#1039491 fontconfig: Segfault in libfontconfig.so caused by custom fonts.conf

Package:
fontconfig
Source:
fontconfig
Description:
generic font configuration library - support binaries
Submitter:
R Guo
Date:
2023-06-26 16:33:04 UTC
Severity:
normal
#1039491#5
Date:
2023-06-26 16:28:30 UTC
From:
To:
I suffered the issue when I upgraded to Debian 12.
It's unfortunate that I can't remember the version of the last known good fontconfig.
Because I do not stick to the stable release of Debian as a home desktop user.
It could be the Debian 11 version or some random version snapped from the rolling release.
I had an old fonts.conf that I shaped years ago without any issue until this recent system upgrade.

So far I can find two applications suffered from this issue -- gnome-font-viewer and libreoffice.
Both of them are not useable and crash upon start up.
Here is a callstack I captured from gnome-font-viewer in a GDB session.
0x00007ffff6fa8c79 in ?? () from /lib/x86_64-linux-gnu/libfontconfig.so.1
(gdb) bt
#0  0x00007ffff6fa8c79 in  () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#1  0x00007ffff6f9c27c in  () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#2  0x00007ffff6f8f429 in FcConfigSubstituteWithPat () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#3  0x00007ffff6fa1131 in FcFontRenderPrepare () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#4  0x00007ffff6fa180a in FcFontSetMatch () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#5  0x00007ffff6869f93 in  () at /lib/x86_64-linux-gnu/libpangoft2-1.0.so.0
#6  0x00007ffff7ee7cfd in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#7  0x00007ffff6d3ffd4 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#8  0x00007ffff6dc05bc in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

And a callstack from libreoffice:
Thread 1 "soffice.bin" received signal SIGSEGV, Segmentation fault.
0x00007ffff19c4c79 in ?? () from /lib/x86_64-linux-gnu/libfontconfig.so.1
(gdb) bt
#0  0x00007ffff19c4c79 in  () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#1  0x00007ffff19b827c in  () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#2  0x00007ffff19ab429 in FcConfigSubstituteWithPat () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#3  0x00007ffff19bd131 in FcFontRenderPrepare () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#4  0x00007ffff19bd80a in FcFontSetMatch () at /lib/x86_64-linux-gnu/libfontconfig.so.1
#5  0x00007ffff6ac073c in psp::PrintFontManager::getFontOptions(FontAttributes const&, int) () at /usr/lib/libreoffice/program/libmergedlo.so
#6  0x00007ffff6ac10e4 in FreetypeFont::GetFontOptions() const () at /usr/lib/libreoffice/program/libmergedlo.so
#7  0x00007ffff6ac17a9 in CairoTextRender::DrawTextLayout(GenericSalLayout const&, SalGraphics const&) () at /usr/lib/libreoffice/program/libmergedlo.so
#8  0x00007ffff67865c7 in  () at /usr/lib/libreoffice/program/libmergedlo.so
#9  0x00007ffff67b1b35 in OutputDevice::DrawText(Point const&, rtl::OUString const&, int, int, std::vector<tools::Rectangle, std::allocator<tools::Rectangle> >*, rtl::OUString*, SalLayoutGlyphs const*) () at /usr/lib/libreoffice/program/libmergedlo.so
#10 0x00007ffff5c30e44 in  () at /usr/lib/libreoffice/program/libmergedlo.so
#11 0x00007ffff5c31ec7 in FontNameBox::CachePreview(unsigned long, Point*) () at /usr/lib/libreoffice/program/libmergedlo.so
#12 0x00007ffff5c320c7 in  () at /usr/lib/libreoffice/program/libmergedlo.so
#13 0x00007ffff694f843 in Scheduler::CallbackTaskScheduling() () at /usr/lib/libreoffice/program/libmergedlo.so

This issue appears to be related to my customization in fonts.conf.
Switching to a different user account or disable my customization can temporally workaround this issue.
I attempted to hunt for any offending piece inside my fonts.conf but couldn't find anything conclusion.
During this clue hunting session I even run into a situation that the entire gnome session crashes, repeatedly.
I mean, new gnome session crashes also. Here is a dmesg snippet I grabbed from the gnome session crash:

