Re: zbar-0.23.93p1 segfaults, on -current 2026q3

On Mon, Aug 17, 2026 at 09:37:30PM +0100, Stuart Henderson wrote:
> On 2026/08/17 18:56, Mikolaj Kucharski wrote:
> > Hi all.
> > 
> > I see consisent segmentation fault with `zbarimg -q --raw sample.png`
> > command. I don't have usable core at present, so don't have any more
> > info, but I am asking do you see the same? I took few random QR codes
> > from the Internet and they all dump the core with above command.
> > 
> > I was using over the years zbarimg many times, so I didn't see this
> > before. I see this on two separate machines.
> 
> I see it here too, also with other image formats, and with zbar compiled
> with any of base llvm 22, ports llvm 21, ports gcc 16, on amd64 and
> aarch64. Also same if I use packages from just before the ImageMagick
> update.
> 
> Found a slightly older laptop and updated to 2026-05-15-0105
> packages from ftp.hostserver.de archive, and zbar from there works.
> 
> Stepping forward the zbar package from 2026-05-30-0105 works,
> updating just zbar to the package from 2026-06-01-0105 without
> touching any other package it starts segfaulting.
> 
> The big thing that is likely to be in this window is LLVM 22.
> 
> Here's a backtrace from one of the times it crashed.
> 
> $ egdb zbarimg 
> GNU gdb (GDB) 17.2
> Copyright (C) 2025 Free Software Foundation, Inc.
> License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
> This is free software: you are free to change and redistribute it.
> There is NO WARRANTY, to the extent permitted by law.
> Type "show copying" and "show warranty" for details.
> This GDB was configured as "x86_64-unknown-openbsd8.0".
> Type "show configuration" for configuration details.
> For bug reporting instructions, please see:
> <https://www.gnu.org/software/gdb/bugs/>.
> Find the GDB manual and other documentation resources online at:
>     <http://www.gnu.org/software/gdb/documentation/>.
> 
> For help, type "help".
> Type "apropos word" to search for commands related to "word"...
> Reading symbols from zbarimg...
> Reading symbols from /usr/local/bin/.debug/zbarimg.dbg...
> (gdb) set args --verbose=999 somefile.png
> (gdb) r
> Starting program: /usr/local/bin/zbarimg --verbose=999 somefile.png
> _zbar_process_image: processing: Y800(30303859) 324x234 @0x2e14426f000
> _zbar_scan_image: img_x+: 0000,0000 @0x2e14426f000
> _zbar_scan_image: img_x-: 0323,0001 @0x2e14426f287
> 
> Program received signal SIGSEGV, Segmentation fault.
> _zbar_scan_image (iscn=0x2e17de0dd80, img=0x2e0d0cfa310) at img_scanner.c:964
> 964			uint8_t d = *p;
> (gdb) bt
> #0  _zbar_scan_image (iscn=0x2e17de0dd80, img=0x2e0d0cfa310) at img_scanner.c:964
> #1  0x000002e136700ae9 in zbar_scan_image (iscn=0x2e0d0d06880, img=0x0) at img_scanner.c:1128
> #2  0x000002e1366fa5f1 in _zbar_process_image (proc=0x2e0d0d2b480, img=0x2e0d0cfa540) at processor.c:84
> #3  0x000002e1366fc50c in zbar_process_image (proc=0x2e0d0d2b480, img=0x2e0d0cfa540) at processor.c:707
> #4  0x000002de9426d5a6 in scan_image (filename=0x7743e50f5b7d "somefile.png") at zbarimg/zbarimg.c:209
> #5  0x000002de9426ccf8 in main (argc=3, argv=0x7743e50f5908) at zbarimg/zbarimg.c:448
> (gdb) frame 2
> #2  0x000002e1366fa5f1 in _zbar_process_image (proc=0x2e0d0d2b480, img=0x2e0d0cfa540) at processor.c:84
> 84		nsyms = zbar_scan_image(proc->scanner, tmp);
> (gdb) list
> 79		if (proc->syms) {
> 80		    zbar_symbol_set_ref(proc->syms, -1);
> 81		    proc->syms = NULL;
> 82		}
> 83		zbar_image_scanner_recycle_image(proc->scanner, img);
> 84		nsyms = zbar_scan_image(proc->scanner, tmp);
> 85		_zbar_image_swap_symbols(img, tmp);
> 86	
> 87		zbar_image_destroy(tmp);
> 88		tmp = NULL;
> (gdb) p tmp
> $1 = (zbar_image_t *) 0x2e0d0cfa310
> (gdb) p *tmp
> $2 = {
>   format = 808466521,
>   width = 324,
>   height = 234,
>   data = 0x2e14426f000,
>   datalen = 75816,
>   crop_x = 0,
>   crop_y = 0,
>   crop_w = 324,
>   crop_h = 234,
>   userdata = 0x0,
>   cleanup = 0x2e1366f8780 <cleanup_ref>,
>   refcnt = 1,
>   src = 0x0,
>   srcidx = -1,
>   next = 0x2e0d0cfa540,
>   seq = 0,
>   syms = 0x2e0d0d2ffc0
> }
> (gdb) frame 3
> #3  0x000002e1366fc50c in zbar_process_image (proc=0x2e0d0d2b480, img=0x2e0d0cfa540) at processor.c:707
> 707		rc = _zbar_process_image(proc, img);
> (gdb) p img
> $3 = (zbar_image_t *) 0x2e0d0cfa540
> (gdb) list
> 702		rc = _zbar_processor_set_size(proc, zbar_image_get_width(img),
> 703					      zbar_image_get_height(img));
> 704	    if (!rc) {
> 705		zbar_image_scanner_enable_cache(proc->scanner, 0);
> 706		zbar_image_scanner_request_dbus(proc->scanner, proc->is_dbus_enabled);
> 707		rc = _zbar_process_image(proc, img);
> 708		if (proc->streaming)
> 709		    zbar_image_scanner_enable_cache(proc->scanner, 1);
> 710	    }
> 711	
> 
> On another machine which is closer to -current, recompiling zbar with
> -O1 I still get SEGV, but with -O0 it works ok.
> 
> Belatedly thought to check issues/PRs and found
> https://github.com/mchehab/zbar/pull/329 which would explain it,
> and tests concur.
> 
> ok?

