Bug 2342257 - Software using fontconfig crashes in FT_Stream_ReadULong
Summary: Software using fontconfig crashes in FT_Stream_ReadULong
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Fedora
Classification: Fedora
Component: fontconfig
Version: 41
Hardware: Unspecified
OS: Linux
unspecified
urgent
Target Milestone: ---
Assignee: Akira TAGOH
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-01-27 14:22 UTC by Nicolas Fella
Modified: 2025-01-30 03:15 UTC (History)
7 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2025-01-29 01:51:40 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Nicolas Fella 2025-01-27 14:22:36 UTC
Several programs using fontconfig are crashing.

This can be reproduced with fc-cache

'gdb --args /usr/bin/fc-cache-64 -f' yields

#0  FT_Stream_ReadULong (stream=0x555555617450, error=0x7fffffffc7f0) at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/base/ftstream.c:659
#1  0x00007ffff7cc6f13 in sfnt_open_font (stream=0x555555617450, face=<optimized out>, face_instance_index=<synthetic pointer>, woff2_num_faces=<synthetic pointer>)
    at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/sfnt/sfobjs.c:384
#2  sfnt_init_face (stream=<optimized out>, face=<optimized out>, face_instance_index=0, num_params=<optimized out>, params=<optimized out>)
    at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/sfnt/sfobjs.c:562
#3  0x00007ffff7c9c7d1 in tt_face_init (stream=0x555555617450, ttface=0x5555555f0680, face_index=0, num_params=0, params=0x0)
    at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/truetype/ttobjs.c:693
#4  0x00007ffff7c7c32d in open_face (driver=driver@entry=0x55555562c960, astream=astream@entry=0x7fffffffcb50, 
    anexternal_stream=anexternal_stream@entry=0x7fffffffcb47 "", face_index=face_index@entry=0, num_params=0, params=0x0, aface=0x7fffffffcb48)
    at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/base/ftobjs.c:1556
#5  0x00007ffff7c81a41 in ft_open_face_internal (library=0x5555555991b0, args=args@entry=0x7fffffffcd40, face_index=face_index@entry=0, 
    aface=aface@entry=0x7fffffffce20, test_mac_fonts=test_mac_fonts@entry=1 '\001') at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/base/ftobjs.c:2648
#6  0x00007ffff7c825b2 in FT_New_Face (library=<optimized out>, pathname=pathname@entry=0x5555555f0490 "/usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf", 
    face_index=face_index@entry=0, aface=aface@entry=0x7fffffffce20) at /usr/src/debug/freetype-2.13.3-1.fc41.x86_64/src/base/ftobjs.c:1622
#7  0x00007ffff7f4817e in IA__FcFreeTypeQueryAll (file=file@entry=0x5555555f0490 "/usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf", id=id@entry=4294967295, 
    blanks=blanks@entry=0x0, count=count@entry=0x0, set=set@entry=0x555555560a60) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fcfreetype.c:2343
#8  0x00007ffff7f48771 in FcFileScanFontConfig (set=0x555555560a60, file=0x5555555f0490 "/usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf", 
    config=0x555555560570) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fcdir.c:81
#9  FcFileScanConfig (set=set@entry=0x555555560a60, dirs=dirs@entry=0x555555572a10, file=0x5555555f0490 "/usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf", 
    config=config@entry=0x555555560570) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fcdir.c:159
#10 0x00007ffff7f48d0c in FcDirScanConfig (set=set@entry=0x555555560a60, dirs=dirs@entry=0x555555572a10, dir=dir@entry=0x5555555e5a00 "/usr/share/fonts/google-noto", 
    force=force@entry=1, config=config@entry=0x555555560570) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fcdir.c:274
#11 0x00007ffff7f48f76 in FcDirCacheScan (dir=0x5555555e5a00 "/usr/share/fonts/google-noto", config=0x555555560570)
    at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fcdir.c:354
#12 0x00007ffff7f3fc12 in IA__FcDirCacheRead (dir=<optimized out>, force=<optimized out>, config=0x555555560570)
    at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fcdir.c:464
#13 FcConfigAddDirList (config=config@entry=0x555555560570, set=set@entry=FcSetSystem, dirSet=0x555555560680)
    at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fccfg.c:509
#14 0x00007ffff7f3c9c7 in IA__FcConfigBuildFonts (config=config@entry=0x555555560570) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fccfg.c:543
#15 0x00007ffff7f410c0 in IA__FcConfigSetCurrent (config=config@entry=0x555555560570) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/src/fccfg.c:564
#16 0x00005555555557a8 in main (argc=<optimized out>, argv=0x7fffffffd3a8) at /usr/src/debug/fontconfig-2.15.0-8.fc41.x86_64/fc-cache/fc-cache.c:386

This is particularly nasty since it also affects kwin_wayland/SDDM, so booting into a graphical session is broken.