[46809.303875] evolution-alarm[68584]: segfault at 555600000064 ip 00007f6899e84c79 sp 00007ffe8e3d7660 error 4 in libfontconfig.so.1.12.0[7f6899e64000+29000]
[46809.303882] Code: 00 48 8b 0c 24 83 c0 20 48 89 d7 8d 14 dd 00 00 00 00 c1 eb 03 0f b6 c0 31 d3 31 c3 48 85 c9 75 50 48 8d 57 01 48 89 54 24 08 <0f> b6 07 89 c1 83 e1 c0 80 f9 c0 74 5a 8d 48 bf 80 f9 19 76 c2 84
[46809.324430] remmina[68636]: segfault at 7f7600000064 ip 00007f768b041c79 sp 00007f7675128350 error 4 in libfontconfig.so.1.12.0[7f768b021000+29000]
[46809.324438] Code: 00 48 8b 0c 24 83 c0 20 48 89 d7 8d 14 dd 00 00 00 00 c1 eb 03 0f b6 c0 31 d3 31 c3 48 85 c9 75 50 48 8d 57 01 48 89 54 24 08 <0f> b6 07 89 c1 83 e1 c0 80 f9 c0 74 5a 8d 48 bf 80 f9 19 76 c2 84
[46809.648499] blueman-tray[68672]: segfault at 7fe500000064 ip 00007fe5ec258c79 sp 00007fe5dbffead0 error 4 in libfontconfig.so.1.12.0[7fe5ec238000+29000]
[46809.648505] Code: 00 48 8b 0c 24 83 c0 20 48 89 d7 8d 14 dd 00 00 00 00 c1 eb 03 0f b6 c0 31 d3 31 c3 48 85 c9 75 50 48 8d 57 01 48 89 54 24 08 <0f> b6 07 89 c1 83 e1 c0 80 f9 c0 74 5a 8d 48 bf 80 f9 19 76 c2 84
[46809.978944] gnome-shell[68684]: segfault at 7fe500000064 ip 00007fe5a5664c79 sp 00007fe561535450 error 4 in libfontconfig.so.1.12.0[7fe5a5644000+29000]
[46809.978950] Code: 00 48 8b 0c 24 83 c0 20 48 89 d7 8d 14 dd 00 00 00 00 c1 eb 03 0f b6 c0 31 d3 31 c3 48 85 c9 75 50 48 8d 57 01 48 89 54 24 08 <0f> b6 07 89 c1 83 e1 c0 80 f9 c0 74 5a 8d 48 bf 80 f9 19 76 c2 84
[46811.639881] gnome-shell[68837]: segfault at 7f1d00000064 ip 00007f1e3d7a1c79 sp 00007f1df566f450 error 4 in libfontconfig.so.1.12.0[7f1e3d781000+29000]
[46811.639887] Code: 00 48 8b 0c 24 83 c0 20 48 89 d7 8d 14 dd 00 00 00 00 c1 eb 03 0f b6 c0 31 d3 31 c3 48 85 c9 75 50 48 8d 57 01 48 89 54 24 08 <0f> b6 07 89 c1 83 e1 c0 80 f9 c0 74 5a 8d 48 bf 80 f9 19 76 c2 84
[46811.749263] gnome-session-f[68849]: segfault at 7f2300000064 ip 00007f23e89f3c79 sp 00007f23e4fd47d0 error 4 in libfontconfig.so.1.12.0[7f23e89d3000+29000]
[46811.749268] Code: 00 48 8b 0c 24 83 c0 20 48 89 d7 8d 14 dd 00 00 00 00 c1 eb 03 0f b6 c0 31 d3 31 c3 48 85 c9 75 50 48 8d 57 01 48 89 54 24 08 <0f> b6 07 89 c1 83 e1 c0 80 f9 c0 74 5a 8d 48 bf 80 f9 19 76 c2 84

Maybe I have something bad (or deprecated in new version) in my customized config, but I really hope it can fail more gracefully...

Thanks,
R. G.