Submitted By: Xi Ruoyao Date: 2026-10-28 Initial Package Version: 1.5.34 Upstream Status: Applied (PR 2890) Origin: https://raw.githubusercontent.com/AOSC-Dev/aosc-os-abbs/c0e48e722757/app-i18n/ibus/01-libibus/patches/0002-libibus-make-an-IBusText-own-an-updated-IBusAttrList.patch (Used this instead of the upstreamed PR because the latter changes meson.build that does not exist in 1.5.34 yet) Description: Fix gnome-shell crash typing via ibus. From b52b51b23e68843ad983f3c211a0703b6cfe323e Mon Sep 17 00:00:00 2001 From: Tianhao Chai Date: Thu, 26 Mar 2026 20:43:47 -0400 Subject: [PATCH] libibus: make an IBusText own an updated IBusAttrList reference For all usages of IBusAttrList, the list is an owned reference within a IBusText struct. ibus_panel_convert_text() and ibus_input_context_convert_text() violate the invarient by assigning a **floating** IBusAttrList reference to an IBusText without sinking it. Through interactions I don't completely understand, GJS can somehow obtain a strong owning reference to the IBusAttrList and can end up freeing a `IBusAttrList` with a valid (albeit floating) reference somewhere else. Using the other reference constitutes a use-after-free. We already have a `ibus_text_set_attributes()` that does the intended ref sinking, so just use that instead of manually assigning pointers. --- src/ibusinputcontext.c | 6 ++---- src/ibuspanelservice.c | 6 ++---- src/ibustext.h | 2 +- 3 files changed, 5 insertions(+), 9 deletions(-) diff --git a/src/ibusinputcontext.c b/src/ibusinputcontext.c index 68d12fb5..235a2f1f 100644 --- a/src/ibusinputcontext.c +++ b/src/ibusinputcontext.c @@ -570,8 +570,7 @@ ibus_input_context_convert_text (IBusInputContext *context, g_error_free (error); } if (new_attrs) { - g_object_unref (text->attrs); - text->attrs = new_attrs; + ibus_text_set_attributes (text, new_attrs); } break; case IBUS_PREEDIT_FORMAT_HINT: @@ -582,8 +581,7 @@ ibus_input_context_convert_text (IBusInputContext *context, g_error_free (error); } if (new_attrs) { - g_object_unref (text->attrs); - text->attrs = new_attrs; + ibus_text_set_attributes (text, new_attrs); } break; default: diff --git a/src/ibuspanelservice.c b/src/ibuspanelservice.c index 16229822..fb0cc64f 100644 --- a/src/ibuspanelservice.c +++ b/src/ibuspanelservice.c @@ -1204,8 +1204,7 @@ ibus_panel_convert_text (IBusPanelService *panel, g_error_free (error); } if (new_attrs) { - g_object_unref (text->attrs); - text->attrs = new_attrs; + ibus_text_set_attributes (text, new_attrs); } break; case IBUS_PREEDIT_FORMAT_HINT: @@ -1216,8 +1215,7 @@ ibus_panel_convert_text (IBusPanelService *panel, g_error_free (error); } if (new_attrs) { - g_object_unref (text->attrs); - text->attrs = new_attrs; + ibus_text_set_attributes (text, new_attrs); } break; default: diff --git a/src/ibustext.h b/src/ibustext.h index e5e3c4a9..e5319b4b 100644 --- a/src/ibustext.h +++ b/src/ibustext.h @@ -209,7 +209,7 @@ IBusAttrList * ibus_text_get_attributes (IBusText *text); /** * ibus_text_set_attributes: * @text: An IBusText. - * @attrs: An IBusAttrList + * @attrs: (transfer full): An IBusAttrList */ void ibus_text_set_attributes (IBusText *text, IBusAttrList *attrs); -- 2.52.0