Your message dated Sat, 10 Oct 2026 20:42:15 +0000
with message-id <[email protected]>
and subject line Bug#1150554: fixed in mate-panel 1.27.1-6
has caused the Debian Bug report #1150554,
regarding mate-panel: crash in panel_background_prepare() with a gradient
background-image in the GTK theme (e.g. Blackbird)
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1150554: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1150554
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: mate-panel
Version: 1.27.1-4.1
Severity: normal
Tags: patch upstream
Dear Maintainer,
mate-panel crashes as soon as the GTK theme Blackbird (package
blackbird-gtk-theme) is selected in Appearance Preferences, and at every
start while Blackbird is set, so the session ends up without panels.
Seen on trixie, X11, two monitors, with mate-panel 1.27.1-4.1 (and a
local rebuild of it), libgtk-3-0t64 3.24.49-3, libcairo2 1.18.4-1+b1,
blackbird-gtk-theme 0.4+20171213-4.
Steps to reproduce:
1. apt install blackbird-gtk-theme
2. In Appearance Preferences (mate-appearance-properties), select the
theme Blackbird.
mate-panel crashes. Whether and where exactly it crashes depends on the
stack contents (see below); here it crashed every time.
Cause:
mate-panel/panel-background.c, panel_background_prepare(), case
PANEL_BACK_NONE:
cairo_surface_t *surface;
cairo_pattern_get_surface(background->default_pattern, &surface);
/* catch invalid images (e.g. -gtk-gradient) before scaling and
rendering */
if (surface != NULL ){
...
cairo_surface_reference(surface);
default_pattern is the theme's background-image
(set_background_default_style()
in panel-toplevel.c). For background-image: -gtk-gradient(...), GTK 3.24
returns the gradient's own cairo pattern (css_image_value_query() in
gtk/gtkcssstylepropertyimpl.c); for other images it returns a surface
pattern. For a gradient pattern, cairo_pattern_get_surface() returns
CAIRO_STATUS_PATTERN_TYPE_MISMATCH and does not write to surface. The
return value is ignored and surface is uninitialized, so the check that
is meant to catch exactly this case tests stack garbage. Blackbird sets
background-image: -gtk-gradient(...) for PanelToplevel
(gtk-3.20/apps/gnome-applications.css).
Backtraces, from a local rebuild 1.27.1-4.1+armin1 with its dbgsym. It
differs from 1.27.1-4.1 only by an unrelated wnck-pager patch; Debian's
build crashed at the same offset (mate-panel + 0x4007a, line 112).
1. SIGSEGV when selecting the theme:
#0 cairo_surface_reference () from libcairo.so.2
#1 panel_background_prepare (background=0x555eb3f90dc0) at
panel-background.c:112
#2 set_background_default_style (widget=0x555eb3f90d70) at
panel-toplevel.c:2961
2. SIGABRT, cairo's reference count assertion in the same call:
#4 __assert_fail_base (..., line=939, ...) at ./assert/assert.c:118
#5 ?? () from libcairo.so.2
#6 panel_background_prepare (background=0x55c6f20dece0) at
panel-background.c:112
#7 set_background_region (toplevel=0x55c6f20dec90) at panel-toplevel.c:3195
3. SIGSEGV at startup, after the garbage pointer survived the reference:
#0 gdk_window_set_background_pattern () from libgdk-3.so.0
#1 panel_background_prepare (background=0x55a272a94da0) at
panel-background.c:121
#2 set_background_region (toplevel=0x55a272a94d50) at panel-toplevel.c:3195
#4 panel_toplevel_size_allocate (widget=0x55a272a94d50, ...) at
panel-toplevel.c:3274
The attached patch initializes the pointer and checks the return value,
so such a theme falls back to the background color with the existing
warning, as the code intends. Tested on the affected machine with
1.27.1-4.1 plus this patch: no crash when selecting Blackbird or when
starting with Blackbird set; the warning "unsupported value of
'background-image' in GTK+ theme" appears instead.
The code is unchanged in mate-panel 1.28.x and master. Related reports,
closed without a code change or not handled:
https://github.com/mate-desktop/mate-panel/issues/1249
https://github.com/mate-desktop/mate-panel/issues/1352
https://bugs.launchpad.net/ubuntu/+source/mate-panel/+bug/1986453
I will forward the patch upstream and add the link here.
Regards,
Armin Fuerst
--
The ASCII Ribbon Campaign
() No HTML/RTF in email
/\ No Word docs in email
Respect for open standards
http://arc.pasp.de/
Description: Fix crash with gradient background-image in the GTK theme
panel_background_prepare() passes an uninitialized pointer to
cairo_pattern_get_surface() and ignores its return value. For a pattern
that is not a surface pattern, such as the one GTK returns for
background-image: -gtk-gradient(...), cairo_pattern_get_surface() fails
with CAIRO_STATUS_PATTERN_TYPE_MISMATCH and does not set the pointer. The
check "surface != NULL", meant to catch exactly this case, then tests
uninitialized stack memory, and mate-panel crashes in
cairo_surface_reference() (SIGSEGV or a cairo assertion) or later in
gdk_window_set_background_pattern(), depending on the stack contents.
.
Initialize the pointer and check the return value, so such a theme falls
back to the background color with the existing warning, as intended.
.
Reproducer: GTK theme Blackbird (package blackbird-gtk-theme), which sets
background-image: -gtk-gradient(...) for PanelToplevel.
