Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Notification daemon crash when image-path hint contains an icon name #7491

Open
elboulangero opened this issue Apr 21, 2018 · 3 comments
Open

Comments

@elboulangero
Copy link

 * Cinnamon Cinnamon 3.6.7
 * Distribution Linux Mint 18.3 Sylvia
 * 64 bit

Issue

The notification daemon doesn't support icon names.

On the application side, I use GApplication to send notifications. I set an icon using this kind code:

icon = g_themed_icon_new("edit-copy");
g_notification_set_icon(notif, icon);
g_application_send_notification(app, "notif-id", notif);

This code will basically crash my application. The crash is due to a bug in glib, which is triggered because the send_notification() times out. It times out because the Cinnamon notification daemon doesn't reply anymore, and probably crashed as well.

I tracked that as much as I could. On the caller side first (ie. glib), we can see that support for GThemedIcon was discussed in Bug 745634, and added in glib ec1edef3.

Now if you look into this file you can see that the implementation will ultimately save the icon in the image-path hint. Which leads us to the steps to reproduce...

Steps to reproduce

So we can re-create the dbus call that is send by g_application_send_notification(). As for the image, we can either use a full path (that's what you get if the caller used GFileIcon), or simply the filename without the extension (that's what you get if the caller used GThemedIcon).

Setting a full path works:

IMAGE=/usr/share/icons/Adwaita/48x48/actions/edit-copy.png
python -c "import dbus; print dbus.Bus().call_blocking(\
    'org.freedesktop.Notifications', \
    '/org/freedesktop/Notifications', \
    'org.freedesktop.Notifications', \
    'Notify', \
    'susssasa{sv}i', \
    ('appname', 0, '', 'summary', 'body', [], {'image-path': '$IMAGE'}, -1))"

Setting an icon name doesn't, there is no notification displayed:

IMAGE=edit-copy
python -c ... # copy-paste the snippet above

Other information

It's up to you to decide if you want to support Themed Icon or not in your notification daemon, but at least the notification daemon should handle gracefully any junk input that is send by applications in the image-path hint.

I added some logs in the Cinnamon Javascript, and I ended up here in the file js/ui/notificationDaemon.js:

       } else if (hints['image-path']) {
           return textureCache.load_uri_async(GLib.filename_to_uri(hints['image-path'], null), size, size);

This call never returns because GLib.filename_to_uri raises an exception that is not handled. I noticed that there's a few of this call in the file, where exceptions are not handled.

I added a try catch statement, however the notification is still not displayed. I didn't go further.

Hope this helps, feel free to ping me for more details. Cheers,

Arnaud

itzexor added a commit to itzexor/Cinnamon that referenced this issue Apr 27, 2018
gnomesysadmins pushed a commit to GNOME/glib that referenced this issue Jun 13, 2018
The way things were before: a FreedesktopNotification struct is
allocated before the dbus call, and this same struct is possibly re-used
for other dbus calls. If the server becomes unavailable, the callback
will be invoked after the call times out, which leaves a long time where
other dbus calls can happen, re-using the same FreedesktopNotification
as user data. When the first call times out, the callback is invoked,
and the user data is freed. Subsequent calls that used the same user
data will time out later on, and try to free a pointer that was already
freed, hence segfaults.

This bug can be reproduced in Cinnamon 3.6.7, as mentioned in:
<linuxmint/cinnamon#7491>

This commit fixes that by always allocating a new
FreedesktopNotification before invoking dbus_call(), ensuring that the
callback always have a valid user data.

Signed-off-by: Arnaud Rebillout <elboulangero@gmail.com>
gnomesysadmins pushed a commit to GNOME/glib that referenced this issue Jun 13, 2018
The way things were before: a FreedesktopNotification struct is
allocated before the dbus call, and this same struct is possibly re-used
for other dbus calls. If the server becomes unavailable, the callback
will be invoked after the call times out, which leaves a long time where
other dbus calls can happen, re-using the same FreedesktopNotification
as user data. When the first call times out, the callback is invoked,
and the user data is freed. Subsequent calls that used the same user
data will time out later on, and try to free a pointer that was already
freed, hence segfaults.

This bug can be reproduced in Cinnamon 3.6.7, as mentioned in:
<linuxmint/cinnamon#7491>

This commit fixes that by always allocating a new
FreedesktopNotification before invoking dbus_call(), ensuring that the
callback always have a valid user data.

Signed-off-by: Arnaud Rebillout <elboulangero@gmail.com>
@icarter09
Copy link
Member

@elboulangero are you still experiencing this issue?

@elboulangero
Copy link
Author

@icarter09 Sorry I found that out only while doing some testing in a Cinnamon VM, after user reported a crash with Goodvibes on Cinnamon. I don't run Cinnamon myself so I can't say.

This being said I thing you can try the "Steps to reproduce" above to see if it's still an issue

cheers

@leigh123linux
Copy link
Contributor

@icarter09 Yes it's still an issue here, fedora uses @itzexor WIP to fix it

itzexor@d56f1cc

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants