librsvg crashes with SIGSEGV when opening broken SVG file

Bug #608026 reported by Bruno Girin on 2010-07-21
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Fix Released
Nominated for Main by Bruno Girin
librsvg (Ubuntu)
Nominated for Maverick by Bruno Girin

Bug Description

Binary package hint: librsvg2-2

Steps to reproduce:
1. Save the attached .tgz file and extract the .svg file that it contains
2. Open Nautilus
3. Navigate to the folder where the .svg file was extracted

Expected behaviour:
Nautilus opens the file.

Actual behaviour:
Nautilus stops responding, the window greys out and Nautilus eventually crashes.

ProblemType: Crash
DistroRelease: Ubuntu 10.04
Package: nautilus 1:2.30.1-0ubuntu1.1
ProcVersionSignature: Ubuntu 2.6.32-23.37-generic
Uname: Linux 2.6.32-23-generic i686
Architecture: i386
Date: Wed Jul 21 02:55:01 2010
ExecutablePath: /usr/bin/nautilus
InstallationMedia: Ubuntu 10.04 "Lucid Lynx" - Beta i386 (20100406.1)
ProcCmdline: nautilus
 PATH=(custom, user)
 Segfault happened at: 0xf0dea1: repz cmpsb %es:(%edi),%ds:(%esi)
 PC (0x00f0dea1) ok
 source "%es:(%edi)" (0x00f31952) ok
 destination "%ds:(%esi)" (0x0000007b) not located in a known VMA region (needed writable region)!
SegvReason: writing NULL VMA
Signal: 11
SourcePackage: nautilus
 ?? () from /usr/lib/
 ?? () from /usr/lib/
 ?? () from /usr/lib/
 ?? () from /usr/lib/
 ?? () from /usr/lib/
Title: nautilus crashed with SIGSEGV
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

Bruno Girin (brunogirin) wrote :

 rsvg_paint_server_parse (inherit=0x8efd674, defs=0x8d655e0,
 rsvg_parse_style_pair (ctx=<value optimized out>,
 rsvg_parse_style (ctx=0x8ee1418, state=0x8efd600,
 rsvg_parse_style_attrs (ctx=0x8ee1418, state=0x8efd600,
 rsvg_node_group_set_atts (self=0x8a89e40, ctx=0x8ee1418,

Changed in nautilus (Ubuntu):
importance: Undecided → Medium
tags: removed: need-i386-retrace

Additional information: the issue also occurs when trying to open other files than the zip file mentioned and it also happens when I wait until Nautilus is ready before double-clicking on a file.

Bruno Girin (brunogirin) wrote :

More additional info: when logging out after the crash, a window appears advising that the file manager is not responding and asking whether I want to log out anywyay. Forcing the logout and logging back in again does not seem to resolve the problem: Nautilus either hangs or crashes when double-cliking on a file in the Downloads directory. Other directories seem to be unaffected by the problem.

Bruno Girin (brunogirin) wrote :

Some more additional info: restarting the computer doesn't seem to solve the problem. Nautilus now hangs whenever I try to do any action in the Downloads directory (open file, delete file, etc.)

description: updated
Bruno Girin (brunogirin) on 2010-07-21
visibility: private → public
Pedro Villavicencio (pedro) wrote :

that's a librsvg crash, could you attach the svgs to the report? thanks.

affects: nautilus (Ubuntu) → librsvg (Ubuntu)
Changed in librsvg (Ubuntu):
status: New → Incomplete
Bruno Girin (brunogirin) wrote :

@Pedro: if I open that folder using Firefox to upload the file, it crashes Firefox in the same way (presumably because the open file dialog uses the same widget). Is there a command line way to attach a file?

Pedro Villavicencio (pedro) wrote :

could you compress those maybe and then attach it? it's crashing at a svg so it's just a matter to compress the folder.

Bruno Girin (brunogirin) wrote :

@Pedro: please find attached an archive containing all the SVG files present in my Downloads folder.

