GNOME Bugzilla – Bug 375295
the 'randomizer' plugin is broken for at least 2.2.7 and above using some LANGs
Last modified: 2008-01-15 13:14:49 UTC
GIMP version at least 2.2.7 (haven't found earlier versions to try) and above (including latest 2.2.13) has a bug that makes it crash when the LANG environment variable is set to some languages that use "long" strings (I think). The Russian language I use (LANG=ru_RU) uses 2 bytes per character in UTF-8; it looks like the randomizer plugin uses somewhere a static buffer for NLS strings which gets overwritten if the strings are too long. To reproduce, run: [zap@zap]LANG=ru_RU gimp After that choose File->New (Файл->Новый), create a default canvas, then choose Filters->Noise->Hurl / Pick (Фильтры->Шум->Бросок / Выбор), then press OK. A message box telling that the plugin has died unexpectedly will pop up. In the console you will see the following message: *** buffer overflow detected ***: /usr/lib/gimp/2.0/plug-ins/randomize terminated ======= Backtrace: ========= /lib/libc.so.6(__chk_fail+0x41)[0x6232b1] /lib/libc.so.6(__vsprintf_chk+0x0)[0x622b48] /lib/libc.so.6(_IO_default_xsputn+0x9c)[0x5a7817] /lib/libc.so.6(_IO_vfprintf+0xfae)[0x581fc7] /lib/libc.so.6(__vsprintf_chk+0xa1)[0x622be9] /lib/libc.so.6(__sprintf_chk+0x30)[0x622b3c] /usr/lib/gimp/2.0/plug-ins/randomize[0x8049a38] This should work with glibc 2.4 and above which have a built-in memory trashing detector. With earlier glibc's the bug could not manifest instantly but neverless trashing memory is not a good thing in any case.
This is already fixed in the HEAD branch for quite a while. I have now also fixed it in 2.2. Thanks for reporting it. 2006-11-14 Sven Neumann <sven@gimp.org> * plug-ins/common/randomize.c: fixed possible buffer overflow (bug #375295).