https://bugs.kde.org/show_bug.cgi?id=523405
Bug ID: 523405
Summary: HEIF plugin crashes with a NULL function pointer call
in libheif's StreamReader_CApi::request_range
Classification: Frameworks and Libraries
Product: frameworks-kimageformats
Version First unspecified
Reported In:
Platform: openSUSE
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected]
Target Milestone: ---
Created attachment 194541
--> https://bugs.kde.org/attachment.cgi?id=194541&action=edit
archive with image, coredumb, debuginfo
DESCRIPTION
Generating a thumbnail for a tiled (grid) HEIC image crashes the
process with SIGSEGV. With debug symbols the crash is a jump to
address 0x0:
#4 0x0000000000000000 in ??? ()
#5 StreamReader_CApi::request_range (this=0x..., end_pos=41227)
at libheif-1.23.0/libheif/bitstream.h:168
libheif is reading through the C API reader callback struct supplied
by the HEIF plugin (HEIFHandler::ensureDecoder, heif.cpp:791) and
calls request_range, which is not set - hence the call to a NULL
pointer. My reading is that the reader struct built by the plugin
does not provide this (newer, optional) callback, while libheif calls
it unconditionally. Whether the fix belongs in the plugin or in
libheif is for you to judge.
The crash happens in a worker thread that libheif spawns itself for
grid tile decoding (ImageItem_Grid::decode_and_paste_tile_image), not
in a thread created by KIO. The other threads visible in the
backtrace are sibling tile decoders blocked after this one died.
STEPS TO REPRODUCE
1. Put the attached HEIC file into a folder.
2. Open that folder in Dolphin with image previews enabled.
3. kioworker crashes.
OBSERVED RESULT
kioworker terminates with SIGSEGV, no thumbnail is produced.
100% reproducible - it happens on every single attempt.
EXPECTED RESULT
A thumbnail is generated, or the decode fails gracefully. A missing
optional callback should never lead to a NULL function pointer call.
SOFTWARE/OS VERSIONS
Operating System: openSUSE Tumbleweed (rolling, fully updated)
KDE Plasma Version: 6.7.3
KDE Frameworks Version: 6.28.0
Qt Version: 6.11.1
Relevant packages:
kf6-kimageformats 6.28.0
kio-extras 26.04.3
libheif1 1.23.0 (Packman repository)
libde265-0 1.1.1 (Packman repository)
Note: libheif and its codec plugins come from Packman, not from the
official openSUSE repositories.
ADDITIONAL INFORMATION
The file itself is fine - `file` reports "ISO Media, HEIF Image HEVC
Main or Main Still Picture Profile" and it decodes to a correct
2316x3088 image.
Only the Qt/kimageformats path crashes. Everything that reads the
file directly instead of through the C API reader callbacks works:
- `heif-dec` on the command line: OK (single and 30 parallel runs)
- GIMP: opens the file without problems
- ImageMagick with libheif 1.17.6: OK
- pillow-heif with libheif 1.23.1: OK
Reproduced on two openSUSE Tumbleweed machines with different
hardware but an identical package set. NOT reproducible on Debian
Trixie with Plasma, which ships an older libheif - consistent with
request_range only being called by newer libheif versions.
I am an end user, not a developer. I used Claude (Anthropic's AI
assistant) to help analyse the coredump and narrow this down, but all
commands, versions and test results above were run on my own systems.
Please note that I am not able to build packages or test patches
before they are released, so I cannot verify a proposed fix. The
attached backtrace, the test image and the observations above are
everything I can contribute. I am of course happy to answer questions
or re-test once a fix reaches the openSUSE Tumbleweed repositories.
Full backtrace with debug symbols and the test image are attached.
--
You are receiving this mail because:
You are watching all bug changes.
