App crashes when loading images containing Exif metadata, segmentation fault (Odin)

[kem-a]

What Happened

When loading images containing Exif metadata app instantly crashes if in Preferences option Write metadata to files is toggled off.

Expected Behavior

App should handle this without a crash. In perfect case scenario it should show error message to the user or to show at least which image caused error. There are many ways how to handle it. Going through 2k photos one by one to figure out the problem is not a very convenient way to solve errors.

One last note, it is still possible to crash app even with metadata toggle enabled. I had two photos that just did that, but I haven't narrowed down exact cause. My guess is that photos contains some non standard metadata, that Photos app can't handle.

[edit:] I dug deeper and found that two photos that caused a crash had corrupted Exif metadata. By fixing it Photos app could load it. So in summary, Photos app does not handle very well metadata issues.

Steps to Reproduce

1. In Preferences toggle off option Write metadata to files.
2. Take any image and apply metadata, for example, rotate it.
3. Copy to Photo library or folder from where Photos app loads images.

Logs

$ dmesg
[ 6502.494616] io.elementary.p[10017]: segfault at 7e2 ip 00007f89b14304b5 sp 00007ffcc02dc210 error 6 in libc-2.31.so[7f89b13ea000+178000]
[ 6502.494675] Code: 0f 85 29 2c 00 00 8b 8d 58 fa ff ff 83 f9 2f 0f 87 4d 17 00 00 89 ca 83 c1 08 48 03 95 68 fa ff ff 89 8d 58 fa ff ff 48 8b 12 <89> 02 e9 a8 c9 ff ff 48 89 e0 48 39 c4 74 15 48 81 ec 00 10 00 00

$ journalctl | grep io.elementary.p
sep 16 17:18:01 kerrigan io.elementary.p[10017]: Page.vala:276: Page 20190310_203941.jpg: Unable to locate action PrevPhoto
sep 16 17:18:01 kerrigan io.elementary.p[10017]: Page.vala:276: Page 20190310_203941.jpg: Unable to locate action NextPhoto
sep 16 17:18:01 kerrigan io.elementary.p[10017]: Page.vala:276: Page 20190310_203941.jpg: Unable to locate action FlipHorizontally
sep 16 17:18:01 kerrigan io.elementary.p[10017]: Page.vala:276: Page 20190310_203941.jpg: Unable to locate action FlipVertically
sep 16 17:18:01 kerrigan io.elementary.p[10017]: Page.vala:276: Page 20190310_203941.jpg: Unable to locate action SetBackground
sep 16 17:18:02 kerrigan kernel: io.elementary.p[10017]: segfault at 7e2 ip 00007f89b14304b5 sp 00007ffcc02dc210 error 6 in libc-2.31.so[7f89b13ea000+178000]

Platform Information

OS: elementary OS 6 Odin x86_64
Host: Aspire VX5-591G V1.08
Kernel: 5.11.0-34-generic

$ io.elementary.photos --version
Photos 2.7.1

[davidak]

I was not able to reproduce with your steps, but noticed an issue with metadata too.

Steps to reproduce:

1. Download https://davidak.de/images/theme_10_08.jpg
2. Open with photos from terminal: io.elementary.photos '/home/davidak/Documents/theme_10_08.jpg'
3. You get this message:

PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

It is actually just a warning. The app does not crash.

Maybe the crash is related to a different problem? Maybe the same that i reported here: #699

[davidak@gaming:~]$ io.elementary.photos '/home/davidak/Documents/theme_10_08.jpg' 
** Message: 18:09:02.390: main.vala:347: Shotwell Photo Viewer 2.7.3

** (io.elementary.photos:3728934): WARNING **: 18:09:02.423: PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

** (io.elementary.photos:3728934): WARNING **: 18:09:02.569: PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

** (io.elementary.photos:3728934): WARNING **: 18:09:02.569: PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

** (io.elementary.photos:3728934): WARNING **: 18:09:02.575: PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

** (io.elementary.photos:3728934): WARNING **: 18:09:02.586: Page.vala:280: Page theme_10_08.jpg: Unable to locate action PrevPhoto

** (io.elementary.photos:3728934): WARNING **: 18:09:02.586: Page.vala:280: Page theme_10_08.jpg: Unable to locate action NextPhoto

** (io.elementary.photos:3728934): WARNING **: 18:09:02.586: Page.vala:280: Page theme_10_08.jpg: Unable to locate action FlipHorizontally

** (io.elementary.photos:3728934): WARNING **: 18:09:02.586: Page.vala:280: Page theme_10_08.jpg: Unable to locate action FlipVertically

** (io.elementary.photos:3728934): WARNING **: 18:09:02.586: Page.vala:280: Page theme_10_08.jpg: Unable to locate action SetBackground

** (io.elementary.photos:3728934): WARNING **: 18:09:02.602: Page.vala:280: Page theme_10_08.jpg: Unable to locate action PrevPhoto

** (io.elementary.photos:3728934): WARNING **: 18:09:02.602: Page.vala:280: Page theme_10_08.jpg: Unable to locate action NextPhoto

** (io.elementary.photos:3728934): WARNING **: 18:09:02.602: Page.vala:280: Page theme_10_08.jpg: Unable to locate action FlipHorizontally

