#588221 metacity: crashes when a client tries to create a too big window

Package:
metacity
Source:
metacity
Description:
lightweight GTK window manager
Submitter:
Andras Veres-Szentkiralyi
Date:
2010-07-06 08:45:09 UTC
Severity:
normal
#588221#5
Date:
2010-07-04 12:10:30 UTC
From:
To:
While opening an invalid m3u file through the usage of the GUI of brasero, the
X server crashes. Such invalid playlist file can be generated by the
following command: perl -e 'print "A" x 30000' >crash.m3u


Brasero prints the following information to the console:

(brasero:4325): Gdk-WARNING **: Native Windows wider or taller than 65535
pixels are not supported
brasero: Fatal IO error 104 (A kapcsolatot bontotta a távoli fél) on X server
:0.0.


Relevant X.org log entries:

Backtrace:
0: /usr/bin/X (xorg_backtrace+0x3b) [0x80addcb]
1: /usr/bin/X (0x8048000+0x5ab75) [0x80a2b75]
2: (vdso) (__kernel_rt_sigreturn+0x0) [0xffffe40c]
3: /usr/bin/X (0x8048000+0xa1731) [0x80e9731]
4: /usr/bin/X (ConfigureWindow+0xa13) [0x8085053]
5: /usr/bin/X (0x8048000+0x2b182) [0x8073182]
6: /usr/bin/X (0x8048000+0x2c0d7) [0x80740d7]
7: /usr/bin/X (0x8048000+0x1e8fa) [0x80668fa]
8: /lib/i686/cmov/libc.so.6 (__libc_start_main+0xe6) [0xb75dac76]
9: /usr/bin/X (0x8048000+0x1e4e1) [0x80664e1]
Segmentation fault at address 0x40

Fatal server error:
Caught signal 11 (Segmentation fault). Server aborting

#588221#10
Date:
2010-07-04 12:59:45 UTC
From:
To:
reassign 588046 xserver-xorg
thanks

Le dimanche 04 juillet 2010 à 14:10 +0200, Andras Veres-Szentkiralyi a
écrit :

While some checking code on the Brasero or GTK+ side would be useful…

… a crash in the X server is a X bug.

Cheers,

#588221#19
Date:
2010-07-04 19:42:15 UTC
From:
To:
I can't reproduce an X crash with this, I get a metacity crash instead.
Please attach your full X log and config, and if possible get a full
backtrace from the crash with gdb.

Cheers,
Julien

#588221#24
Date:
2010-07-04 20:13:39 UTC
From:
To:
2010. július 4. vasárnap 21.42.15 dátummal Ön az alábbiakat írta:

I'm using KDE4, so maybe your Metacity crashes in reaction to some
"inappropriate behaviour", which KWin ignores and lets the error propagate
towards the X.org server.

My X log and config is attached, in the meanwhile I'll try to start the X.org
server inside GDB and send a backtrace too.

#588221#29
Date:
2010-07-04 20:33:18 UTC
From:
To:
I notice you're not running with kernel mode setting.  Any particular
reason why not?

Cheers,
Julien

#588221#34
Date:
2010-07-04 21:09:48 UTC
From:
To:
2010. július 4. vasárnap 22.33.18 dátummal Julien Cristau ezt írta:

I don't remember whether I had any particular reasons or not, I haven't
touched my X.org conf since August 2009.

I attached a full GDB backtrace.

#588221#39
Date:
2010-07-04 21:53:29 UTC
From:
To:
Thanks.  May I ask you to rebuild the xorg-server package with the
attached patch, see if it helps?

Thanks,
Julien

#588221#44
Date:
2010-07-04 22:27:03 UTC
From:
To:
2010. július 4. vasárnap 23.53.29 dátummal Julien Cristau ezt írta:

Sure, I applied the attached patch and started dpkg-buildpackage.

#588221#49
Date:
2010-07-04 22:41:58 UTC
From:
To:
2010. július 4. vasárnap 23.53.29 dátummal Julien Cristau ezt írta:

I rebuilt the xorg-server package with the attached patch, and it solved the
X.org side of the problem, so now brasero simply crashes (but leaves the X
server intact) and prints the following to the console:

(brasero:28709): Gdk-WARNING **: Native Windows wider or taller than 65535
pixels are not supported
The program 'brasero' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadDrawable (invalid Pixmap or Window parameter)'.
  (Details: serial 20839 error_code 9 request_code 62 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

#588221#54
Date:
2010-07-04 23:23:33 UTC
From:
To:
tag 588046 pending
kthxbye
Thanks, I've included that patch for the next upload.
Right, that's the (sort of) expected outcome, instead of crashing X
sends an error to the client.  Apps typically don't react very well to
that, but then brasero shouldn't create a window with an insanely big
width in the first place.

Cheers,
Julien