Package: tango-icon-theme
Version: 0.8.90-2
Severity: important

Hi,

after upgrading my Debian testing box today, xterm crashed with a
segmentation fault. Copying in /usr/share/icons/Human/cursors/
  sb_up_arrow to sb_down_arrow, and
  sb_right_arrow to sb_left_arrow
solved the problem.

As you may have noticed, a lot of different packages seem to be involded
and I'm not at all sure I'm directing this bug report at the right
place. Please feel free to reassign this bug if you see fit.

Running xterm with gdb shows that the function XcursorScanTheme is
running in circles. The stack backtrace looks like follows:

  ...
  #16 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4b10 "Tango:gnome", 
      name=0x2afd30e57ade "sb_down_arrow") at ../../src/library.c:265
  #17 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4af0 
"Tangerine:Tango:gnome", 
      name=0x2afd30e57ade "sb_down_arrow") at ../../src/library.c:265
  #18 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4ae1 "Human", 
name=0x2afd30e57ade "sb_down_arrow")
      at ../../src/library.c:265
  #19 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4ab0 "Tango:gnome", 
      name=0x2afd30e57ade "sb_down_arrow") at ../../src/library.c:265
  #20 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4a90 
"Tangerine:Tango:gnome", 
      name=0x2afd30e57ade "sb_down_arrow") at ../../src/library.c:265
  #21 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4a81 "Human", 
name=0x2afd30e57ade "sb_down_arrow")
      at ../../src/library.c:265
  #22 0x00002afd30e569d8 in XcursorScanTheme (theme=0x6a4a50 "Tango:gnome", 
      name=0x2afd30e57ade "sb_down_arrow") at ../../src/library.c:265
  ...

This happens a couple thousand times until the stack limit is hit and a
segmentation fault is triggered.

The argument theme is obtained by XcursorScanTheme using the function
_XcursorThemeInherits. I haven't looked at it further, but my guess is
that it's evaluating the inheritance of themes and returns the
``parent'' theme. Thus root of the problem seems to be this circular
reference:

  o...@alyja:~ $ grep Inherits /usr/share/icons/{Human,Tango}/index.theme
  /usr/share/icons/Human/index.theme:Inherits=Tangerine,Tango,gnome
  /usr/share/icons/Tango/index.theme:Inherits=gnome,crystalsvg,Human

By copying the files (as noted above) this recursion is ended and xterm
starts normally again.

I think other programs using libXcursor may be effected, too. pidgin
crashed on me and after removing `Human' from Tango's `Inherits' list it
started up again and worked just fine. I didn't to any further debugging
though.

I direct this bugreport against tango-icon-theme and not
human-cursors-theme or libxcursor1 because of the three only
tango-icon-theme was updated recently. As I said: Feel free to reassign.
The previous version of the package was 0.8.90-1. With that old version,
I didn't experience any problems.

I see several possible solutions:

  - Remove the circular inheritance.
  - Provide `sb_down_arrow' and `sb_left_arrow', for example in
    human-cursors-theme. This is probably a dead-end since other
    non-existent files will cause the problem again.
  - Limit the recursion depth in libXcursor/XcursorScanTheme to
    something reasonable, like 20 or 100 or so.

Regards,
-octo
-- 
Florian octo Forster
Hacker in training
GnuPG: 0x91523C3D
http://verplant.org/

Attachment: signature.asc
Description: Digital signature

Reply via email to