** Summary changed: - nautilus crashed with SIGSEGV in gtk_label_set_text() from update_no_applications_label() from nautilus_app_chooser_widget_real_add_items() from g_closure_invoke() from signal_emit_unlocked_R() + nautilus crashed with use-after-free in app chooser dialog
** Description changed: + [ Impact ] + + nautilus may crash upon installing/removing/updating/modifying + applications after having opened and closed an "Open With..." dialog. + + This is due to an use-after-free bug in the implementation of the "Open With..." dialog. + In most cases of regular usage the use-after-free does not happen, but a specific combination of actions (see Test Plan), or a custom nautilus extension, can expose the bug. + + This is a regression introduced in version 1:50.2.2-0ubuntu0.1 + + [ Test Plan ] + + 1. Launch `nautilus` in a terminal (to monitor its logs) + 2. Open a second window of nautilus (Ctrl + N) + 3. In each window, right-click a video file and select "Open With..." + 4. In one of the two window only, close the "Open With..." dialog. + 5. Open the Settings app + 6. Navigate to Apps > Default Apps + 7. Change the default video player + 8. Verify that nautilus did not print any CRITICAL warnings on the terminal + 9. Verify that nautilus did not crash + 10. Verify that the "Open With..." dialog now shows the new default video player as pre-selected. + + [ Where problems could occur ] + + Problems could manifest in the "Open With..." dialog of nautilus, the + default file manager in Ubuntu Desktop. + + The patch plugs a leak of the callback signal responsible for updating + the list of applications if it were to change during the lifetime of the + dialog itself. + + Issues would manifest with the dialog no longer updating on app changes. + This is verified to be working correctly in the test plan. + + [ Other info ] + The Ubuntu Error Tracker has been receiving reports about a problem regarding nautilus. This problem was most recently seen with package version 1:50.2.2-0ubuntu0.1, the problem page at https://errors.ubuntu.com/problem/685a38082de3a53d5e4e683d2a76a6006f48a933 contains more details, including versions of packages affected, stacktrace or traceback, and individual crash reports. If you do not have access to the Ubuntu Error Tracker and are a software developer, you can request it at http://forms.canonical.com/reports/. ** Description changed: [ Impact ] nautilus may crash upon installing/removing/updating/modifying applications after having opened and closed an "Open With..." dialog. This is due to an use-after-free bug in the implementation of the "Open With..." dialog. In most cases of regular usage the use-after-free does not happen, but a specific combination of actions (see Test Plan), or a custom nautilus extension, can expose the bug. - This is a regression introduced in version 1:50.2.2-0ubuntu0.1 + Due to the nature of memory corruption bugs, this could manifest with a + number of different stack traces, which have been marked as duplicates + of this bug. + + This was a regression introduced in version 1:50.2.2-0ubuntu0.1 [ Test Plan ] 1. Launch `nautilus` in a terminal (to monitor its logs) 2. Open a second window of nautilus (Ctrl + N) 3. In each window, right-click a video file and select "Open With..." 4. In one of the two window only, close the "Open With..." dialog. 5. Open the Settings app 6. Navigate to Apps > Default Apps 7. Change the default video player 8. Verify that nautilus did not print any CRITICAL warnings on the terminal 9. Verify that nautilus did not crash 10. Verify that the "Open With..." dialog now shows the new default video player as pre-selected. [ Where problems could occur ] Problems could manifest in the "Open With..." dialog of nautilus, the default file manager in Ubuntu Desktop. The patch plugs a leak of the callback signal responsible for updating the list of applications if it were to change during the lifetime of the dialog itself. Issues would manifest with the dialog no longer updating on app changes. This is verified to be working correctly in the test plan. [ Other info ] The Ubuntu Error Tracker has been receiving reports about a problem regarding nautilus. This problem was most recently seen with package version 1:50.2.2-0ubuntu0.1, the problem page at https://errors.ubuntu.com/problem/685a38082de3a53d5e4e683d2a76a6006f48a933 contains more details, including versions of packages affected, stacktrace or traceback, and individual crash reports. If you do not have access to the Ubuntu Error Tracker and are a software developer, you can request it at http://forms.canonical.com/reports/. ** Bug watch added: gitlab.gnome.org/GNOME/nautilus/-/issues #4316 https://gitlab.gnome.org/GNOME/nautilus/-/issues/4316 ** Also affects: nautilus via https://gitlab.gnome.org/GNOME/nautilus/-/issues/4316 Importance: Unknown Status: Unknown ** Also affects: nautilus (Ubuntu Resolute) Importance: Undecided Status: New ** Changed in: nautilus (Ubuntu) Status: New => Fix Committed ** Changed in: nautilus (Ubuntu) Assignee: (unassigned) => Alessandro Astone (aleasto) ** Changed in: nautilus (Ubuntu) Milestone: None => ubuntu-26.10 ** Changed in: nautilus (Ubuntu Resolute) Assignee: (unassigned) => Alessandro Astone (aleasto) ** Changed in: nautilus (Ubuntu Resolute) Milestone: None => resolute-updates ** Changed in: nautilus (Ubuntu Resolute) Status: New => In Progress -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2164705 Title: nautilus crashed with use-after-free in app chooser dialog To manage notifications about this bug go to: https://bugs.launchpad.net/nautilus/+bug/2164705/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
