Public bug reported:
If the user's wallpaper cannot be decoded by gdk-pixbuf, gnome-shell segfaults
about one second after GDM authentication, on every login, producing an
un-diagnosable login loop at the physical console (the GDM greeter itself is
unaffected, and ssh logins work, so it looks like an authentication problem to
the user). A failed wallpaper load should never take down the session.
In my case the wallpaper was an iPhone HEIC photo, and the July 9 security
update run removed `libheif-plugin-libde265` + `libde265-0` as "unused
dependencies" (autoremove), leaving `heif-gdk-pixbuf` installed but unable to
decode HEVC. Any image that gdk-pixbuf fails on without setting a GError
should reproduce this.
Steps to reproduce
1. Ubuntu 24.04, GNOME on Wayland, log in normally.
2. Set the desktop background to any .HEIC photo (Settings → Appearance, or an
iPhone photo via the file manager). Wallpaper displays fine at this point.
3. `sudo apt remove libheif-plugin-libde265 libde265-0`
(equivalently: let unattended-upgrades/autoremove drop them)
4. Log out. Log back in at the console.
Expected: session starts; wallpaper falls back to a solid color; a warning
is logged.
Actual: gnome-shell segfaults ~1 s after authentication and the user is
returned to the greeter — indefinitely (login loop). Journal shows:
gnome-shell[3099]: Unsupported feature: Unsupported codec
gnome-shell[3099]: g_task_return_error: assertion 'error != NULL' failed
gnome-shell[3099]: g_task_propagate_pointer: assertion 'task->result_set'
failed
gnome-shell[3099]: GNOME Shell crashed with signal 11
systemd[4589]: [email protected]: Main process exited,
code=dumped, status=11/SEGV
Analysis
Two chained bugs, confirmed from the core dump (fault instruction resolved by
disassembly of libmutter-14.so.0, offset 0xab2c6: `mov 0x8(%rax),%r8` with
rax == NULL — i.e. reading `error->message` on a NULL GError):
Bug 1 — heif-gdk-pixbuf (trigger): when libheif has no HEVC decoder
plugin, the pixbuf loader makes `gdk_pixbuf_new_from_stream()` return NULL
without setting the GError out-parameter (the libheif error text
"Unsupported feature: Unsupported codec" is printed to the journal instead of
being propagated). Returning NULL without setting the error violates the
gdk-pixbuf loader contract.
Bug 2 — mutter (the crash): `src/compositor/meta-background-image.c` is
not robust against that. In `load_file()`:
pixbuf = gdk_pixbuf_new_from_stream (G_INPUT_STREAM (stream), NULL, &error);
...
if (pixbuf == NULL)
{
g_task_return_error (task, error); /* error == NULL -> glib assertion,
task completes with neither
result nor error set */
return;
}
then in `file_loaded()`:
pixbuf = g_task_propagate_pointer (task, &error); /* NULL, error stays
NULL */
if (pixbuf == NULL)
{
char *uri = g_file_get_uri (image->file);
g_warning ("Failed to load background '%s': %s",
uri, error->message); /* SIGSEGV: error is
NULL */
Suggested fix in mutter: `g_task_return_error()` only when `error != NULL`
(else `g_task_return_new_error(...)`), and/or
`error ? error->message : "unknown error"` in `file_loaded()`.
heif-gdk-pixbuf should additionally set the GError on decode failure.
Status across upstream versions (checked 2026-07-14 against upstream
tags):
- mutter <= 48 (46.2, 47.0, 48.0 checked): decodes via gdk-pixbuf; the crash
is fully reachable as described. Among supported Ubuntu releases only
24.04 LTS (46.2) ships these, so the SRU target is noble.
- mutter 49.0, 50.1, and 51~alpha/main (Ubuntu 25.10, 26.04, and the current
devel series): the decoder was switched to Glycin in mutter 49
(`gly_loader_load` / `gly_image_next_frame`), which removes this report's
concrete trigger — third-party gdk-pixbuf loaders such as heif-gdk-pixbuf
are no longer in the code path, and Glycin sets proper GErrors, so a
missing HEIC decoder degrades gracefully there. However, the unsafe
pattern itself is unchanged in all of these versions: `load_file()` passes
the callee-provided error to `g_task_return_error()` unchecked, and
`file_loaded()` still does
g_warning ("Failed to load background '%s': %s", uri,
error->message);
with no NULL guard (src/compositor/meta-background-image.c, same lines in
49.0 through main). Any decoder-side GError-contract violation
reintroduces the same session-killing crash, so the hardening is worth
applying on main as well as in the noble SRU.
Backtrace (apport, from /var/crash/_usr_bin_gnome-shell.1000.crash)
#5 <signal handler called>
#6 0x0000715be92ab2c6 in ??? () at libmutter-14.so.0 <- file_loaded(),
g_warning on error->message, error==NULL
#7 0x0000715be98e17bb in ??? () at libgio-2.0.so.0 <- GTask
completion
#8 0x0000715be98e17f5 in ??? () at libgio-2.0.so.0
#9 ...
#11 g_main_loop_run () at libglib-2.0.so.0
#12 meta_context_run_main_loop () at libmutter-14.so.0
(Full core dump available; the crash was auto-uploaded via whoopsie on
2026-07-14, so an errors.ubuntu.com bucket should exist.)
Versions
- Ubuntu 24.04.4 LTS, GNOME on Wayland, Intel graphics (i915)
- mutter / libmutter-14-0: 46.2-1ubuntu0.24.04.16
- gnome-shell: 46.0-0ubuntu6~24.04.14
- heif-gdk-pixbuf / libheif1: 1.17.6-1ubuntu4.4
- kernel: 6.17.0-35-generic
** Affects: mutter (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Desktop Bugs, which is subscribed to mutter in Ubuntu.
https://bugs.launchpad.net/bugs/2160730
Title:
Unguarded error->message dereference in file_loaded()
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mutter/+bug/2160730/+subscriptions
--
desktop-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/desktop-bugs
