Bug#1144206: libgdk-pixbuf-2.0-0: Segmentation fault in gdk_pixbuf_get_n_channels

Package: libgdk-pixbuf-2.0-0
Version: 2.44.7+dfsg-1
Severity: serious
Tags: security
Affects: viking
X-Debbugs-Cc: Debian Security Team <[email protected]>

In Viking, when moving the map with the mouse, I got a
segmentation fault in gdk_pixbuf_get_n_channels.

Since images come from the network, this is potentially a
security issue (depending on the currently unknown cause
of the segmentation fault).

$ gdb /usr/bin/viking core.384824
GNU gdb (Debian 17.2-1+b1) 17.2
Copyright (C) 2025 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/bin/viking...
Reading symbols from /usr/lib/debug/.build-id/be/4156d4e9ba8690465a6c544fac61ffa47f3fb2.debug...

⚠ warning: Can't open file /memfd:glycin-frame (deleted) during file-backed mapping note processing

⚠ warning: Can't open file /home/vinc17/.local/share/gvfs-metadata/root-325986fa.log (deleted) during file-backed mapping note processing

⚠ warning: Can't open file /home/vinc17/.local/share/gvfs-metadata/root (deleted) during file-backed mapping note processing
[New LWP 384824]
[New LWP 385197]
[New LWP 384825]
[New LWP 384827]
[New LWP 384829]
[New LWP 384828]
[New LWP 385186]
[New LWP 384826]
[New LWP 384830]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/bin/viking 20100523.gpx 20110808.gpx 20170813.gpx 20190622.gpx 20190623a.gpx 20190623b.gpx 20190624.gpx 20190626.gpx 20190816.gpx 20201223.gpx 20201227.gpx 20210103.gpx 20210327.gpx 20210328.gpx 20210329.gpx 20210330.gpx 20210331.gpx 20210401.gpx 20210402.gpx 20210403.gpx 20210404.gpx 20210405.gpx 20210406.gpx 20210409.gpx 20210417.gpx 20210424.gpx 20210425.gpx 20210502.gpx 20210511.gpx 20210513.gpx 20211221a.gpx 20211221b.gpx 20211222.gpx 20211230.gpx 20220101a.gpx 20220101b.gpx 20220429.gpx 20220430a.gpx 20220430b.gpx 20220501.gpx 20220503.gpx 20220811a.gpx 20220811b.gpx 20220812.gpx 20221223a.gpx 20221223b.gpx 20221224.gpx 20230805.gpx 20230807a.gpx 20230807b.gpx 20230809a.gpx 20230809b.gpx 20231222a.gpx 20231222b.gpx 20231223.gpx 20231224a.gpx 20231224b.gpx 20231225.gpx 20231228.gpx 20231229.gpx 20240101a.gpx 20240101b.gpx 20240102.gpx 20240103.gpx 20240428.gpx 20240429.gpx 20240608a.gpx 20240608b.gpx 20240614a.gpx 20240614b.gpx 20240615.gpx 20240616.gpx 20240814.gpx 20240816.gpx 20240817.gpx 20240818a.gpx 20240818b.gpx 20241025a.gpx 20241025b.gpx 20241025c.gpx 20241026a.gpx 20241026b.gpx 20241027a.gpx 20241027b.gpx 20241027c.gpx 20241101.gpx 20241102.gpx 20241103.gpx 20241221a.gpx 20241221b.gpx 20241228.gpx 20250101.gpx 20250102a.gpx 20250102b.gpx 20250103.gpx 20250426a.gpx 20250426b.gpx 20250428.gpx 20250429.gpx 20250430.gpx 20250501.gpx 20250819.gpx 20251226a.gpx 20251226b.gpx 20251227.gpx 20251228a.gpx 20251228b.gpx 20251229.gpx 20260809a.gpx 20260809b.gpx 20260809c.gpx 20260810.gpx 20260811.gpx 20260812.gpx'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f6fe52d0375 in gdk_pixbuf_get_n_channels (
    pixbuf=pixbuf@entry=0x55683841303d) at ../gdk-pixbuf/gdk-pixbuf.c:774

⚠ warning: 774  ../gdk-pixbuf/gdk-pixbuf.c: No such file or directory
[Current thread is 1 (Thread 0x7f6fdcbef040 (LWP 384824))]

I've attached the full backtrace.

-- System Information:
Debian Release: forky/sid
  APT prefers unstable-debug
  APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable-debug'), (500, 'proposed-updates-debug'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 7.1.6+deb14-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libgdk-pixbuf-2.0-0 depends on:
ii  glycin-thumbnailers      2.1.5+ds-2
ii  libc6                    2.42-17
ii  libgdk-pixbuf2.0-common  2.44.7+dfsg-1
ii  libglib2.0-0t64          2.88.3-2
ii  libglycin-2-0            2.1.5+ds-2
ii  shared-mime-info         2.4-5+b3

libgdk-pixbuf-2.0-0 recommends no packages.

libgdk-pixbuf-2.0-0 suggests no packages.

-- no debconf information

-- 
Vincent Lefèvre <[email protected]> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / Pascaline project (LIP, ENS-Lyon)