Package: mate-panel
Version: 1.27.1-4.1
Severity: normal
Tags: patch upstream
Dear Maintainer,
mate-panel crashes as soon as the GTK theme Blackbird (package
blackbird-gtk-theme) is selected in Appearance Preferences, and at every
start while Blackbird is set, so the session ends up without panels.
Seen on trixie, X11, two monitors, with mate-panel 1.27.1-4.1 (and a
local rebuild of it), libgtk-3-0t64 3.24.49-3, libcairo2 1.18.4-1+b1,
blackbird-gtk-theme 0.4+20171213-4.
Steps to reproduce:
1. apt install blackbird-gtk-theme
2. In Appearance Preferences (mate-appearance-properties), select the
theme Blackbird.
mate-panel crashes. Whether and where exactly it crashes depends on the
stack contents (see below); here it crashed every time.
Cause:
mate-panel/panel-background.c, panel_background_prepare(), case
PANEL_BACK_NONE:
cairo_surface_t *surface;
cairo_pattern_get_surface(background->default_pattern, &surface);
/* catch invalid images (e.g. -gtk-gradient) before scaling and
rendering */
if (surface != NULL ){
...
cairo_surface_reference(surface);
default_pattern is the theme's background-image
(set_background_default_style()
in panel-toplevel.c). For background-image: -gtk-gradient(...), GTK 3.24
returns the gradient's own cairo pattern (css_image_value_query() in
gtk/gtkcssstylepropertyimpl.c); for other images it returns a surface
pattern. For a gradient pattern, cairo_pattern_get_surface() returns
CAIRO_STATUS_PATTERN_TYPE_MISMATCH and does not write to surface. The
return value is ignored and surface is uninitialized, so the check that
is meant to catch exactly this case tests stack garbage. Blackbird sets
background-image: -gtk-gradient(...) for PanelToplevel
(gtk-3.20/apps/gnome-applications.css).
Backtraces, from a local rebuild 1.27.1-4.1+armin1 with its dbgsym. It
differs from 1.27.1-4.1 only by an unrelated wnck-pager patch; Debian's
build crashed at the same offset (mate-panel + 0x4007a, line 112).
1. SIGSEGV when selecting the theme:
#0 cairo_surface_reference () from libcairo.so.2
#1 panel_background_prepare (background=0x555eb3f90dc0) at
panel-background.c:112
#2 set_background_default_style (widget=0x555eb3f90d70) at
panel-toplevel.c:2961
2. SIGABRT, cairo's reference count assertion in the same call:
#4 __assert_fail_base (..., line=939, ...) at ./assert/assert.c:118
#5 ?? () from libcairo.so.2
#6 panel_background_prepare (background=0x55c6f20dece0) at
panel-background.c:112
#7 set_background_region (toplevel=0x55c6f20dec90) at panel-toplevel.c:3195
3. SIGSEGV at startup, after the garbage pointer survived the reference:
#0 gdk_window_set_background_pattern () from libgdk-3.so.0
#1 panel_background_prepare (background=0x55a272a94da0) at
panel-background.c:121
#2 set_background_region (toplevel=0x55a272a94d50) at panel-toplevel.c:3195
#4 panel_toplevel_size_allocate (widget=0x55a272a94d50, ...) at
panel-toplevel.c:3274
The attached patch initializes the pointer and checks the return value,
so such a theme falls back to the background color with the existing
warning, as the code intends. Tested on the affected machine with
1.27.1-4.1 plus this patch: no crash when selecting Blackbird or when
starting with Blackbird set; the warning "unsupported value of
'background-image' in GTK+ theme" appears instead.
The code is unchanged in mate-panel 1.28.x and master. Related reports,
closed without a code change or not handled:
https://github.com/mate-desktop/mate-panel/issues/1249
https://github.com/mate-desktop/mate-panel/issues/1352
https://bugs.launchpad.net/ubuntu/+source/mate-panel/+bug/1986453
I will forward the patch upstream and add the link here.
Regards,
Armin Fuerst
--
The ASCII Ribbon Campaign
() No HTML/RTF in email
/\ No Word docs in email
Respect for open standards
http://arc.pasp.de/
Description: Fix crash with gradient background-image in the GTK theme
panel_background_prepare() passes an uninitialized pointer to
cairo_pattern_get_surface() and ignores its return value. For a pattern
that is not a surface pattern, such as the one GTK returns for
background-image: -gtk-gradient(...), cairo_pattern_get_surface() fails
with CAIRO_STATUS_PATTERN_TYPE_MISMATCH and does not set the pointer. The
check "surface != NULL", meant to catch exactly this case, then tests
uninitialized stack memory, and mate-panel crashes in
cairo_surface_reference() (SIGSEGV or a cairo assertion) or later in
gdk_window_set_background_pattern(), depending on the stack contents.
.
Initialize the pointer and check the return value, so such a theme falls
back to the background color with the existing warning, as intended.
.
Reproducer: GTK theme Blackbird (package blackbird-gtk-theme), which sets
background-image: -gtk-gradient(...) for PanelToplevel.
Author: Armin Fuerst <[email protected]>
Forwarded: not-yet
Last-Update: 2026-10-10
---
--- a/mate-panel/panel-background.c 2026-10-10 18:17:20.979260128 +0000
+++ b/mate-panel/panel-background.c 2026-10-10 18:17:21.045607285 +0000
@@ -101,10 +101,13 @@
* backing region is cleared
* (gdk_window_clear_backing_region), the correctly
* scaled pattern is used */
- cairo_surface_t *surface;
+ cairo_surface_t *surface = NULL;
- cairo_pattern_get_surface(background->default_pattern, &surface);
- /* catch invalid images (e.g. -gtk-gradient) before scaling and rendering */
+ /* catch invalid images (e.g. -gtk-gradient) before scaling and rendering:
+ * for a pattern that is not a surface pattern, such as a gradient,
+ * cairo_pattern_get_surface() fails and leaves surface unset */
+ if (cairo_pattern_get_surface (background->default_pattern, &surface) != CAIRO_STATUS_SUCCESS)
+ surface = NULL;
if (surface != NULL ){
double width, height;
cairo_matrix_t m;
