https://bugs.kde.org/show_bug.cgi?id=523186
Bug ID: 523186
Summary: kimg_heif.so crashes (SIGSEGV, null request_range
callback) when opening grid/tiled HEIC images
Classification: Frameworks and Libraries
Product: frameworks-kimageformats
Version First 6.28.0
Reported In:
Platform: Fedora RPMs
OS: Linux
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
CC: [email protected], [email protected]
Target Milestone: ---
Version: kf6-kimageformats 6.28.0 (Qt 6.11.1, KF 6.28.0), libheif 1.21.2 +
libde265 1.0.18, Fedora 44 KDE
DESCRIPTION
Opening a tiled/grid HEIC (as produced by iPhones) through the kimageformats
HEIF plugin crashes with SIGSEGV. The crash is a call through a null function
pointer: libheif's grid-tile decode path invokes request_range on the
caller-supplied stream reader, but that callback is null. Any Qt/KDE app that
loads the image via this plugin is affected — Gwenview cannot open the file,
and Dolphin's thumbnailer (kioworker/thumbnail.so) crashes repeatedly.
STEPS TO REPRODUCE
1. Take a tiled/grid HEIC (e.g. a standard Samsung Galaxy/iPhone photo — stored
as an image grid).
2. Open it in any Qt/KDE app that uses the plugin — Gwenview, or let Dolphin
generate a thumbnail.
OBSERVED RESULT
SIGSEGV. Gwenview fails to open the file; Dolphin's thumbnail worker crashes.
EXPECTED RESULT
Image opens / thumbnail renders.
SOFTWARE/OS VERSIONS
Operating System: Fedora Linux 44
KDE Plasma Version: 6.7.2
KDE Frameworks Version: 6.28.0
Qt Version: 6.11.1
Kernel Version: 7.1.3-201.fc44.x86_64 (64-bit)
Graphics Platform: Wayland
Processors: 24 × AMD Ryzen 9 9900X 12-Core Processor
Memory: 64 GiB of RAM (62.4 GiB usable)
Graphics Processor: AMD Radeon RX 9070 XT
ADDITIONAL INFORMATION
Evidence the file and decoder are fine (bug is isolated to the plugin's reader
path):
- heif-convert on the same file decodes it successfully (uses libheif's
built-in file reader, not the callback reader).
- digiKam opens the same file successfully (uses its own DImg HEIF loader, not
this Qt plugin).
- The same files open correctly on Windows (independent HEIF implementation).
- Only grid/tiled HEICs crash; single-tile HEICs open normally.
- Only one HEIF plugin is installed
(/usr/lib64/qt6/plugins/imageformats/kimg_heif.so, owned by kf6-kimageformats),
and ldd confirms it links to the packaged /lib64/libheif.so.1 (1.21.2) — no
duplicate plugin, no stray libheif.
Key backtrace:
#5 0x0000000000000000 in ?? ()
#6 StreamReader_CApi::request_range (...) at bitstream.h:168
#7 Box_iloc::read_data (...) at box.cc:1853
#10 DataExtent::read_data (...) at codecs/decoder.cc:73
#11 Decoder::get_compressed_data (...) at codecs/decoder.cc:235
#16 ImageItem_Grid::decode_and_paste_tile_image (...) at grid.cc:503
The crash occurs while decoding a grid tile, when libheif issues a lazy range
request for the tile's data (Box_iloc::read_data → request_range). The reader
supplied by the plugin appears to be registered with a reader_api_version that
implies range-request support, while the request_range function pointer is null
— so libheif calls into address 0x0. This looks like the plugin's heif_reader
setup either declaring a range-capable API version without providing the
callback, or not guarding for the version libheif expects.
--
You are receiving this mail because:
You are watching all bug changes.