Author: Armin Fuerst <[email protected]>
Forwarded: not-yet
Last-Update: 2026-10-10
---
--- a/mate-panel/panel-background.c 2026-10-10 18:17:20.979260128 +0000
+++ b/mate-panel/panel-background.c 2026-10-10 18:17:21.045607285 +0000
@@ -101,10 +101,13 @@
* backing region is cleared
* (gdk_window_clear_backing_region), the correctly
* scaled pattern is used */
- cairo_surface_t *surface;
+ cairo_surface_t *surface = NULL;
- cairo_pattern_get_surface(background->default_pattern, &surface);
- /* catch invalid images (e.g. -gtk-gradient) before scaling and rendering */
+ /* catch invalid images (e.g. -gtk-gradient) before scaling and rendering:
+ * for a pattern that is not a surface pattern, such as a gradient,
+ * cairo_pattern_get_surface() fails and leaves surface unset */
+ if (cairo_pattern_get_surface (background->default_pattern, &surface) != CAIRO_STATUS_SUCCESS)
+ surface = NULL;
if (surface != NULL ){
double width, height;
cairo_matrix_t m;
--- End Message ---
--- Begin Message ---
Source: mate-panel
Source-Version: 1.27.1-6
Done: Mike Gabriel <[email protected]>
We believe that the bug you reported is fixed in the latest version of
mate-panel, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mike Gabriel <[email protected]> (supplier of updated mate-panel package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 10 Oct 2026 21:37:45 +0200
Source: mate-panel
Architecture: source
Version: 1.27.1-6
Distribution: unstable
Urgency: medium
Maintainer: Debian+Ubuntu MATE Packaging Team <[email protected]>
Changed-By: Mike Gabriel <[email protected]>
Closes: 1150554
Changes:
mate-panel (1.27.1-6) unstable; urgency=medium
.
* debian/patches:
+ Add 1001-panel-background-fix-uninitialized-surface.patch. Fix crash with
gradient background-image in the GTK theme panel_background_prepare()
passes an uninitialized pointer to cairo_pattern_get_surface() and
ignores its return value. (Closes: #1150554). Thanks to Amin Fuerst for
submitting the patch.
Checksums-Sha1:
f05337a5e46f15b0b12550f4eea46ace4309b1d0 3207 mate-panel_1.27.1-6.dsc
487b1bb4f68de8361af5eefa4ce339490dc6e474 25388
mate-panel_1.27.1-6.debian.tar.xz
a683e1565b39a91b3048c71be8f9348b19093c7c 21151
mate-panel_1.27.1-6_source.buildinfo
Checksums-Sha256:
d424f8297b4acc4e64a2a28f9069b2c9137a503bda5e4d2bb0760c76a17391aa 3207
mate-panel_1.27.1-6.dsc
dc4ffc3c7ad7c69abb952c02288739535007a37d4a362e5e67eb4ad732a09d59 25388
mate-panel_1.27.1-6.debian.tar.xz
c7587c05d15a3d308c217eb8443eec307f3de02b9f200423992bab43062ef59b 21151
mate-panel_1.27.1-6_source.buildinfo
Files:
bb4e6a7c4e1a675de9e57123514962d1 3207 x11 optional mate-panel_1.27.1-6.dsc
dc11814d520424577e5185c5fdfe7584 25388 x11 optional
mate-panel_1.27.1-6.debian.tar.xz
10da10201af19fc412da390fa88446a7 21151 x11 optional
mate-panel_1.27.1-6_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJJBAEBCgAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAmrKlSsVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxIEoP/32Z/BkLLo5Crqo2H4S5pIxGlWis
O2pebdj+VRWLu0hypWtcHHcFMfbutlJWB1KXfMh3Ckwtw/Zkc7GImPuPfNFo5i91
1JerwsRDmNiT1XdEAe+PpvkYWvtUaRvN7lyWgnRTMiute4oU6rniPIFu5BjSAKSA
V1gSvwzn/9HKQt86MZI5HvmDW+mVa6WHaooq2tzyA7zwHIbjJWjD6VqnkyGw4P/d
tAJcFjWg3l2SQuuva7L3gWyE+sZ6gdK5KpHXh8OIEB1C0L2TJXclpTpQNuZaP/H9
aRHICOJ7jQoUDtILY1LoFugPmIuG1zcFIqorNpjtlyK5kJxI4VEo0Ama89/Wc8wF
mCPq0zkIRJ58nphWthAnxlJUInEnAqA5HTJkZt605GPJ1DABo4BS6DWrAWaAGpNt
smlobwlhxBl6BxUll8pdcAeclmZ3BWqhAqIVpgTg4AvJezkAnTlciBW7KZHEbKkR
Bnwo2+SlHCV0IariMgwMpAg9bu8Ebnfdybnyh31qZRmW9nR+GRPDbOvaGqjgWTCy
P63snjs73jujaMJF3SGKxS65YfyMFDcOPdxalhPjHqg6PJJ76uHLFQt5h+w+h+FU
iAn4WE+buttz7qdxci8EN0sq3Knlox2KJicX1lq/M9a6iQIL1Xya7R/U9n30si0F
6P18qmZ0UlI6oIxf
=Iboq
-----END PGP SIGNATURE-----
pgpfIkZHt7hyF.pgp
Description: PGP signature
--- End Message ---
