[Pidgin] #15282: Reliable crash of Ubuntu's Pidgin build

[Pidgin]

#15282: Reliable crash of Ubuntu's Pidgin build
--------------------+-------------------------------------------------------
Reporter:  ioerror  |        Type:  defect      
  Status:  new      |   Component:  pidgin (gtk)
 Version:  2.7.11   |    Keywords:  security    
--------------------+-------------------------------------------------------
 During my attempts to triage ( #14571 and #15281 ) and reproduce some
 libpng/zlib/gtk bugs, I found a reliable crash in the Pidgin shipping with
 Ubuntu's Natty release. Please see bug #14571 for the malformed png files
 I'm using to crash Pidgin.

 It also appears that those pngs trigger some bugs (likely GTK again) with
 Ubuntu's pidgin on Natty (Pidgin 2.7.11 (libpurple 2.7.11)).

 When trying to set my Ubuntu client's buddy icon (in accounts, settings,
 xmpp account, use this buddy icon) to png-1-width-800-height-2.png, my
 entire pidgin crashes:
 {{{
 [New Thread 0x7f469effd700 (LWP 11116)]
 [Thread 0x7f469cc22700 (LWP 11115) exited]
 The program 'Pidgin' received an X Window System error.
 This probably reflects a bug in the program.
 The error was 'BadAlloc (insufficient resources for operation)'.
   (Details: serial 91875 error_code 11 request_code 53 minor_code 0)
   (Note to programmers: normally, X errors are reported asynchronously;
    that is, you will receive the error a while after causing it.
    To debug your program, run it with the --sync command line
    option to change this behavior. You can then get a meaningful
    backtrace from your debugger if you break on the gdk_x_error()
 function.)
 [Thread 0x7f46a814d700 (LWP 10426) exited]
 [Thread 0x7f469effd700 (LWP 11116) exited]
 }}}

 Here's another run:
 {{{
 The program 'Pidgin' received an X Window System error.
 This probably reflects a bug in the program.
 The error was 'BadAlloc (insufficient resources for operation)'.
   (Details: serial 9969573 error_code 11 request_code 53 minor_code 0)
   (Note to programmers: normally, X errors are reported asynchronously;
    that is, you will receive the error a while after causing it.
    To debug your program, run it with the --sync command line
    option to change this behavior. You can then get a meaningful
    backtrace from your debugger if you break on the gdk_x_error()
 function.)
 }}}

 This is a reliable crash using png-1-width-800-height-2.png - I have a
 bunch of other malformed pngs in the same directory and the directory
 actually _re-arranges_ itself while waiting for me to select a file:
 {{{
 The program 'Pidgin' received an X Window System error.
 This probably reflects a bug in the program.
 The error was 'BadAlloc (insufficient resources for operation)'.
   (Details: serial 135898 error_code 11 request_code 53 minor_code 0)
   (Note to programmers: normally, X errors are reported asynchronously;
    that is, you will receive the error a while after causing it.
    To debug your program, run it with the --sync command line
    option to change this behavior. You can then get a meaningful
    backtrace from your debugger if you break on the gdk_x_error()
 function.)
 }}}

 Once I even triggered what might just be an epic AppArmor kernel message
 log before it crashed out. Note the value after "name=" and well, what
 just happened?
 {{{
 [194563.072597] type=1400 audit(1345771956.934:381): apparmor="DENIED"
 operation="open" parent=16943 profile="/usr/bin/pidgin"
 name=2F686F6D652F696F2F4465736B746F702F436C65616E207570202F pid=16964
 comm="pidgin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=1000
 }}}

-- 
Ticket URL: <http://developer.pidgin.im/ticket/15282>
Pidgin <http://pidgin.im>
Pidgin