Thanks @septemberhx, the fix covers fcitx5 too, added to Impact. ** Description changed:
[Impact] - * libibus 1.5.33 and later store a *floating* IBusAttrList in the - IBusText that ibus_input_context_convert_text() and - ibus_panel_convert_text() return, whenever the preedit carries at - least one attribute. - * gnome-shell (HINT preedit format since GNOME 49) reads it with - text.get_attributes(). GJS ref_sinks the incoming object, so the - IBusText and the JS wrapper share a single reference. When the - IBusText is destroyed after the signal, the list is freed under a - live wrapper. - * Every such preedit logs, at the next GJS collection: - g_object_unref: assertion 'G_IS_OBJECT (object)' failed - Object 0x... of type IBusAttrList has been finalized while it was - still owned by gjs, this is due to invalid memory management. - and eventually gnome-shell segfaults. On Wayland that ends the whole - user session, with unsaved work lost. - * On GNOME Wayland gnome-shell is the IBus client of every application, - so every IME that styles its preedit is affected: anthy, mozc, rime, - libpinyin, hangul, and dictation engines that send semantic hints. - Commit-only input sends an empty list, which takes a safe path. - * Fix: upstream 5bbe88a1 (sink the list via ibus_text_set_attributes) - and its follow-up 1a331e69 (fixes the leak 5bbe88a1 introduced for - empty lists). Both are in 1.5.35-rc1, which Debian unstable already - carries (1.5.35~rc1-1), so the next development series gets the fix - by sync. + * libibus 1.5.33 and later store a *floating* IBusAttrList in the + IBusText that ibus_input_context_convert_text() and + ibus_panel_convert_text() return, whenever the preedit carries at + least one attribute. + * gnome-shell (HINT preedit format since GNOME 49) reads it with + text.get_attributes(). GJS ref_sinks the incoming object, so the + IBusText and the JS wrapper share a single reference. When the + IBusText is destroyed after the signal, the list is freed under a + live wrapper. + * Every such preedit logs, at the next GJS collection: + g_object_unref: assertion 'G_IS_OBJECT (object)' failed + Object 0x... of type IBusAttrList has been finalized while it was + still owned by gjs, this is due to invalid memory management. + and eventually gnome-shell segfaults. On Wayland that ends the whole + user session, with unsaved work lost. + * On GNOME Wayland gnome-shell is the IBus client of every application, + so every IME that styles its preedit is affected: anthy, mozc, rime, + libpinyin, hangul, and dictation engines that send semantic hints. + Commit-only input sends an empty list, which takes a safe path. Not + limited to IBus engines: on GNOME Wayland fcitx5's IBus frontend + owns org.freedesktop.IBus, so gnome-shell's libibus converts fcitx5's + styled preedits through the same code (comment #3, with a SIGSEGV + backtrace through libibus from libgjs). + * Fix: upstream 5bbe88a1 (sink the list via ibus_text_set_attributes) + and its follow-up 1a331e69 (fixes the leak 5bbe88a1 introduced for + empty lists). Both are in 1.5.35-rc1, which Debian unstable already + carries (1.5.35~rc1-1), so the next development series gets the fix + by sync. [Test Plan] - Reproducer, needs no gnome-shell and never touches the live session: - a private ibus-daemon on its own address, a GJS engine sending - preedits, and a GJS input context set up as gnome-shell sets up its - own (set_client_commit_preedit(true), PreeditFormat.HINT, - text.get_attributes() in the update-preedit-text handler). - Attached: run.sh, repro.js. + Reproducer, needs no gnome-shell and never touches the live session: + a private ibus-daemon on its own address, a GJS engine sending + preedits, and a GJS input context set up as gnome-shell sets up its + own (set_client_commit_preedit(true), PreeditFormat.HINT, + text.get_attributes() in the update-preedit-text handler). + Attached: run.sh, repro.js. - 1. sudo apt install ibus gjs gir1.2-ibus-1.0 - 2. dbus-run-session -- ./run.sh attrs - Sends 20 preedits, each with one HINT attribute. - Before: each of the two criticals above is logged (10 times each - with the current package). - After: no critical. - 3. dbus-run-session -- ./run.sh empty - Same with an empty attribute list. Clean before and after - (control: the safe path is unchanged). - 4. End to end, on a GNOME Wayland session: enable an IME that styles - its preedit (e.g. ibus-anthy, Japanese), type a few words into - gedit or the overview search, wait 20 s, then - journalctl --user -b _COMM=gnome-shell | grep -c IBusAttrList - Before: > 0. After: 0. gnome-shell keeps running. - 5. Regression: type and commit text, with and without preedit, through - ibus-anthy and ibus-hangul in a GTK 3 app, a GTK 4 app and a Qt app - under both Wayland and X11 sessions. Preedit appears, is styled, - updates and commits as before. + 1. sudo apt install