there are other (slightly different) PRs as well
https://github.com/mchehab/zbar/pull/299
https://github.com/mchehab/zbar/pull/332

ok jsg@

> 
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/graphics/zbar/Makefile,v
> diff -u -p -r1.40 Makefile
> --- Makefile	17 Aug 2026 19:36:49 -0000	1.40
> +++ Makefile	17 Aug 2026 20:36:57 -0000
> @@ -1,7 +1,7 @@
>  COMMENT=	ZBar barcode reader
> 
>  DISTNAME=	zbar-0.23.93
> -REVISION=	2
> +REVISION=	3
> 
>  SHARED_LIBS=	zbar	0.1 \
>  		zbargtk	0.1
> Index: patches/patch-zbar_img_scanner_c
> ===================================================================
> RCS file: patches/patch-zbar_img_scanner_c
> diff -N patches/patch-zbar_img_scanner_c
> --- /dev/null	1 Jan 1970 00:00:00 -0000
> +++ patches/patch-zbar_img_scanner_c	17 Aug 2026 20:36:57 -0000
> @@ -0,0 +1,22 @@
> +https://github.com/mchehab/zbar/pull/329, plus pull in stddef.h
> +
> +Index: zbar/img_scanner.c
> +--- zbar/img_scanner.c.orig
> ++++ zbar/img_scanner.c
> +@@ -33,6 +33,7 @@
> + #endif
> +
> + #include <assert.h>
> ++#include <stddef.h> /* ptrdiff_t */
> + #include <stdlib.h> /* malloc, free */
> + #include <string.h> /* memcmp, memset, memcpy */
> +
> +@@ -862,7 +863,7 @@ static void zbar_send_code_via_dbus(zbar_image_scanner
> +     do {                                 \
> + 	x += (dx);                       \
> + 	y += (dy);                       \
> +-	p += (dx) + ((uintptr_t)(dy)*w); \
> ++	p += (ptrdiff_t)(dx) + (intptr_t)(dy) * (intptr_t)w; \
> +     } while (0);
> +
> + static void *_zbar_scan_image(zbar_image_scanner_t *iscn, zbar_image_t *img)
> 
>