Bruno Girin (brunogirin) on 2010-08-01
summary: - nautilus crashed with SIGSEGV when opening Downloads directory
+ nautilus crashed with SIGSEGV when opening directory that contains
+ attached SVG file
description: updated
description: updated
summary: - nautilus crashed with SIGSEGV when opening directory that contains
- attached SVG file
+ librsvg crashes with SIGSEGV when opening attached SVG file

After some investigation, it appears that this is due to a very broken SVG file. The library should be robust enough to deal with that. I created a test case in Vala that reproduces the problem with minimum amount of code. In order to build and run this test case, do the following (you will need the Vala compiler for this):

tar zxvf test-608026.tgz
valac -g --pkg librsvg-2.0 test-608026.vala

Bruno Girin (brunogirin) wrote :

And after running the test case in gdb, here is the patch to librsvg that resolves the issue. It adds a test for NULL pointer in rsvg_paint_server_parse.

summary: - librsvg crashes with SIGSEGV when opening attached SVG file
+ librsvg crashes with SIGSEGV when opening broken SVG file
tags: added: patch
Bruno Girin (brunogirin) wrote :

@Brian: should I forward the bug and patch upstream?

Sebastien Bacher (seb128) wrote :

> should I forward the bug and patch upstream?

Thank you for your work there, that would be useful yes

Changed in librsvg (Ubuntu):
status: Incomplete → Triaged
Changed in librsvg (Ubuntu):
status: Triaged → Fix Committed
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package librsvg - 2.26.3-2ubuntu1

librsvg (2.26.3-2ubuntu1) maverick; urgency=low

  * debian/patches/no_null_crash.patch:
    - don't crash on corrupted images, thanks Bruno Girin (lp: #608026)
 -- Sebastien Bacher <email address hidden> Tue, 10 Aug 2010 16:59:03 +0200

Changed in librsvg (Ubuntu):
status: Fix Committed → Fix Released
tags: added: patch-accepted
removed: patch
Bruno Girin (brunogirin) wrote :

Forwarded the bug and patch upstream.

Changed in librsvg:
importance: Undecided → Unknown
status: New → Unknown
Changed in librsvg:
status: Unknown → New
Bruno Girin (brunogirin) on 2010-08-12
tags: added: patch-forwarded-upstream
Bruno Girin (brunogirin) wrote :

I would suggest an SRU for Lucid to fix this bug there as well.

Impact of the bug:
Browsing a directory that contains an SVG file with empty style attributes causes the application to crash. This happens with Nautilus or any application that uses the GTK open file dialog (e.g. Firefox). So this can potentially affect a large number of users.

How the bug has been addressed:
The patch is trivial and adds a check for NULL to the line in rsvg_paint_server_parse that checks the validity of input parameters.

Detailed instruction on how to test this bug are in comment #12.

The potential for regression is very low as the only added code is a sanity check of input parameters.

Sebastien Bacher (seb128) wrote :

Thanks for your interest Bruno, would be nice to have upstream reviewing the change before having it applied to the stable serie though

Bruno Girin (brunogirin) wrote :

@Sebastien: I agree with you, it would be nice. I just updated the upstream bug to make it more obvious that there's a patch attached to it so hopefully upstream will pick it up.

Changed in librsvg (Ubuntu Lucid):
importance: Undecided → Low
status: New → Triaged
Bruno Girin (brunogirin) wrote :

I just upgraded to Maverick beta and the bug has come back because Maverick now uses version 2.31 of librsvg so the patch needs to be applied to that new version.

tags: added: maverick
Changed in librsvg:
importance: Unknown → Medium
Sebastien Bacher (seb128) wrote :

bug #701820 could be a similar issue

Rolf Leggewie (r0lf) wrote :

Since apparently this regressed back into maverick it would be nice to know the status of this ticket for oneiric, affected or not?

Changed in librsvg:
status: New → Confirmed
Changed in librsvg:
status: Confirmed → Fix Released
Rolf Leggewie (r0lf) wrote :

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

Changed in librsvg (Ubuntu Lucid):
status: Triaged → Won't Fix
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.