ibus gjs gir1.2-ibus-1.0 + 2. dbus-run-session -- ./run.sh attrs + Sends 20 preedits, each with one HINT attribute. + Before: each of the two criticals above is logged (10 times each + with the current package). + After: no critical. + 3. dbus-run-session -- ./run.sh empty + Same with an empty attribute list. Clean before and after + (control: the safe path is unchanged). + 4. End to end, on a GNOME Wayland session: enable an IME that styles + its preedit (e.g. ibus-anthy, Japanese), type a few words into + gedit or the overview search, wait 20 s, then + journalctl --user -b _COMM=gnome-shell | grep -c IBusAttrList + Before: > 0. After: 0. gnome-shell keeps running. + 5. Regression: type and commit text, with and without preedit, through + ibus-anthy and ibus-hangul in a GTK 3 app, a GTK 4 app and a Qt app + under both Wayland and X11 sessions. Preedit appears, is styled, + updates and commits as before. [Where problems could occur] - * The patches change who owns the attribute list of every IBusText that - libibus converts for clients and panels, in - ibus_input_context_convert_text() and ibus_panel_convert_text(). - Every IBus client links this code: gnome-shell, the GTK 3 and GTK 4 - IM modules, the Qt platform input context, the IBus panel and - candidate window. - * One reference too few would reintroduce a use-after-free in any of - those clients: critical warnings in their logs, then crashes while - composing text, the worst case being gnome-shell, which ends the - session. - * One reference too many would leak an IBusAttrList per preedit update. - Memory of long-running clients such as gnome-shell would grow while - the user types with an IME. - * A wrong attribute list would show as missing or wrong preedit - styling (underline, highlight of the selected segment) in - applications, or in the candidate window. - * 1a331e69 exists because 5bbe88a1 alone leaked on empty lists. Both - are applied together here. + * The patches change who owns the attribute list of every IBusText that + libibus converts for clients and panels, in + ibus_input_context_convert_text() and ibus_panel_convert_text(). + Every IBus client links this code: gnome-shell, the GTK 3 and GTK 4 + IM modules, the Qt platform input context, the IBus panel and + candidate window. + * One reference too few would reintroduce a use-after-free in any of + those clients: critical warnings in their logs, then crashes while + composing text, the worst case being gnome-shell, which ends the + session. + * One reference too many would leak an IBusAttrList per preedit update. + Memory of long-running clients such as gnome-shell would grow while + the user types with an IME. + * A wrong attribute list would show as missing or wrong preedit + styling (underline, highlight of the selected segment) in + applications, or in the candidate window. + * 1a331e69 exists because 5bbe88a1 alone leaked on empty lists. Both + are applied together here. [Other Info] - * Upstream: https://github.com/ibus/ibus/issues/2889 (fixed by PR - https://github.com/ibus/ibus/pull/2890, commit 5bbe88a1) and - https://github.com/ibus/ibus/issues/2941 (PR - https://github.com/ibus/ibus/pull/2943, commit 1a331e69). - * Introduced with the semantic preedit API (ae3c987f, 1.5.33). - noble (1.5.29) is not affected. - * Both patches are verbatim upstream and apply cleanly to resolute's - 1.5.34~rc2 and stonking's 1.5.34. - * Versions: resolute 1.5.34~rc2-1ubuntu0.1 (first Ubuntu delta, so - Maintainer is updated); stonking 1.5.34-1ubuntu3.1. - * Seen in the field through Myna dictation's streaming preedit, whose - preedit carries one WHOLE hint: https://github.com/canonical/myna/issues/18 - Reproduced there as a gnome-shell SIGSEGV on stonking, and by an - e2e test in a GNOME stonking VM. + * Upstream: https://github.com/ibus/ibus/issues/2889 (fixed by PR + https://github.com/ibus/ibus/pull/2890, commit 5bbe88a1) and + https://github.com/ibus/ibus/issues/2941 (PR + https://github.com/ibus/ibus/pull/2943, commit 1a331e69). + * Introduced with the semantic preedit API (ae3c987f, 1.5.33). + noble (1.5.29) is not affected. + * Both patches are verbatim upstream and apply cleanly to resolute's + 1.5.34~rc2 and stonking's 1.5.34. + * Versions: resolute 1.5.34~rc2-1ubuntu0.1 (first Ubuntu delta, so + Maintainer is updated); stonking 1.5.34-1ubuntu3.1. + * Seen in the field through Myna dictation's streaming preedit, whose + preedit carries one WHOLE hint: https://github.com/canonical/myna/issues/18 + Reproduced there as a gnome-shell SIGSEGV on stonking, and by an + e2e test in a GNOME stonking VM. -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2170983 Title: [SRU] ibus: IBusAttrList use-after-free crashes gnome-shell on preedit with attributes To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ibus/+bug/2170983/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
