Public bug reported:

Every time I scan a real document with my Lexmark X2600 series scanner (USB) 
using
Document Scanner (simple-scan), the application crashes. journalctl shows:

  simple-scan.desktop[PID]: *** buffer overflow detected ***: terminated

This is a glibc _FORTIFY_SOURCE abort (SIGABRT), not a hang or a simple
lockup.

Steps to reproduce:
1. Connect the Lexmark X2600 scanner via USB and load a real document
   (flatbed or feeder).
2. Open Document Scanner, select the Lexmark X2600 device.
3. Click "Scan".
4. The app is killed after a few seconds to ~1-2 minutes into the scan.

I captured a full core dump (via gdb on the apport crash file) and got this
backtrace:

  __fortify_fail("buffer overflow detected")
  __chk_fail()
  clean_and_copy_data ()          -- libsane-lexmark_x2600.so.1
  sane_lexmark_x2600_read ()      -- libsane-lexmark_x2600.so.1
  (glib worker thread) -> start_thread -> clone3

So the overflow happens inside clean_and_copy_data(), called from
sane_lexmark_x2600_read(), in the SANE "lexmark_x2600" backend
(package libsane1, source package sane-backends). This looks like a
fixed-size internal buffer that doesn't account for the actual row/frame
size being copied — scanimage -v -p reports "scanning image 1654 pixels
wide and variable height at 24 bits/pixel", so the "variable height" frame
may be the trigger.

Scanning with xsane using the same backend does not crash for a preview,
only simple-scan reliably triggers the crash on a real scan, across at
least 4 separate attempts.

Environment:
- Ubuntu 26.10 "resolute" (development release)
- simple-scan 48.1-0ubuntu3
- libsane1 1.4.0-1ubuntu1 (source: sane-backends)
- Scanner: Lexmark X2600 series, USB (lexmark_x2600:libusb:001:004)

ProblemType: Bug
DistroRelease: Ubuntu 26.04
Package: simple-scan 48.1-0ubuntu3
ProcVersionSignature: Ubuntu 7.0.0-31.31-generic 7.0.14
Uname: Linux 7.0.0-31-generic x86_64
ApportVersion: 2.34.1-0ubuntu0.1
Architecture: amd64
CasperMD5CheckResult: pass
CurrentDesktop: ubuntu:GNOME
Date: Wed Sep 23 11:30:20 2026
InstallationDate: Installed on 2026-08-12 (42 days ago)
InstallationMedia: Ubuntu 26.04 "Resolute Raccoon" - Release amd64 (20260423.1)
MachineType: Micro-Star International Co., Ltd. MS-7E02
ProcEnviron:
 LANG=en_US.UTF-8
 PATH=(custom, no user)
 SHELL=/bin/bash
 TERM=xterm-256color
 XDG_RUNTIME_DIR=<set>
ProcKernelCmdLine: BOOT_IMAGE=/boot/vmlinuz-7.0.0-31-generic 
root=UUID=c0c5ab57-7da8-441a-bfa2-e996ce11c3f9 ro quiet splash 
crashkernel=2G-4G:320M,4G-32G:512M,32G-64G:1024M,64G-128G:2048M,128G-:4096M
SourcePackage: simple-scan
UpgradeStatus: No upgrade log present (probably fresh install)
dmi.bios.date: 01/10/2024
dmi.bios.release: 5.27
dmi.bios.vendor: American Megatrends International, LLC.
dmi.bios.version: A.60
dmi.board.asset.tag: Default string
dmi.board.name: PRO B760M-P (MS-7E02)
dmi.board.vendor: Micro-Star International Co., Ltd.
dmi.board.version: 2.0
dmi.chassis.asset.tag: Default string
dmi.chassis.type: 3
dmi.chassis.vendor: Micro-Star International Co., Ltd.
dmi.chassis.version: 2.0
dmi.modalias: 
dmi:bvnAmericanMegatrendsInternational,LLC.:bvrA.60:bd01/10/2024:br5.27:svnMicro-StarInternationalCo.,Ltd.:pnMS-7E02:pvr2.0:rvnMicro-StarInternationalCo.,Ltd.:rnPROB760M-P(MS-7E02):rvr2.0:cvnMicro-StarInternationalCo.,Ltd.:ct3:cvr2.0:skuDefaultstring:pfaDefaultstring:
dmi.product.family: Default string
dmi.product.name: MS-7E02
dmi.product.sku: Default string
dmi.product.version: 2.0
dmi.sys.vendor: Micro-Star International Co., Ltd.

** Affects: simple-scan (Ubuntu)
     Importance: Undecided
         Status: New


** Tags: amd64 apport-bug resolute wayland-session

-- 
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168270

Title:
  simple-scan crashes with "buffer overflow detected" when scanning with
  Lexmark X2600 (lexmark_x2600 SANE backend)

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/simple-scan/+bug/2168270/+subscriptions


-- 
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs

Reply via email to