https://bugs.kde.org/show_bug.cgi?id=523405
--- Comment #1 from Jan Iversen <[email protected]> --- This is very likely a duplicate of bug 523105, which was reported a few days earlier and identifies the root cause: the heif_reader struct in HEIFHandler::ensureDecoder() is a block-local, and libheif keeps only a raw pointer to it (StreamReader_CApi::m_func_table), so the function table is read from a dead stack frame later on. That matches my backtrace exactly - my crash is a jump to 0x0 from StreamReader_CApi::request_range. One difference worth noting: for me only a single HEIC file triggers the crash, while bug 523105 reports it for every HEIC. That seems consistent with the dangling-pointer analysis, where whether the clobbered stack slot happens to hold garbage or a usable value is essentially chance. My report also confirms the regression boundary from a different angle: Debian Trixie with kimageformats 6.27.0 is unaffected, two openSUSE Tumbleweed machines with 6.28.0 both crash. Feel free to close this as a duplicate. -- You are receiving this mail because: You are watching all bug changes.
