Package: release.debian.org Severity: normal Tags: trixie X-Debbugs-Cc: [email protected] Control: affects -1 + src:lomiri-terminal-app User: [email protected] Usertags: pu
Please accept upload of lomiri-terminal-app 2.0.5-2+deb13u1 to Debian trixie. [ Reason ] Fix use-after-free issue, fix focus/foregrounding problem with settings dialog. [ Impact ] Above problems remain present in Lomiri on Debian trixie. [ Tests ] Manual tests on Debian 13's Lomiri. [ Risks ] Only for Lomiri / lomiri-terminal-app users. [ Checklist ] [x] *all* changes are documented in the d/changelog [x] I reviewed all changes and I approve them [x] attach debdiff against the package in (old)stable [x] the issue is verified as fixed in unstable [ Changes ] + lomiri-terminal-app (2.0.5-2+deb13u1) trixie; urgency=medium + + * debian/patches: + + Trivially rebase 2001_use-noto-fonts.patch. + + Add 0001_Fix-use-after-free-when-leaving-selection-mode.patch. Fix + use-after-free when leacing selection mode. + + Add 0002_Work-around-refocusing-the-settings-page.patch. Fix re-focusing + the settings dialog when having been sent to background before. + + -- Mike Gabriel <[email protected]> Wed, 04 Nov 2026 20:57:56 +0100 [ Other info ] None.
diff -Nru lomiri-terminal-app-2.0.5/debian/changelog lomiri-terminal-app-2.0.5/debian/changelog --- lomiri-terminal-app-2.0.5/debian/changelog 2025-06-20 14:02:09.000000000 +0200 +++ lomiri-terminal-app-2.0.5/debian/changelog 2026-11-04 20:57:56.000000000 +0100 @@ -1,3 +1,14 @@ +lomiri-terminal-app (2.0.5-2+deb13u1) trixie; urgency=medium + + * debian/patches: + + Trivially rebase 2001_use-noto-fonts.patch. + + Add 0001_Fix-use-after-free-when-leaving-selection-mode.patch. Fix + use-after-free when leacing selection mode. + + Add 0002_Work-around-refocusing-the-settings-page.patch. Fix re-focusing + the settings dialog when having been sent to background before. + + -- Mike Gabriel <[email protected]> Wed, 04 Nov 2026 20:57:56 +0100 + lomiri-terminal-app (2.0.5-2) unstable; urgency=medium [ Robert Tari ] diff -Nru lomiri-terminal-app-2.0.5/debian/patches/0001_Fix-use-after-free-when-leaving-selection-mode.patch lomiri-terminal-app-2.0.5/debian/patches/0001_Fix-use-after-free-when-leaving-selection-mode.patch --- lomiri-terminal-app-2.0.5/debian/patches/0001_Fix-use-after-free-when-leaving-selection-mode.patch 1970-01-01 01:00:00.000000000 +0100 +++ lomiri-terminal-app-2.0.5/debian/patches/0001_Fix-use-after-free-when-leaving-selection-mode.patch 2026-11-04 20:53:23.000000000 +0100 @@ -0,0 +1,62 @@ +From 8e94bc20f6a621f4d877c9f19dc91af9f095c60f Mon Sep 17 00:00:00 2001 +From: mad0ps <[email protected]> +Date: Wed, 19 Aug 2026 08:07:39 +0700 +Subject: [PATCH] Fix use-after-free when leaving selection mode + +The "exit selection mode" bar lives in the bottomMessage Loader, whose +active property is turned on by PropertyChanges in the SELECTION state. +Its MouseArea.onClicked reset terminalPage.state as its first statement, +which reverts that PropertyChanges and makes the Loader tear down its +item tree synchronously -- including the MouseArea still executing. The +following PopupUtils.open() then ran against freed objects, aborting the +process with munmap_chunk(): invalid pointer. + +This regressed in 8dcfc136. The same two statements previously lived in +closeSelectionButton / closeSelectionButtonTab, AbstractButtons toggled +through visible, where leaving the state hid them instead of destroying +them, so the handler could finish safely. + +Move the body into terminalPage.exitSelectionMode(), which runs on an +object that survives the state change; open the popover while the bar is +still alive and pass dummyForOtherActions as the caller, as the other two +call sites already do; defer the state change with Qt.callLater so the +teardown happens after the handler has returned. +--- + app/qml/TerminalPage.qml | 19 +++++++++++++++---- + 1 file changed, 15 insertions(+), 4 deletions(-) + +--- a/app/qml/TerminalPage.qml ++++ b/app/qml/TerminalPage.qml +@@ -45,6 +45,20 @@ + } + } + ++ // Leaving selection mode must not run inside the bottomMessage ++ // MouseArea: the SELECTION state keeps bottomMessage.active true, so ++ // resetting the state destroys the Loader item tree -- including this ++ // very MouseArea -- while its handler is still executing. Opening the ++ // popover afterwards then dereferences freed memory and aborts the ++ // process (munmap_chunk(): invalid pointer). ++ // Open the popover while the item is still alive, and defer the state ++ // change until the handler has returned. ++ function exitSelectionMode() { ++ PopupUtils.open(Qt.resolvedUrl("AlternateActionPopover.qml"), ++ dummyForOtherActions); ++ Qt.callLater(function () { terminalPage.state = "DEFAULT"; }); ++ } ++ + function changeColor(color) { + var red = 1 - (color.r * 0.05) + var green = 1 - (color.g * 0.05) +@@ -286,10 +300,7 @@ + anchors.fill: parent + cursorShape: Qt.PointingHandCursor + hoverEnabled: false +- onClicked: { +- terminalPage.state = "DEFAULT"; +- PopupUtils.open(Qt.resolvedUrl("AlternateActionPopover.qml")); +- } ++ onClicked: terminalPage.exitSelectionMode() + } + } + } diff -Nru lomiri-terminal-app-2.0.5/debian/patches/0002_Work-around-refocusing-the-settings-page.patch lomiri-terminal-app-2.0.5/debian/patches/0002_Work-around-refocusing-the-settings-page.patch --- lomiri-terminal-app-2.0.5/debian/patches/0002_Work-around-refocusing-the-settings-page.patch 1970-01-01 01:00:00.000000000 +0100 +++ lomiri-terminal-app-2.0.5/debian/patches/0002_Work-around-refocusing-the-settings-page.patch 2026-11-04 20:46:54.000000000 +0100 @@ -0,0 +1,30 @@ +From b2adb4d6446fb423729dabed7ac701cf2d40c249 Mon Sep 17 00:00:00 2001 +From: Kugi Eusebio <[email protected]> +Date: Tue, 1 Jul 2025 14:33:20 +0000 +Subject: [PATCH] Work around refocusing the settings page + +--- + app/qml/TerminalPage.qml | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/app/qml/TerminalPage.qml b/app/qml/TerminalPage.qml +index d92db30..aa1edd1 100644 +--- a/app/qml/TerminalPage.qml ++++ b/app/qml/TerminalPage.qml +@@ -41,7 +41,13 @@ Page { + if (!settingsLoader.item) { + settingsLoader.active = true; + } else { ++ // TODO: UT doesn't support window.raise yet ++ // requestActivate should be enough but it doesn't ++ // work properly in UT.Fix this once it's supported ++ settingsLoader.item.hide(); ++ settingsLoader.item.show(); + settingsLoader.item.requestActivate(); ++ settingsLoader.item.raise(); + } + } + +-- +2.47.3 + diff -Nru lomiri-terminal-app-2.0.5/debian/patches/2001_use-noto-fonts.patch lomiri-terminal-app-2.0.5/debian/patches/2001_use-noto-fonts.patch --- lomiri-terminal-app-2.0.5/debian/patches/2001_use-noto-fonts.patch 2025-05-05 22:55:16.000000000 +0200 +++ lomiri-terminal-app-2.0.5/debian/patches/2001_use-noto-fonts.patch 2026-11-04 20:53:16.000000000 +0100 @@ -4,7 +4,7 @@ --- a/app/qml/TerminalSettings.qml +++ b/app/qml/TerminalSettings.qml -@@ -67,7 +67,7 @@ +@@ -73,7 +73,7 @@ property Settings innerSettings: Settings { id: innerSettings property int fontSize: defaultFontSize diff -Nru lomiri-terminal-app-2.0.5/debian/patches/series lomiri-terminal-app-2.0.5/debian/patches/series --- lomiri-terminal-app-2.0.5/debian/patches/series 2025-06-20 14:01:58.000000000 +0200 +++ lomiri-terminal-app-2.0.5/debian/patches/series 2026-11-04 20:56:10.000000000 +0100 @@ -2,3 +2,5 @@ 2003_ignore-autopilot.patch 2004_hide-app-if-not-in-lomiri.patch 2005_suppress-xkb-compose.patch +0001_Fix-use-after-free-when-leaving-selection-mode.patch +0002_Work-around-refocusing-the-settings-page.patch
