#894589 graphviz: Segmentation fault in feasible_tree() at at ns.c:516 in libgvc.so.6

Package:
graphviz
Source:
graphviz
Description:
rich set of graph drawing tools
Submitter:
Date:
2026-07-15 08:27:02 UTC
Severity:
important
#894589#5
Date:
2018-04-02 00:46:34 UTC
From:
To:
Dear Maintainer,

I run "dot -Tsvg pkg-deepin-dep.today.dot" and got segfault.

Reading symbols from /usr/bin/dot...Reading symbols from /usr/lib/debug/.build-
id/b2/d9312242d7e1e1734fd2e8a3555268ddbea8bf.debug...done.
done.
(gdb) set pagination off
(gdb) r -Tsvg pkg-deepin-dep.today.dot
Starting program: /usr/bin/dot -Tsvg pkg-deepin-dep.today.dot
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
feasible_tree () at ns.c:516
516     ns.c: 没有那个文件或目录.
(gdb) bt full
#0  feasible_tree () at ns.c:516
        tree = 0x555555964110
        i = <optimized out>
        n = <optimized out>
        subtree_count = <optimized out>
#1  rank2 (g=g@entry=0x55555577ea40, balance=balance@entry=2,
maxiter=2147483647, search_size=<optimized out>) at ns.c:821
        iter = 0
        ns = 0x7ffff7bb7b5e "network simplex: "
        f = <optimized out>
#2  0x00007ffff7b88c64 in rank (g=g@entry=0x55555577ea40,
balance=balance@entry=2, maxiter=<optimized out>) at ns.c:870
        s = <optimized out>
        search_size = <optimized out>
#3  0x00007ffff1d15db5 in dot_position (g=g@entry=0x55555577ea40,
asp=asp@entry=0x0) at position.c:132
        __PRETTY_FUNCTION__ = "dot_position"
#4  0x00007ffff1d0e259 in dotLayout (g=g@entry=0x55555577ea40) at dotinit.c:326
        aspect = {targetAR = 3.9525251667299724e-323, combiAR =
9.8813129168249309e-324, prevIterations = -9280, curIterations = 32767,
nextIter = 0, nPasses = -1335793544, badGraph = 0}
        asp = 0x0
        maxphase = -1
#5  0x00007ffff1d0eaa8 in doDot (g=0x55555577ea40) at dotinit.c:463
        ccs = <optimized out>
        sg = <optimized out>
        i = <optimized out>
        ncc = -1335793544
        pinfo = {aspect = 1.70365918e+13, sz = 0, margin = 8, doSplines = 0,
mode = l_node, fixed = 0x0, vals = 0x0, flags = 0}
        Pack = -1
        mode = l_undef
#6  dot_layout (g=0x55555577ea40) at dotinit.c:509
No locals.
#7  0x00007ffff7b5cdcb in gvLayoutJobs (gvc=<optimized out>, g=0x55555577ea40)
at gvlayout.c:85
        gvle = 0x7ffff1f27690 <dotgen_engine>
        p = <optimized out>
        rc = <optimized out>
#8  0x000055555555502f in main (argc=<optimized out>, argv=<optimized out>) at
dot.c:134
        prev = 0x0
        r = <optimized out>
        rc = 0

The input file can be found at
https://salsa.debian.org/pkg-deepin-team/progress-
tracker/tree/02359e87d31274e3d314e91112c21b9260a883c8/depgraph
(by running make -B) and I have attached an example file too.
#894589#10
Date:
2018-04-02 01:05:37 UTC
From:
To:
2018-04-02 8:46 GMT+08:00 Boyuan Yang <073plan@gmail.com>:

Graphviz in Stretch is not affected, btw.
#894589#17
Date:
2026-07-15 08:25:48 UTC
From:
To:
Bisecting with Address Sanitizer and Undefined Behavior Sanitizer
indicates this was fixed upstream in commit
fed9dd288d1e29e0ca0b1c9e2f800e91d5c78f4d
(https://gitlab.com/graphviz/graphviz/-/commit/fed9dd288d1e29e0ca0b1c9e2f800e91d5c78f4d),
so this bug was filed upstream as
https://gitlab.com/graphviz/graphviz/-/issues/1225. The fix landed in
Graphviz 2.42.0.