Public bug reported:
Affects: fontconfig (Ubuntu 26.04 LTS)
Package Version: libfontconfig1 2.17.1-3ubuntu1
Architecture: amd64
Severity: High (Causes unhandled crash in kscreenlocker_greet resulting in
emergency lock / local DoS)
=== SUMMARY ===
Fontconfig crashes with a General Protection Fault (Signal 11 SIGSEGV) inside
libfontconfig.so.1.16.1 when performing font fallback character matching via
FcCharSetHasChar().
When Qt/QML attempts to resolve fallback fonts for glyph U+25CF (Black
Circle '●', standard password masking bullet), Fontconfig iterates
through indexed system fonts. If an indexed font contains compressed
tables or unexpected table boundaries (specifically KaTeX_AMS-
Regular.woff), FcCharSetHasChar() reads an invalid memory offset,
setting register %rax to 0xfefefefefefefefe and attempting an invalid
read at 0x10(%rax).
=== ENVIRONMENT ===
- OS: Ubuntu 26.04 (Kubuntu)
- Kernel: 7.0.0-34-generic x86_64
- libfontconfig1: 2.17.1-3ubuntu1
- libqt6gui6: 6.10.2+dfsg-7
- Offending font file: /usr/share/fonts/truetype/katex/KaTeX_AMS-Regular.woff
(provided by fonts-katex 0.16.10+~cs6.1.0-5ubuntu1)
=== REPRODUCTION STEPS ===
1. Install fonts-katex (which places .woff files into
/usr/share/fonts/truetype/katex/).
2. Rebuild font cache: `fc-cache -f`
3. Execute font matching for Unicode character U+25CF:
$ fc-match ":charset=25cf"
(Outputs: KaTeX_AMS-Regular.woff: "Noto Sans" "<unknown style>")
4. Trigger fallback query in an application (e.g. kscreenlocker_greet --testing
or any Qt Quick TextInput in password mode).
=== EXPECTED BEHAVIOR ===
Fontconfig should validate font table bounds, gracefully reject or skip
incompatible/compressed WOFF tables, and continue traversal to valid native
TrueType/OpenType fonts (such as DejaVuSans.ttf).
=== ACTUAL BEHAVIOR ===
Process terminates immediately with SIGSEGV (GPF, error:0 in kernel logs). When
this occurs inside kscreenlocker_greet, KWin marks the greeter as unstable
after retry exhaustion and places the screen locker into unrecoverable
emergency mode.
=== GDB REGISTER & DISASSEMBLY DUMP ===
Faulting instruction:
0x000073f197cdc4fc: add 0x10(%rax), %r8
Register state at crash:
rax: 0xfefefefefefefefe (-72340172838076674)
rbx: 0x0
rcx: 0xfffffff8
rdx: 0x25
rsi: 0x0
rdi: 0x25
r8: 0xfefefefefefefefe
r11: 0x25cf (Target Unicode character: U+25CF)
rip: 0x73f197cdc4fc
=== STACK TRACE ===
#0 0x000073f197cdc4fc in ?? () from
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1
#1 0x000073f197cdcf79 in FcCharSetHasChar () from
/usr/lib/x86_64-linux-gnu/libfontconfig.so.1
#2 0x000073f19a21065c in
QFontEngineMultiFontConfig::shouldLoadFontEngineForCharacter(int, unsigned int)
const () from /usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#3 0x000073f19a046323 in QFontEngineMulti::stringToCMap(QChar const*, int,
QGlyphLayout*, int*, QFlags<QFontEngine::ShaperFlag>) const () from
/usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#4 0x000073f19a0b20bd in QTextEngine::shapeText(int) const () from
/usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#5 0x000073f19a0dd5de in QTextLine::layout_helper(int) () from
/usr/lib/x86_64-linux-gnu/libQt6Gui.so.6
#6 0x000073f19b275775 in QQuickTextPrivate::setLineGeometry(...) from
/usr/lib/x86_64-linux-gnu/libQt6Quick.so.6
#7 0x000073f19b27664b in QQuickTextPrivate::setupTextLayout(...) from
/usr/lib/x86_64-linux-gnu/libQt6Quick.so.6
#8 0x000073f19b278b71 in QQuickTextPrivate::updateSize() () from
/usr/lib/x86_64-linux-gnu/libQt6Quick.so.6
#9 0x000073f19b279811 in QQuickTextPrivate::updateLayout() () from
/usr/lib/x86_64-linux-gnu/libQt6Quick.so.6
#10 0x000073f19072c347 in QQuickLabel::componentComplete() () from
/usr/lib/x86_64-linux-gnu/libQt6QuickTemplates2.so.6
=== WORKAROUND / VERIFICATION ===
Purging fonts-katex and running `fc-cache -r -v` immediately resolves the
crash; character 0x25cf cleanly falls back to DejaVuSans.ttf.
** Affects: fontconfig (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2168514
Title:
SIGSEGV in FcCharSetHasChar() at offset 0xc4fc during character
fallback traversal (dereference of 0xfefefefefefefefe)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/fontconfig/+bug/2168514/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
