype = 4
        static_scope = 0
        fastpath_handler = <optimized out>
        closure = <optimized out>
        run_type = <optimized out>
        l = <optimized out>
        fastpath = <optimized out>
        instance_and_params = <optimized out>
        signal_return_type = <optimized out>
        param_values = <optimized out>
        i = <optimized out>
        n_params = <optimized out>
        __func__ = "g_signal_emit_valist"
#22 0x00007f2273019fcf in g_signal_emit (instance=instance at entry=0x5638305863b0, signal_id=<optimized out>, detail=detail at entry=0) at ././gobject/gsignal.c:3447
Python Exception <class 'gdb.error'> Attempt to dereference a generic pointer.: 
#23 0x00007f2274e7e883 in _gtk_widget_set_style (widget=widget at entry=0x5638305863b0 [MsdMediaKeysWindow], style=style at entry=0x563831747cb0 [GtkStyle])
    at ././gtk/gtkwidget.c:16622
#24 0x00007f2274b84666 in gtk_widget_get_style (widget=widget at entry=0x5638305863b0 [MsdMediaKeysWindow]) at ././gtk/deprecated/gtkstyle.c:4183
        style = 0x563831747cb0 [GtkStyle]
        __func__ = "gtk_widget_get_style"
#25 0x00007f2256cefb04 in msd_osd_window_style_set (widget=0x5638305863b0 [MsdMediaKeysWindow], previous_style=0x0) at msd-osd-window.c:512
        style = <optimized out>
#26 0x00007f2273002010 in g_cclosure_marshal_VOID__OBJECTv (closure=0x563830420fc0, return_value=<optimized out>, instance=0x5638305863b0, args=<optimized out>, marshal_data=<optimized out>, n_params=<optimized out>, param_types=0x56383046cf80)
    at ././gobject/gmarshal.c:2102
        cc = 0x563830420fc0
        data1 = <optimized out>
        data2 = <optimized out>
        callback = 0x7f2256cefad0 <msd_osd_window_style_set>
        arg0 = 0x0

(gdb) info registers
rax            0x7f2272ab8b60	139785929460576
rbx            0x7f2274ec821d	139785967272477
rcx            0x7f2272ab8b60	139785929460576
rdx            0x0	0
rsi            0x7ffc834c1280	140722511286912
rdi            0x7f2274ec821d	139785967272477
rbp            0x7ffc834c12cc	0x7ffc834c12cc
rsp            0x7ffc834c0e10	0x7ffc834c0e10
r8             0x7f2272d7d960	139785932364128
r9             0x7f2272ab8b60	139785929460576
r10            0x7ffc834c14f0	140722511287536
r11            0x5638303574a0	94799326966944
r12            0x563831748c30	94799347878960
r13            0x2	2
r14            0x7ffc834c12d0	140722511286992
r15            0x7f2273241660	139785937360480
rip            0x7f22727597b6	0x7f22727597b6 <__GI_____strtod_l_internal+22>
eflags         0x10246	[ PF ZF IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0

(gdb) disassemble 
Dump of assembler code for function __GI_____strtod_l_internal:
   0x00007f22727597a0 <+0>:	push   %r15
   0x00007f22727597a2 <+2>:	push   %r14
   0x00007f22727597a4 <+4>:	mov    %rcx,%r9
   0x00007f22727597a7 <+7>:	push   %r13
   0x00007f22727597a9 <+9>:	push   %r12
   0x00007f22727597ab <+11>:	push   %rbp
   0x00007f22727597ac <+12>:	push   %rbx
   0x00007f22727597ad <+13>:	sub    $0x438,%rsp
   0x00007f22727597b4 <+20>:	test   %edx,%edx
=> 0x00007f22727597b6 <+22>:	mov    %rsi,0x8(%rsp)
   0x00007f22727597bb <+27>:	mov    %rdi,0x10(%rsp)
   0x00007f22727597c0 <+32>:	mov    0x8(%rcx),%rsi
   0x00007f22727597c4 <+36>:	je     0x7f22727597d8 <__GI_____strtod_l_internal+56>
   0x00007f22727597c6 <+38>:	mov    0x50(%rsi),%rcx
   0x00007f22727597ca <+42>:	movzbl (%rcx),%eax
   0x00007f22727597cd <+45>:	sub    $0x1,%eax
   0x00007f22727597d0 <+48>:	cmp    $0x7d,%al


-- System Information:
Debian Release: stretch/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'testing-debug'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages mate-settings-daemon depends on:
ii  libatk1.0-0                      2.21.90-2
ii  libc6                            2.23-5
ii  libcairo-gobject2                1.14.6-1+b1
ii  libcairo2                        1.14.6-1+b1
ii  libcanberra-gtk3-0               0.30-3
ii  libcanberra0                     0.30-3
ii  libdbus-1-3                      1.10.10-1
ii  libdbus-glib-1-2                 0.106-1
ii  libdconf1                        0.26.0-1
ii  libfontconfig1                   2.11.0-6.7
ii  libfreetype6                     2.6.3-3+b1
ii  libgdk-pixbuf2.0-0               2.34.0-1
ii  libglib2.0-0                     2.49.6-1
ii  libgtk-3-0                       3.21.5-3
ii  libice6                          2:1.0.9-1+b1
ii  libmate-desktop-2-17             1.14.1-1
ii  libmatekbd4                      1.14.1-1
ii  libmatemixer0                    1.14.0-1
ii  libnotify4                       0.7.6-2
ii  libnspr4                         2:4.12-2
ii  libnss3                          2:3.26-1
ii  libpango-1.0-0                   1.40.2-1
ii  libpangocairo-1.0-0              1.40.2-1
ii  libpolkit-gobject-1-0            0.105-16
ii  libpulse0                        9.0-3
ii  libsm6                           2:1.2.2-1+b1
ii  libstartup-notification0         0.12-4
ii  libx11-6                         2:1.6.3-1
ii  libxext6                         2:1.3.3-1
ii  libxi6                           2:1.7.6-1
ii  libxklavier16                    5.4-1
ii  mate-desktop-common              1.14.1-1
ii  mate-polkit [policykit-1-gnome]  1.14.0-1
ii  mate-settings-daemon-common      1.14.1-1
ii  policykit-1-gnome                0.105-3
ii  x11-xserver-utils                7.7+7

mate-settings-daemon recommends no packages.

mate-settings-daemon suggests no packages.

-- no debconf information



More information about the pkg-mate-team mailing list