right click crash

[yisishoujo]

this appears after upgrading to fedora 38
feh-3.9.1-2.fc38.x86_64
i also tried compile feh3.10, same issue

cmd says:

➜ Pictures feh Hotpot.png 
*** buffer overflow detected ***: terminated
[1]    89384 IOT instruction (core dumped)  feh Hotpot.png

bug report gives me this link:
https://retrace.fedoraproject.org/faf/reports/654678/

a part of the info generated by fedora problem reporting

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `feh Hotpot.png'.
Program terminated with signal SIGABRT, Aborted.
#0 __pthread_kill_implementation (threadid=, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
Downloading source file /usr/src/debug/glibc-2.37-1.fc38.x86_64/nptl/pthread_kill.c...
44 return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;

Thread 1 (Thread 0x7f714ed294c0 (LWP 92529)):
#0 __pthread_kill_implementation (threadid=, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
tid =
ret = 0
pd =
old_mask = {__val = {8430738504383725568}}
ret =
#1 0x00007f714fc85c03 in __pthread_kill_internal (signo=6, threadid=) at pthread_kill.c:78
No locals.
#2 0x00007f714fc34aee in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
ret =
#3 0x00007f714fc1d87f in __GI_abort () at abort.c:79
save_stage = 1
act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, sa_mask = {__val = {10592466326024880128, 10736581514134290432, 10880696702243700736, 11024811890353111040, 11168927078462521344, 11313042266571931648, 11457157454681341952, 11601272642790752256, 140124646246460, 11889503019009572864, 12033618207118983168, 2, 140733487803168, 8, 0, 94092701197240}}, sa_flags = 1340064560, sa_restorer = 0xb5000000b4000000}
#4 0x00007f714fc1e60f in __libc_message (fmt=fmt@entry=0x7f714fd992e6 "*** %s ***: terminated\n") at ../sysdeps/posix/libc_fatal.c:150
ap = {{gp_offset = 16, fp_offset = 0, overflow_arg_area = 0x7fff118c6b70, reg_save_area = 0x7fff118c6b00}}
fd = 2
list =
nlist =
cp =
#5 0x00007f714fd19b29 in __GI___fortify_fail (msg=msg@entry=0x7f714fd9928c "buffer overflow detected") at fortify_fail.c:24
No locals.
#6 0x00007f714fd18364 in __GI___chk_fail () at chk_fail.c:28
No locals.
#7 0x00007f714fdf5134 in memset (__len=4, __ch=0, __dest=0x5593aa07e3f0) at /usr/include/bits/string_fortified.h:59
No locals.
#8 __imlib_Polygon_FillToData (blend=, dst_alpha=, op=, clh=7, clw=4, cly=11, clx=78, dstw=, dst=, color=4278190080, poly=0x5593aa07e300) at /usr/src/debug/imlib2-1.7.4-4.fc38.x86_64/src/lib/polygon.c:1153
j =
sfunc = 0x7f714fe0f550 <__imlib_CopyShapedSpanToRGB>
k = 1
a_a = 0
nactive_horz_edges = 0
x1 =
p = 0x5593aa07f9d0
s1 = 0x5593aa07e3a2 "\006\252\223U"
ysort = 0x5593aa07e3b0
edge = 0x5593aa07e330
ps =
nactive_edges = 2
clby = 17
clrx = 81
y = 11
nx0 = 82
nvertices = 3
ty = 11
by = 17
x0 =
nx1 = 77
s0 = 0x5593aa07e382 "\006\252\223U"
sfunc =
ysort =
edge =
k =
a_a =
nactive_edges =
nactive_horz_edges =
nvertices =
clrx =
clby =
ty =
by =
y =
x0 =
x1 =
nx0 =
nx1 =
p =
s0 =
s1 =
ps =
j =
i =
m =
m =
v0 =
v1 =
w =
ne =
dx =
dy =
m =
m =
v0 =
v1 =
w =
ne =
dx =
dy =
lx =
rx =
le_lx =
le_rx =
re_lx =
re_rx =
le =
re =
x =
ey =
eyy =
x =
ey =
eyy =
m =
#9 __imlib_Polygon_FillToImage (anti_alias=, blend=, op=, clh=, clw=, cly=, clx=, im=, color=4278190080, poly=0x5593aa07e300) at /usr/src/debug/imlib2-1.7.4-4.fc38.x86_64/src/lib/polygon.c:1845
No locals.
#10 imlib_image_fill_polygon (poly=poly@entry=0x5593aa07e300) at /usr/src/debug/imlib2-1.7.4-4.fc38.x86_64/src/lib/api.c:5344
im =
#11 0x00005593a8433597 in feh_menu_draw_submenu_at (oy=0, ox=0, dst=0x5593aa07e1e0, y=, x=) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/menu.c:840
poly = 0x5593aa07e300
poly =
#12 feh_menu_draw_item (oy=, ox=, im=, i=0x5593aa0691c0) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/menu.c:709
No locals.
#13 feh_menu_draw_to_buf (oy=, ox=0, im=0x5593aa07e1e0, m=0x5593aa068ce0) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/menu.c:795
i = 0x5593aa0691c0
w =
h =
i =
w =
h =
#14 feh_menu_redraw (m=m@entry=0x5593aa068ce0) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/menu.c:761
y = 0
w = 96
im = 0x5593aa07e1e0
x = 0
h = 160
u = 0x5593aa069140
uu =
#15 0x00005593a8433873 in feh_menu_redraw (m=0x5593aa068ce0) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/menu.c:741
u =
uu =
x =
y =
w =
h =
im =
#16 feh_menu_show_at (m=0x5593aa068ce0, x=1015, y=554) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/menu.c:406
No locals.
#17 0x00005593a8440c68 in winwidget_show_menu (winwid=0x5593aa047480) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/winwidget.c:1238
x = 1015
y = 554
b = 117
c = 1024
r = 0
#18 0x00005593a84346f3 in feh_main_iteration (block=block@entry=1) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/main.c:155
ev = {type = 4, xany = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473}, xkey = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, root = 1025, subwindow = 0, time = 48762468, x = 183, y = 117, x_root = 1015, y_root = 554, state = 0, keycode = 3, same_screen = 1}, xbutton = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, root = 1025, subwindow = 0, time = 48762468, x = 183, y = 117, x_root = 1015, y_root = 554, state = 0, button = 3, same_screen = 1}, xmotion = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, root = 1025, subwindow = 0, time = 48762468, x = 183, y = 117, x_root = 1015, y_root = 554, state = 0, is_hint = 3 '\003', same_screen = 1}, xcrossing = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, root = 1025, subwindow = 0, time = 48762468, x = 183, y = 117, x_root = 1015, y_root = 554, mode = 0, detail = 3, same_screen = 1, focus = -6608966, state = 4288489146}, xfocus = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, mode = 1025, detail = 0}, xexpose = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, x = 1025, y = 0, width = 0, height = 0, count = 48762468}, xgraphicsexpose = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, drawable = 75497473, x = 1025, y = 0, width = 0, height = 0, count = 48762468, major_code = 0, minor_code = 183}, xnoexpose = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, drawable = 75497473, major_code = 1025, minor_code = 0}, xvisibility = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, state = 1025}, xcreatewindow = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, parent = 75497473, window = 1025, x = 0, y = 0, width = 48762468, height = 0, border_width = 183, override_redirect = 117}, xdestroywindow = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025}, xunmap = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025, from_configure = 0}, xmap = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025, override_redirect = 0}, xmaprequest = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, parent = 75497473, window = 1025}, xreparent = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025, parent = 0, x = 48762468, y = 0, override_redirect = 183}, xconfigure = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025, x = 0, y = 0, width = 48762468, height = 0, border_width = 183, above = 2379411882999, override_redirect = 0}, xgravity = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025, x = 0, y = 0}, xresizerequest = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, width = 1025, height = 0}, xconfigurerequest = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, parent = 75497473, window = 1025, x = 0, y = 0, width = 48762468, height = 0, border_width = 183, above = 2379411882999, detail = 0, value_mask = 18418358780879175681}, xcirculate = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, event = 75497473, window = 1025, place = 0}, xcirculaterequest = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, parent = 75497473, window = 1025, place = 0}, xproperty = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, atom = 1025, time = 0, state = 48762468}, xselectionclear = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, selection = 1025, time = 0}, xselectionrequest = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, owner = 75497473, requestor = 1025, selection = 0, target = 48762468, property = 502511173815, time = 2379411882999}, xselection = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, requestor = 75497473, selection = 1025, target = 0, property = 48762468, time = 502511173815}, xcolormap = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, colormap = 1025, new = 0, state = 0}, xclient = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, message_type = 1025, format = 0, data = {b = "d\016\350\002\000\000\000\000\267\000\000\000u\000\000\000\367\003\000", s = {3684, 744, 0, 0, 183, 0, 117, 0, 1015, 0}, l = {48762468, 502511173815, 2379411882999, 12884901888, -28385292830375935}}}, xmapping = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, request = 1025, first_keycode = 0, count = 0}, xerror = {type = 4, display = 0x35, resourceid = 18418358763699306496, serial = 94092700963264, error_code = 1 '\001', request_code = 0 '\000', minor_code = 128 '\200'}, xkeymap = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, window = 75497473, key_vector = "\001\004", '\000' <repeats 14 times>, "d\016\350\002\000\000\000\000\267\000\000\000u\000\000"}, xgeneric = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, extension = 75497473, evtype = 0}, xcookie = {type = 4, serial = 53, send_event = 0, display = 0x5593aa0451c0, extension = 75497473, evtype = 0, cookie = 1025, data = 0x0}, pad = {-25285778141609980, 53, -28385310010245120, 94092700963264, 75497473, 1025, 0, 48762468, 502511173815, 2379411882999, 12884901888, -28385292830375935, -28387496155076934, -30360037195504457, -35151760409681745, -37124301450830685, -32614066098594392, -28667871620750157, -27257198201657159, -27256094394996040, -26698629114615621, -32319401275087680, -64206196264237137, -67291408715945782}}
tval = {tv_sec = 1682685476, tv_usec = 193053}
fdset = {fds_bits = {8, 0 <repeats 15 times>}}
count = 0
t1 = 1682685476.193053
t2 = 0.048116922378540039
ft =
first = 0
xfd = 3
fdsize = 4
pt = 1682685476.193053
__d =
__d =
__d =
#19 0x00005593a842496a in main (argc=, argv=) at /usr/src/debug/feh-3.9.1-2.fc38.x86_64/src/main.c:105
No locals.

[yisishoujo]

seems same as
#676