It can be worked around by removing some font files

sudo mv /usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf . 
sudo mv /usr/share/fonts/dejavu-sans-fonts/DejaVuSans.ttf . 







Reproducible: Always

Comment 1 Akira TAGOH 2025-01-28 03:56:38 UTC
It works for me.

$ podman pull quay.io/fedora/fedora:41
Trying to pull quay.io/fedora/fedora:41...
Getting image source signatures
Copying blob a52c777f25d4 done   |
Copying config a432b057a5 done   |
Writing manifest to image destination
a432b057a522737c229d2aac9b029f55bf2a44eb3f423e4e4ece2acb8a304652
$ podman run -ti --rm quay.io/fedora/fedora:41
[root@ced2e871c287 /]# dnf install fontconfig dejavu-sans-fonts google-noto-sans-fonts
Updating and loading repositories:
 Fedora 41 openh264 (From Cisco) - x86_64                                    100% |   2.4 KiB/s |   6.0 KiB |  00m02s
 Fedora 41 - x86_64 - Updates                                                100% |   4.5 MiB/s |   9.2 MiB |  00m02s
 Fedora 41 - x86_64                                                          100% |  13.3 MiB/s |  35.4 MiB |  00m03s
Repositories loaded.   
Package                                Arch       Version                                Repository              Size
Installing:
 dejavu-sans-fonts                     noarch     2.37-24.fc41                           fedora               5.5 MiB
 fontconfig                            x86_64     2.15.0-8.fc41                          fedora             791.9 KiB
 google-noto-sans-fonts                noarch     20240701-2.fc41                        fedora              42.5 MiB
Installing dependencies:
 abattis-cantarell-vf-fonts            noarch     0.301-13.fc41                          fedora             192.7 KiB
 default-fonts-core-sans               noarch     4.1-2.fc41                             fedora              11.9 KiB
 fonts-filesystem                      noarch     1:2.0.5-17.fc41                        fedora               0.0   B
 freetype                              x86_64     2.13.3-1.fc41                          fedora             850.5 KiB
 google-noto-fonts-common              noarch     20240701-2.fc41                        fedora              17.5 KiB
 google-noto-sans-vf-fonts             noarch     20240701-2.fc41                        fedora               1.2 MiB
 graphite2                             x86_64     1.3.14-16.fc41                         fedora             192.0 KiB
 harfbuzz                              x86_64     9.0.0-3.fc41                           fedora               2.6 MiB
 libpng                                x86_64     2:1.6.40-4.fc41                        fedora             245.8 KiB
 xml-common                            noarch     0.6.3-65.fc41                          fedora              78.4 KiB

...

[root@ced2e871c287 /]# /usr/bin/fc-cache-64 -f
[root@ced2e871c287 /]# /usr/bin/fc-cache-64 -fv
Font directories:
        /usr/share/X11/fonts/Type1
        /usr/share/X11/fonts/TTF
        /root/.local/share/fonts
        /usr/local/share/fonts
        /usr/share/fonts
        /root/.fonts
        /usr/share/fonts/abattis-cantarell-vf-fonts
        /usr/share/fonts/dejavu-sans-fonts
        /usr/share/fonts/google-noto
        /usr/share/fonts/google-noto-vf
/usr/share/X11/fonts/Type1: skipping, no such directory
/usr/share/X11/fonts/TTF: skipping, no such directory
/root/.local/share/fonts: skipping, no such directory
/usr/local/share/fonts: skipping, no such directory
/usr/share/fonts: caching, new cache contents: 0 fonts, 4 dirs
/usr/share/fonts/abattis-cantarell-vf-fonts: caching, new cache contents: 6 fonts, 0 dirs
/usr/share/fonts/dejavu-sans-fonts: caching, new cache contents: 9 fonts, 0 dirs
/usr/share/fonts/google-noto: caching, new cache contents: 72 fonts, 0 dirs
/usr/share/fonts/google-noto-vf: caching, new cache contents: 10 fonts, 0 dirs
/root/.fonts: skipping, no such directory
/usr/share/fonts/abattis-cantarell-vf-fonts: skipping, looped directory detected
/usr/share/fonts/dejavu-sans-fonts: skipping, looped directory detected
/usr/share/fonts/google-noto: skipping, looped directory detected
/usr/share/fonts/google-noto-vf: skipping, looped directory detected
/usr/lib/fontconfig/cache: cleaning cache directory
/root/.cache/fontconfig: not cleaning non-existent cache directory
/root/.fontconfig: not cleaning non-existent cache directory
/usr/bin/fc-cache-64: succeeded




