Gwenview crash on opening HEIC

Help
1

I tried to open the HEIC image and get the following crash. Reproducible 100% of the time. heif-dec correctly handles the image.

(gdb) bt
#0  0x0000000000000000 in ??? ()
#1  0x00007fffbc0ac3f0 in StreamReader_CApi::request_range(unsigned long, unsigned long) () at /lib64/libheif.so.1
#2  0x00007fffbc0ba378 in Box_iloc::read_data(unsigned int, std::shared_ptr<StreamReader> const&, std::shared_ptr<Box_idat> const&, std::vector<unsigned char, std::allocator<unsigned char> >*, unsigned long, unsigned long, heif_security_limits const*) const () at /lib64/libheif.so.1
#3  0x00007fffbc0e7698 in HeifFile::append_data_from_iloc(unsigned int, std::vector<unsigned char, std::allocator<unsigned char> >&, unsigned long, unsigned long) const () at /lib64/libheif.so.1
#4  0x00007fffbc11d065 in DataExtent::read_data() const () at /lib64/libheif.so.1
#5  0x00007fffbc11d559 in Decoder::get_compressed_data() const () at /lib64/libheif.so.1
#6  0x00007fffbc12381b in Decoder::decode_single_frame_from_compressed_data(heif_decoding_options const&, heif_security_limits const*) () at /lib64/libheif.so.1
#7  0x00007fffbc13dcd8 in ImageItem::decode_compressed_image(heif_decoding_options const&, bool, unsigned int, unsigned int) const () at /lib64/libheif.so.1
#8  0x00007fffbc13f149 in ImageItem::decode_image(heif_decoding_options const&, bool, unsigned int, unsigned int) const () at /lib64/libheif.so.1
#9  0x00007fffbc145218 in ImageItem_Grid::decode_and_paste_tile_image(unsigned int, unsigned int, unsigned int, std::shared_ptr<HeifPixelImage>&, heif_decoding_options const&, int&) const ()
    at /lib64/libheif.so.1
#10 0x00007fffbc141c60 in std::_Function_handler<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> (), std::__future_base::_Task_setter<std::unique_ptr<std::__future_base::_Result<Error>, std::__future_base::_Result_base::_Deleter>, std::thread::_Invoker<std::tuple<Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr<HeifPixelImage>&, heif_decoding_options const&, int&) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper<std::shared_ptr<HeifPixelImage> >, heif_decoding_options, std::reference_wrapper<int> > >, Error> >::_M_invoke(std::_Any_data const&) () at /lib64/libheif.so.1
#11 0x00007fffbc139a96 in std::__future_base::_State_baseV2::_M_do_set(std::function<std::unique_ptr<std::__future_base::_Result_base, std::__future_base::_Result_base::_Deleter> ()>*, bool*) ()
    at /lib64/libheif.so.1
#12 0x00007ffff4a84774 in __pthread_once_slow.isra.0 () at /lib64/libc.so.6
#13 0x00007ffff4a847e9 in pthread_once@GLIBC_2.2.5 () at /lib64/libc.so.6
#14 0x00007fffbc14261f in std::__future_base::_Async_state_impl<std::thread::_Invoker<std::tuple<Error (ImageItem_Grid::*)(unsigned int, unsigned int, unsigned int, std::shared_ptr<HeifPixelImage>&, heif_decoding_options const&, int&) const, ImageItem_Grid const*, unsigned int, unsigned int, unsigned int, std::reference_wrapper<std::shared_ptr<HeifPixelImage> >, heif_decoding_options, std::reference_wrapper<int> > >, Error>::_M_run() () at /lib64/libheif.so.1
#15 0x00007ffff4c4e424 in execute_native_thread_routine () at /lib64/libstdc++.so.6
#16 0x00007ffff4a7f3c4 in start_thread () at /lib64/libc.so.6
#17 0x00007ffff4b0256c in __clone3 () at /lib64/libc.so.6

Operating System: Fedora Linux 43
KDE Plasma Version: 6.7.3
KDE Frameworks Version: 6.28.0
Qt Version: 6.10.3
Kernel Version: 7.1.4-100.fc43.x86_64 (64-bit)
Graphics Platform: Wayland

$ rpm -qa | grep heif
libheif-1.20.2-6.fc43.x86_64
libheif-freeworld-1.20.2-2.fc43.x86_64

$ rpm -qa | grep gwenview
gwenview-26.04.3-1.fc43.x86_64
gwenview-libs-26.04.3-1.fc43.x86_64

Image file: files.catbox.moe/2lhyma.zip

2

The bug isn’t in gwenview directly but in libheif it seems.

You can report the crash to this project GitHub - strukturag/libheif: libheif is an HEIF and AVIF file format decoder and encoder. · GitHub with the crash trace the version used/installed of libheif and the failing file.

3

I grab images from HEIC sample file gallery | Download HEIC images

The image take on a samsung phone works https://heic.digital/download-sample/shelf-christmas-decoration.heic

But the image taken on a iPad does not work https://heic.digital/download-sample/chef-with-trumpet.heic

I tested on fedora 44 with gwenview-26.04.3-1

4

Are you sure about that? libheif was my first obvious culprit, but since libhelf-dec works no problem, I assumed that gwenview may use the library incorrectly.

5

yes, this also crashes.

6

I’ve opened the image in Krita, which also uses libheif (validated with gdb by putting the breakpoint at ImageItem::decode_image), and it works fine, no crashes.

7

Quote was more nuanced.

_The bug isn’t in gwenview directly but in libheif it seems.

And with which version of libheif ?

I don’t have a crash with libheif 1.23.1-1, Arch.

8

Fedora 44 is on libheif-1.21.2-1.fc44.x86_64

@ValdikSS I suggest you report as a bug against fedora with the info that a newer version of libheif seems to be the fix.

Fedora bug tracker is Making sure you're not a bot!

Edit: file against component libheif

9

Here’s what LLM says:

In LoadingDocumentImplPrivate::loadMetaInfo() (lib/document/loadingdocumentimpl.cpp), there is a secondary call to reader.read() whose sole purpose is to obtain the image’s ICC color profile for CMS:

if (!mCmsProfile && reader.canRead()) {
    const QImage qtimage = reader.read();   // ← triggers grid HEIC decode
    if (!qtimage.isNull()) {
        mCmsProfile = Cms::Profile::loadFromICC(qtimage.colorSpace().iccProfile());
    }
}

Both reader (QImageReader) and buffer (QBuffer) are stack-local variables in loadMetaInfo(). When reader.read() returns control to Gwenview, the outer decode appears complete — but libheif’s tile std::async workers are still running. When loadMetaInfo() returns, the stack unwinds and destroys QImageReader and QBuffer.

Krita indeed also crashes in color correction code, but only upon closing it. Let’s assume it’s not gwenview which is ‘holding it wrong’, I’ll try to update libheif.

10

As mentioned in top post, it’s libheif-1.20.2-6.fc43.x86_64

11

Just built libheif 1.23.1 — no changes, still crashes the same way.

12

It does not mean gwenview uses it. You’d need to install and make the gwenview dependencies use it.

You can use ldd /usr/bin/gwenview to check.

13

It does, I see the library in the backtrace. I’ve checked with strings that it’s indeed the file I’ve compiled (I’ve compiled the rpm package and installed it). Also updated libde265 — no changes (it it used in decoding and have been mentioned in libheif bug tracker for some recent null-dereference tickets which seems similar to this issue).

It’s a kimageformats issue: HEIF: keep reader callback table alive · KDE/kimageformats@ad0fb9d · GitHub

14

This was reported and fixed in: