Segfault in OverlayMessage::updateGeometry while resizing selection (use-after-free / dangling QWidget)

[djvillarreal]

Summary

Flameshot segfaults while dragging a selection handle to resize the capture
region. The crash happens inside OverlayMessage::setVisibility(false) →
QWidget::updateGeometry(), where the widget pointer being operated on is
garbage (this=0x9f009e5b2b485244 in QWidget::testAttribute), indicating a
dangling/corrupted OverlayMessage widget rather than a bad user input.

Steps to reproduce

1. Launch flameshot (flameshot gui / the tray "Take Screenshot" action).
2. Start a selection and drag a resize handle to resize the selection box.
3. Flameshot crashes (SIGSEGV) shortly after the drag begins.

This happened on the very first launch after a fresh install, while the
"press Esc to cancel" / size-indicator overlay hint was presumably still
visible and got hidden as a result of the resize.

Expected behavior

Resizing the selection should not crash the application.

Environment

• Flameshot: v14.0.0, compiled with Qt 6.11.1
• Qt runtime: 6.11.2-2 (Arch package qt6-base)
• OS: Omarchy (Arch Linux base), kernel 7.1.8-arch1-3, x86_64
• Session: Wayland (Hyprland)
• Install method: pacman -S flameshot (official Arch extra package, flameshot 14.0.0-1)

Backtrace (crashing thread, symbolized via debuginfod)

#0  QWidget::testAttribute (this=0x9f009e5b2b485244, attribute=Qt::WA_WState_Hidden) at qtbase/src/widgets/kernel/qwidget.h:918
#1  QWidget::isHidden (this=0x9f009e5b2b485244) at qtbase/src/widgets/kernel/qwidget.h:883
#2  QWidgetPrivate::updateGeometry_helper (this=0x557a55d85920, forceUpdate=false) at qtbase/src/widgets/kernel/qwidget.cpp:10578
#3  QWidget::updateGeometry (this=0x557a55d19980) at qtbase/src/widgets/kernel/qwidget.cpp:10602
#4  OverlayMessage::updateGeometry (this=0x557a55d19980) at src/widgets/capture/overlaymessage.cpp:125
#5  OverlayMessage::setVisibility (visible=false) at src/widgets/capture/overlaymessage.cpp:66
#6  QtPrivate::QSlotObjectBase::call (...) at qtbase/src/corelib/kernel/qobjectdefs_impl.h:462
#7  doActivate<false> (sender=0x557a55a02c20, signal_index=8, argv=0x7ffcd3694e30) at qtbase/src/corelib/kernel/qobject.cpp:4393
#8  QWidget::event (this=0x557a55a02c20, event=0x7ffcd3695060) at qtbase/src/widgets/kernel/qwidget.cpp:9194
#9  QApplicationPrivate::notify_helper (...) at qtbase/src/widgets/kernel/qapplication.cpp:3273
#10 QCoreApplication::notifyInternal2 (receiver=0x557a55a02c20, event=0x7ffcd3695060) at qtbase/src/corelib/kernel/qcoreapplication.cpp:1126
#11 QCoreApplication::sendEvent (...) at qtbase/src/corelib/kernel/qcoreapplication.cpp:1571
#12 QWidgetPrivate::setGeometry_sys (this=0x557a55c69430, x=456, y=247, w=25, h=25, isMove=true) at qtbase/src/widgets/kernel/qwidget.cpp:7389
#13 QWidget::setGeometry (this=0x557a55a02c20, r=...) at qtbase/src/widgets/kernel/qwidget.cpp:7281
#14 SelectionWidget::setGeometry (this=0x557a55a02c20, r=...) at src/widgets/capture/selectionwidget.cpp:134
#15 SelectionWidget::parentMouseMoveEvent (this=0x557a55a02c20, e=0x7ffcd36956d0) at src/widgets/capture/selectionwidget.cpp:212
#16 SelectionWidget::eventFilter (this=0x557a55a02c20, obj=..., event=0x7ffcd36956d0) at src/widgets/capture/selectionwidget.cpp:166
#17 QCoreApplicationPrivate::sendThroughObjectEventFilters (...) at qtbase/src/corelib/kernel/qcoreapplication.cpp:1263
...
#23 QApplicationPrivate::sendMouseEvent (...) at qtbase/src/widgets/kernel/qapplication.cpp:2352
#24 QWidgetWindow::handleMouseEvent (...) at qtbase/src/widgets/kernel/qwidgetwindow.cpp:688

The call chain is: mouse-move during a resize drag → SelectionWidget::setGeometry
→ synchronously sent Move event → a signal handler that hides the overlay
message (OverlayMessage::setVisibility(false)) → updateGeometry() on that
overlay widget. At that point the OverlayMessage's this (or its internal
q_ptr) is no longer a valid pointer, consistent with the widget having
already been destroyed or its memory corrupted before this call runs.

Additional notes

• si_code was SI_KERNEL (plain invalid memory access, not a stack-guard
  fault), and the process was otherwise healthy: no OOM, no other crashes
  around it, plenty of free memory.
• Happy to attach the full coredumpctl info output or the raw (unsymbolized)
  multi-thread backtrace if useful — the crashing thread's frames above are
  the relevant ones; other threads were idle in event loops / thread pools.

---

Filed by Claude (Sonnet 5) via Claude Code.

[mmahmoudian]

Did you experience this yourself or is it a bug that was identified by Claude through inspecting code?

[djvillarreal]

I experience the crash and Claude prepared the ticket to issued it in GH. I've not seen it happened again.

…

On Mon, Aug 24, 2026, 12:39 AM Mehrad Mahmoudian ***@***.***> wrote: *mmahmoudian* left a comment (flameshot-org/flameshot#4906) <#4906 (comment)> Did you experience this yourself or is it a bug that was identified by Claude through inspecting code? — Reply to this email directly, view it on GitHub <#4906?email_source=notifications&email_token=BT2OYWJE3AU6AAB72AXDB2D5LPIITA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGEYTOMBWHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KYZTPN52GK4S7MNWGSY3L#issuecomment-5391170694>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BT2OYWIHANTUINUDZ5CVRS35LPIITAVCNFSNUABEKJSXA33TNF2G64TZHM4TAOJQGIYTGMR3JFZXG5LFHM2TEMRZGQ4DSOBZGWQXMAQ> . Triage notifications, keep track of coding agent tasks and review pull requests on the go with GitHub Mobile for iOS <https://github.com/notifications/mobile/ios/BT2OYWI24TLJCSWACTCKU335LPIITA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGEYTOMBWHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2KUZTPN52GK4S7NFXXG> and Android <https://github.com/notifications/mobile/android/BT2OYWIUMCOKLZOKC66GVWD5LPIITA5CNFSNUABFM5UWIORPF5TWS5BNNB2WEL2JONZXKZKDN5WW2ZLOOQXTKMZZGEYTOMBWHE2KM4TFMFZW63VGMF2XI2DPOKSWK5TFNZ2K4ZTPN52GK4S7MFXGI4TPNFSA>. Download it today! You are receiving this because you authored the thread.Message ID: ***@***.***>