** (io.elementary.photos:3728934): WARNING **: 18:09:02.602: Page.vala:280: Page theme_10_08.jpg: Unable to locate action FlipVertically

** (io.elementary.photos:3728934): WARNING **: 18:09:02.602: Page.vala:280: Page theme_10_08.jpg: Unable to locate action SetBackground

** (io.elementary.photos:3728934): WARNING **: 18:09:09.900: PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

** (io.elementary.photos:3728934): WARNING **: 18:09:09.901: PhotoMetadata.vala:557: Unable to read date/time Xmp.xmp.CreateDate from source theme_10_08.jpg: 2008-10-12T16:31+02:00 is not XMP format date/time

---

Photos 2.7.3
NixOS 21.11.334797.6979c0e49bb

[jjg]

I'm seeing a similar segfault during import and I'm guessing it's due to a "bad" image file, but I'm not sure how to tell which file it's accessing when it crashes?

[jeremypw]

@jjg You could try running the app from the terminal with GTK_MESSAGES_DEBUG=all io.elementary.photos to get extra info on what the app is doing. This should give the names of any files it has problems with so the last one to appear may be the one causing the problem, Unfortunately the crash may occur before the app can generate the message.
You could also run the app under gdb (you may need to install this) with gdb io.elementary,photos. Enter run to start the app then when it crashes enter bt to get a backtrace. If you post the output here it can help pin down the cause.

[jeremypw]

I have pushed a PR #781 aimed at making the part of the code that handles photo metadata less likely to crash.

[jjg]

@jjg You could try running the app from the terminal with GTK_MESSAGES_DEBUG=all io.elementary.photos to get extra info on what the app is doing. This should give the names of any files it has problems with so the last one to appear may be the one causing the problem,

As you guessed, the output from this didn't provide any clues (same output as running the command directly:

** (io.elementary.photos:2125609): WARNING **: 12:44:19.546: No image data to encode Exif.Image.JPEGInterchangeFormat.

** (io.elementary.photos:2125609): WARNING **: 12:44:19.553: No image data to encode Exif.Image.JPEGInterchangeFormat.

** (io.elementary.photos:2125609): WARNING **: 12:44:19.568: No image data to encode Exif.Image.JPEGInterchangeFormat.

Unfortunately the crash may occur before the app can generate the message. You could also run the app under gdb (you may need to install this) with gdb io.elementary,photos. Enter run to start the app then when it crashes enter bt to get a backtrace. If you post the output here it can help pin down the cause.

This was more fruitful. Here is the output from the gdb backtrace:

** (io.elementary.photos:2125609): WARNING **: 12:44:19.568: No image data to encode Exif.Image.JPEGInterchangeFormat.

Thread 37 "pool-io.element" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fffd7400640 (LWP 2126080)]
0x00007ffff6667149 in __vfscanf_internal (s=s@entry=0x7fffd73ff5d0, format=format@entry=0x5555557ed274 "%4d%2d%2d%2d%2d%2d", argptr=argptr@entry=0x7fffd73ff5b8, mode_flags=mode_flags@entry=2) at ./stdio-common/vfscanf-internal.c:1896
1896	./stdio-common/vfscanf-internal.c: No such file or directory.
(gdb) bt
#0  0x00007ffff6667149 in __vfscanf_internal
    (s=s@entry=0x7fffd73ff5d0, format=format@entry=0x5555557ed274 "%4d%2d%2d%2d%2d%2d", argptr=argptr@entry=0x7fffd73ff5b8, mode_flags=mode_flags@entry=2)
    at ./stdio-common/vfscanf-internal.c:1896
#1  0x00007ffff6662362 in __GI___isoc99_sscanf (s=0x7fffa806a580 "2007 01 16 03 32 08", format=0x5555557ed274 "%4d%2d%2d%2d%2d%2d")
    at ./stdio-common/isoc99_sscanf.c:31
#2  0x00005555556341c7 in metadata_date_time_construct_from_exif ()
#3  0x000055555572e3e3 in photo_metadata_get_date_time ()
#4  0x000055555572e517 in photo_metadata_get_first_date_time ()
#5  0x0000555555649893 in photo_prepare_for_import ()
#6  0x00005555555f2981 in  ()
#7  0x00005555557605aa in  ()
#8  0x00007ffff7ef6714 in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#9  0x00007ffff7ef3ab1 in  () at /lib/x86_64-linux-gnu/libglib-2.0.so.0
#10 0x00007ffff6694ac3 in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:442
#11 0x00007ffff6726850 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thank-you @jeremypw !

[jeremypw]

@jjg Thanks for the further information - looks like its something to do with the date-time in the metadata. The crash is occuring in one of the batch import worker threads. Could you confirm the format of the photos you are importing (JPEG, BMP, RAW etc)? A different piece of code is used depending on the format.

[jjg]

Could you confirm the format of the photos you are importing (JPEG, BMP, RAW etc)? A different piece of code is used depending on the format.

There are a lot of files and a mixture of formats. No RAW, but probably a little bit of everything else.

[jeremypw]

@jjg I think I've located the cause of the crash in your case (and hopefully in other cases)! I've pushed a fix in #785. Thanks for your help in supplying the back-trace. This allowed me to locate the source of the error.