Public bug reported:
[Impact]
* libibus 1.5.33 and later store a *floating* IBusAttrList in the
IBusText that ibus_input_context_convert_text() and
ibus_panel_convert_text() return, whenever the preedit carries at
least one attribute.
* gnome-shell (HINT preedit format since GNOME 49) reads it with
text.get_attributes(). GJS ref_sinks the incoming object, so the
IBusText and the JS wrapper share a single reference. When the
IBusText is destroyed after the signal, the list is freed under a
live wrapper.
* Every such preedit logs, at the next GJS collection:
g_object_unref: assertion 'G_IS_OBJECT (object)' failed
Object 0x... of type IBusAttrList has been finalized while it was
still owned by gjs, this is due to invalid memory management.
and eventually gnome-shell segfaults. On Wayland that ends the whole
user session, with unsaved work lost.
* On GNOME Wayland gnome-shell is the IBus client of every application,
so every IME that styles its preedit is affected: anthy, mozc, rime,
libpinyin, hangul, and dictation engines that send semantic hints.
Commit-only input sends an empty list, which takes a safe path.
* Fix: upstream 5bbe88a1 (sink the list via ibus_text_set_attributes)
and its follow-up 1a331e69 (fixes the leak 5bbe88a1 introduced for
empty lists). Both are in 1.5.35-rc1, which Debian unstable already
carries (1.5.35~rc1-1), so the next development series gets the fix
by sync.
[Test Plan]
Reproducer, needs no gnome-shell and never touches the live session:
a private ibus-daemon on its own address, a GJS engine sending
preedits, and a GJS input context set up as gnome-shell sets up its
own (set_client_commit_preedit(true), PreeditFormat.HINT,
text.get_attributes() in the update-preedit-text handler).
Attached: run.sh, repro.js.
1. sudo apt install ibus gjs gir1.2-ibus-1.0
2. dbus-run-session -- ./run.sh attrs
Sends 20 preedits, each with one HINT attribute.
Before: each of the two criticals above is logged (10 times each
with the current package).
After: no critical.
3. dbus-run-session -- ./run.sh empty
Same with an empty attribute list. Clean before and after
(control: the safe path is unchanged).
4. End to end, on a GNOME Wayland session: enable an IME that styles
its preedit (e.g. ibus-anthy, Japanese), type a few words into
gedit or the overview search, wait 20 s, then
journalctl --user -b _COMM=gnome-shell | grep -c IBusAttrList
Before: > 0. After: 0. gnome-shell keeps running.
5. Regression: type and commit text, with and without preedit, through
ibus-anthy and ibus-hangul in a GTK 3 app, a GTK 4 app and a Qt app
under both Wayland and X11 sessions. Preedit appears, is styled,
updates and commits as before.
[Where problems could occur]
* The patches change who owns the attribute list of every IBusText that
libibus converts for clients and panels, in
ibus_input_context_convert_text() and ibus_panel_convert_text().
Every IBus client links this code: gnome-shell, the GTK 3 and GTK 4
IM modules, the Qt platform input context, the IBus panel and
candidate window.
* One reference too few would reintroduce a use-after-free in any of
those clients: critical warnings in their logs, then crashes while
composing text, the worst case being gnome-shell, which ends the
session.
* One reference too many would leak an IBusAttrList per preedit update.
Memory of long-running clients such as gnome-shell would grow while
the user types with an IME.
* A wrong attribute list would show as missing or wrong preedit
styling (underline, highlight of the selected segment) in
applications, or in the candidate window.
* 1a331e69 exists because 5bbe88a1 alone leaked on empty lists. Both
are applied together here.
[Other Info]
* Upstream: https://github.com/ibus/ibus/issues/2889 (fixed by PR
https://github.com/ibus/ibus/pull/2890, commit 5bbe88a1) and
https://github.com/ibus/ibus/issues/2941 (PR
https://github.com/ibus/ibus/pull/2943, commit 1a331e69).
* Introduced with the semantic preedit API (ae3c987f, 1.5.33).
noble (1.5.29) is not affected.
* Both patches are verbatim upstream and apply cleanly to resolute's
1.5.34~rc2 and stonking's 1.5.34.
* Versions: resolute 1.5.34~rc2-1ubuntu0.1 (first Ubuntu delta, so
Maintainer is updated); stonking 1.5.34-1ubuntu3.1.
* Seen in the field through Myna dictation's streaming preedit, whose
preedit carries one WHOLE hint: https://github.com/canonical/myna/issues/18
Reproduced there as a gnome-shell SIGSEGV on stonking, and by an
e2e test in a GNOME stonking VM.
** Affects: ibus (Ubuntu)
Importance: High
Status: In Progress
** Affects: ibus (Ubuntu Resolute)
Importance: Undecided
Status: New
** Affects: ibus (Ubuntu Stonking)
Importance: Undecided
Status: New
** Tags: fixed-upstream resolute stonking
** Also affects: ibus (Ubuntu Resolute)
Importance: Undecided
Status: New
** Also affects: ibus (Ubuntu Stonking)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2170983
Title:
[SRU] ibus: IBusAttrList use-after-free crashes gnome-shell on preedit
with attributes
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ibus/+bug/2170983/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
