Arch Linux

Description:

The native gtk color selection dialog is crashing if the color picker button is pressed. The crash happens in any application that uses the native color selector dialog picker like: gcolor2, geany color chooser plugin, etc...


Steps to reproduce:

1. Install gcolor2
2. Run gcolor2
3. Click color picker


Valgrind output of above steps:

$ valgrind gcolor2
==1444== Memcheck, a memory error detector
==1444== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al.
==1444== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info
==1444== Command: gcolor2
==1444==
==1444== Syscall param open(filename) points to unaddressable byte(s)
==1444== at 0x6195590: __open_nocancel (in /usr/lib/libc-2.19.so)
==1444== by 0x612EB01: _IO_file_open (in /usr/lib/libc-2.19.so)
==1444== by 0x612EC8F: _IO_file_fopen@@GLIBC_2.2.5 (in /usr/lib/libc-2.19.so)
==1444== by 0x6123C83: __fopen_internal (in /usr/lib/libc-2.19.so)
==1444== by 0x404B40: ??? (in /usr/bin/gcolor2)
==1444== by 0x4046B8: ??? (in /usr/bin/gcolor2)
==1444== by 0x60D8FFF: (below main) (in /usr/lib/libc-2.19.so)
==1444== Address 0x0 is not stack'd, malloc'd or (recently) free'd
==1444==
==1444== Invalid write of size 4
==1444== at 0x6E4794B: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E47F40: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DEB44F: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E62E9F: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E34696: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DF3EEB: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DECE48: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DE5D24: cairo_fill (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0xE0B8A4E: ??? (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== by 0xE0CAC19: ??? (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== by 0xE0C2947: ??? (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== by 0x4F9D854: ??? (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444== Address 0xffeffbef8 is on thread 1's stack
==1444==
==1444== Invalid read of size 4
==1444== at 0x6E44E3F: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E46A27: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E4797B: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E47F40: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DEB44F: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E62E9F: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6E34696: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DF3EEB: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DECE48: ??? (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0x6DE5D24: cairo_fill (in /usr/lib/libcairo.so.2.11200.16)
==1444== by 0xE0B8A4E: ??? (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== by 0xE0CAC19: ??? (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== Address 0xffeffbef8 is on thread 1's stack
==1444==
==1444== Conditional jump or move depends on uninitialised value(s)
==1444== at 0xE0D091B: murrine_draw_expander (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== by 0xE0C079B: ??? (in /usr/lib/gtk-2.0/2.10.0/engines/libmurrine.so)
==1444== by 0x4EFE8EF: ??? (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444== by 0x4F5F434: ??? (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444== by 0x5B71351: g_closure_invoke (in /usr/lib/libgobject-2.0.so.0.4000.0)
==1444== by 0x5B82B1A: ??? (in /usr/lib/libgobject-2.0.so.0.4000.0)
==1444== by 0x5B8A718: g_signal_emit_valist (in /usr/lib/libgobject-2.0.so.0.4000.0)
==1444== by 0x5B8AD01: g_signal_emit (in /usr/lib/libgobject-2.0.so.0.4000.0)
==1444== by 0x506EFE3: ??? (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444== by 0x4EE8387: gtk_container_propagate_expose (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444== by 0x4EB4AD9: ??? (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444== by 0x4EE6F13: ??? (in /usr/lib/libgtk-x11-2.0.so.0.2400.23)
==1444==
==1444== Stack overflow in thread 1: can't grow stack to 0xffe801fd8
==1444==
==1444== Process terminating with default action of signal 11 (SIGSEGV)
==1444== Access not within mapped region at address 0xFFE801FD8
==1444== at 0x61230FF: _IO_file_doallocate (in /usr/lib/libc-2.19.so)
==1444== If you believe this happened as a result of a stack
==1444== overflow in your program's main thread (unlikely but
==1444== possible), you can try to increase the size of the
==1444== main thread stack using the --main-stacksize= flag.
==1444== The main thread stack size used in this run was 8388608.
==1444== Stack overflow in thread 1: can't grow stack to 0xffe801fd0
==1444==
==1444== Process terminating with default action of signal 11 (SIGSEGV)
==1444== Access not within mapped region at address 0xFFE801FD0
==1444== at 0x4A236C0: _vgnU_freeres (in /usr/lib/valgrind/vgpreload_core-amd64-linux.so)
==1444== If you believe this happened as a result of a stack
==1444== overflow in your program's main thread (unlikely but
==1444== possible), you can try to increase the size of the
==1444== main thread stack using the --main-stacksize= flag.
==1444== The main thread stack size used in this run was 8388608.
==1444==
==1444== HEAP SUMMARY:
==1444== in use at exit: 4,424,190 bytes in 142,278 blocks
==1444== total heap usage: 1,350,088 allocs, 1,207,810 frees, 291,908,217 bytes allocated
==1444==
==1444== LEAK SUMMARY:
==1444== definitely lost: 3,840 bytes in 6 blocks
==1444== indirectly lost: 17,920 bytes in 748 blocks
==1444== possibly lost: 74,419 bytes in 1,073 blocks
==1444== still reachable: 4,132,435 bytes in 139,562 blocks
==1444== suppressed: 0 bytes in 0 blocks
==1444== Rerun with --leak-check=full to see details of leaked memory
==1444==
==1444== For counts of detected and suppressed errors, rerun with: -v
==1444== Use --track-origins=yes to see where uninitialised values come from
==1444== ERROR SUMMARY: 6 errors from 4 contexts (suppressed: 1 from 1)
Segmentation fault (core dumped)