Conversation
u9g
force-pushed
the
geyes-empty-theme-path-crash
branch
from
September 5, 2026 14:56
e98ca78 to
1fd592a
Compare
g_settings_get_string() returns "" for the unset key, not NULL, so the
existing NULL check never fired and load_theme() was handed an empty
directory. g_build_filename("", "config") yields the relative path
"config", resolved against the applet's working directory, which under
D-Bus activation is the user's home directory.
Treat an empty string like NULL and use Default-tiny.
If the theme's "config" path names a directory (for example a stray ~/config when the theme path resolves to the working directory), fopen() succeeds but every read fails with EISDIR. A read error never sets the EOF flag, so the feof()-controlled parser loop ran on an uninitialised line buffer: strtok() returned NULL and strncmp() dereferenced it, crashing the applet at panel start-up, or the loop spun forever at 100% CPU depending on stack contents. - Require "config" to be a regular file before opening it, so a bogus theme path falls through to the Default-tiny fallback. - Drive the parser loop with fgets() instead of feof() and skip lines where strtok() returns NULL. - Read wall-thickness and num-eyes with a second strtok() call. The old code advanced past the NUL that the first strtok() wrote in place of '=' and only worked by reading beyond the terminator. - Guard the pixmap branches against a missing quoted value. Verified that all seven shipped themes parse to the same values as before, and that the crash no longer reproduces when the working directory contains a directory named "config".
u9g
force-pushed
the
geyes-empty-theme-path-crash
branch
from
September 5, 2026 14:58
1fd592a to
1a13215
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Eyes applet crashes (or hangs at 100% CPU) at panel start-up when its
theme-pathkey is unset and the process's working directory contains an entry namedconfig. Seen on Ubuntu 22.04 with mate-applets 1.26.0; the affected code is unchanged on master.Cause
Two things combine:
properties_load()checks the theme path forNULL, butg_settings_get_string()returns""for the unset key.g_build_filename("", "config")then yields the relative pathconfig, resolved against the working directory. Under D-Bus activation that is the user's home directory.fopen()happily opens a directory. Reads then fail withEISDIR, which never sets the EOF flag, so thefeof()-driven loop inparse_theme_file()runs on an uninitialised buffer.strtok()returnsNULLandstrncmp()dereferences it.Backtrace from the crash report (frame 1-3 are in the applet):
Fix
theme-pathlikeNULLand fall back to Default-tiny.configto be a regular file before opening it.fgets(), skip lines wherestrtok()returnsNULL, and read values with a secondstrtok()call instead of walking past the NUL that the first call wrote over=.Testing
wall-thickness,num-eyesand pixmap values as before the change.configin the working directory and an emptytheme-path, the old build hangs or segfaults; the patched build loads Default-tiny and draws the eyes on the panel.