Apparently fonts or something is broken on your box.

[root@ced2e871c287 /]# sha256sum /usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf /usr/share/fonts/dejavu-sans-fonts/DejaVuSans.ttf 
62eb7024a800385d955bd2e7d87dba5e76523d4ba61924f05fa6d0423ac3e9ca  /usr/share/fonts/google-noto/NotoSans-MediumItalic.ttf
8c8847ff58f7a635b23739c12861447ed7503c0dfedc577643c2b095ccda3056  /usr/share/fonts/dejavu-sans-fonts/DejaVuSans.ttf

Is it the same for you?
`rpm -Vv google-noto-sans-fonts` and `rpm -Vv dejavu-sans-fonts` may also helps to verify files in packages.

Comment 2 Nicolas Fella 2025-01-28 18:11:42 UTC
Indeed, somehow those two files got corrupted

rpm -Vv dejavu-sans-fonts
.........  c /etc/fonts/conf.d/20-unhint-small-dejavu-sans.conf
.........  c /etc/fonts/conf.d/57-dejavu-sans-fonts.conf
.........    /usr/share/doc/dejavu-sans-fonts
.........  d /usr/share/doc/dejavu-sans-fonts/AUTHORS
.........  d /usr/share/doc/dejavu-sans-fonts/BUGS
.........  d /usr/share/doc/dejavu-sans-fonts/NEWS
.........  d /usr/share/doc/dejavu-sans-fonts/README.md
.........    /usr/share/fontconfig/conf.avail/20-unhint-small-dejavu-sans.conf
.........    /usr/share/fontconfig/conf.avail/57-dejavu-sans-fonts.conf
.........    /usr/share/fonts/dejavu-sans-fonts
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSans-Bold.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSans-BoldOblique.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSans-ExtraLight.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSans-Oblique.ttf
..?......    /usr/share/fonts/dejavu-sans-fonts/DejaVuSans.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSansCondensed-Bold.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSansCondensed-BoldOblique.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSansCondensed-Oblique.ttf
.........    /usr/share/fonts/dejavu-sans-fonts/DejaVuSansCondensed.ttf
.........    /usr/share/licenses/dejavu-sans-fonts
.........  l /usr/share/licenses/dejavu-sans-fonts/LICENSE
.........    /usr/share/metainfo/org.fedoraproject.dejavu-sans-fonts.metainfo.xml

Most attempts to read them fail some way, e.g. 

~ file DejaVuSans.ttf
DejaVuSans.ttf: ERROR: cannot read `DejaVuSans.ttf' (Input/output error)


After reinstalling the two packages fc-cache runs without errors

Comment 3 Akira TAGOH 2025-01-29 01:51:40 UTC
Alright. that's good then. I'll close this as NOTABUG.

Comment 4 Nicolas Fella 2025-01-29 11:46:52 UTC
Well, ideally a corrupted font file wouldn't crash fontconfig and by extension the whole system

Comment 5 Akira TAGOH 2025-01-30 03:15:09 UTC
Taking care of things can't basically happens makes no sense. In this case, there are no guarantees that other files isn't corrupted which might be important to get things done, because we don't know when/where/who/what/why/how they were corrupted.

Plus, this isn't something fontconfig can take care of, because this crash happens in freetype.


Note You need to log in before you can comment on or make changes to this bug.