Segmentation fault with no logs when scanning media library since upgrade to 10.10.1

[ryannathans]

This issue respects the following points:

• This is a bug, not a question or a configuration issue; Please visit our forum or chat rooms first to troubleshoot with volunteers, before creating a report. The links can be found here.
• This issue is not already reported on GitHub (I've searched it).
• I'm using an up to date version of Jellyfin Server stable, unstable or master; We generally do not support previous older versions. If possible, please update to the latest version before opening an issue.
• I agree to follow Jellyfin's Code of Conduct.
• This report addresses only a single issue; If you encounter multiple issues, kindly create separate reports for each one.

Description of the bug

After upgrading to Jellyfin 10.10.1 (from 10.9.11 IIRC) on FreeBSD 14.1 (using the package in the package manager), manual media library scans now cause segmentation faults. I do not know if automatic library scans cause the same issue, but I would assume so.

It doesn't seem to matter which library I scan, the same behavior occurs. There are no useful logs.

Reproduction steps

1. Sign in as admin
2. Open the dashboard in app/browser
3. Click "Scan All Libraries" (or go to libraries and trigger a scan on any singular library)
4. Observe the server seg fault and crash/restart

What is the current bug behavior?

Segmentation fault (core dumped)

What is the expected correct behavior?

Media library scans as it used to, with no segmentation fault

Jellyfin Server version

10.10.0+

Specify commit id

No response

Specify unstable release number

No response

Specify version number

No response

Specify the build version

10.10.1

Environment

- OS: FreeBSD 14.1
- Linux Kernel: N/a
- Virtualization: Appjail
- Clients: All
- Browser: All
- FFmpeg Version: 6.1.2
- Playback Method: N/a
- Hardware Acceleration: None
- GPU Model: None
- Plugins: AudioDB 10.10.1.0, MusicBrainz 10.10.1.0, OMDb 10.10.1.0, Studio Images 10.10.1.0, TMDb 10.10.1.0, TMDb Box Sets 11.0.0.0, Session Cleaner 4.0.0.0 (tried disabling the two installed plugins with no changes in behavior observed)
- Reverse Proxy: none
- Base URL: none
- Networking: bridge
- Storage: local, ZFS

Jellyfin logs

[14:13:03] [INF] [1] Main: Jellyfin version: 10.10.1
[14:13:03] [INF] [1] Main: Environment Variables: ["[JELLYFIN_LOG_DIR, /var/db/jellyfin/log]"]
[14:13:03] [INF] [1] Main: Arguments: ["/usr/local/jellyfin/jellyfin.dll", "--datadir", "/var/db/jellyfin", "--cachedir", "/var/cache/jellyfin"]
[14:13:03] [INF] [1] Main: Operating system: FreeBSD 14.1-RELEASE-p4 FreeBSD 14.1-RELEASE-p4 GENERIC
[14:13:03] [INF] [1] Main: Architecture: X64
[14:13:03] [INF] [1] Main: 64-Bit Process: True
[14:13:03] [INF] [1] Main: User Interactive: True
[14:13:03] [INF] [1] Main: Processor count: 6
[14:13:03] [INF] [1] Main: Program data path: /var/db/jellyfin
[14:13:03] [INF] [1] Main: Log directory path: /var/db/jellyfin/log
[14:13:03] [INF] [1] Main: Config directory path: /var/db/jellyfin/config
[14:13:03] [INF] [1] Main: Cache path: /var/cache/jellyfin
[14:13:03] [INF] [1] Main: Temp directory path: /tmp/jellyfin
[14:13:03] [INF] [1] Main: Web resources path: /usr/local/jellyfin/jellyfin-web
[14:13:03] [INF] [1] Main: Application directory: /usr/local/jellyfin/
[14:13:03] [INF] [1] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: /var/cache/jellyfin
[14:13:04] [INF] [1] Emby.Server.Implementations.ApplicationHost: Loading assemblies
[14:13:04] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded assembly Jellyfin.Plugin.SessionCleaner, Version=4.0.0.0, Culture=neutral, PublicKeyToken=null from /var/db/jellyfin/plugins/Session Cleaner_4.0.0.0/Jellyfin.Plugin.SessionCleaner.dll
[14:13:04] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded assembly Tvdb.Sdk, Version=4.7.10.0, Culture=neutral, PublicKeyToken=null from /var/db/jellyfin/plugins/TheTVDB_18.0.0.0/Tvdb.Sdk.dll
[14:13:04] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded assembly Jellyfin.Plugin.Tvdb, Version=18.0.0.0, Culture=neutral, PublicKeyToken=null from /var/db/jellyfin/plugins/TheTVDB_18.0.0.0/Jellyfin.Plugin.Tvdb.dll
[14:13:04] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded assembly Jellyfin.Plugin.TMDbBoxSets, Version=11.0.0.0, Culture=neutral, PublicKeyToken=null from /var/db/jellyfin/plugins/TMDb Box Sets_11.0.0.0/Jellyfin.Plugin.TMDbBoxSets.dll
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN subnets: ["xxxx:xxxx:xxxx::/48", "192.168.0.0/16"]
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Defined LAN exclusions: []
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Used LAN subnets: ["xxxx:xxxx:xxxx::/48", "192.168.0.0/16"]
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Filtered interface addresses: ["127.0.0.1", "192.168.69.16", "::1", "fe80::1%15", "fe80::d8:61ff:fe0d:2fe9%8", "xxxx:xxxx:xxxx:2:d8:61ff:fe0d:2fe9"]
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Bind Addresses ["::"]
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Remote IP filter is Allowlist
[14:13:04] [INF] [1] Jellyfin.Networking.Manager.NetworkManager: Filtered subnets: []
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: Session Cleaner 4.0.0.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TheTVDB 18.0.0.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TMDb Box Sets 11.0.0.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: TMDb 10.10.1.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: Studio Images 10.10.1.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: OMDb 10.10.1.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: MusicBrainz 10.10.1.0
[14:13:06] [INF] [1] Emby.Server.Implementations.Plugins.PluginManager: Loaded plugin: AudioDB 10.10.1.0
[14:13:06] [INF] [1] Main: Kestrel is listening on all interfaces
[14:13:06] [WRN] [1] Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager: No XML encryptor configured. Key {redacted} may be persisted to storage in unencrypted form.
[14:13:07] [WRN] [1] Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware: The WebRootPath was not found: /root/wwwroot. Static files may be unavailable.
[14:13:07] [INF] [1] Emby.Server.Implementations.ApplicationHost: Running startup tasks
[14:13:07] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Clean Old Sessions set to fire at 2024-11-13 00:00:00.000 +11:00, which is 09:46:52.5920969 from now.
[14:13:07] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Generate Trickplay Images set to fire at 2024-11-13 03:00:00.000 +11:00, which is 12:46:52.5823725 from now.
[14:13:07] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Extract Chapter Images set to fire at 2024-11-13 01:00:00.000 +11:00, which is 10:46:52.5810462 from now.
[14:13:07] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Scan Media Library set to fire at 2024-11-13 00:00:00.000 +11:00, which is 09:46:52.5776750 from now.
[14:13:07] [INF] [1] Emby.Server.Implementations.ScheduledTasks.TaskManager: Daily trigger for Keyframe Extractor set to fire at 2024-11-13 02:00:00.000 +11:00, which is 11:46:52.5774782 from now.
[14:13:07] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Found ffmpeg version 6.1.2
[14:13:07] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available decoders: ["libdav1d", "av1", "av1_cuvid", "h264", "h264_cuvid", "hevc", "hevc_cuvid", "mpeg2video", "mpeg2_cuvid", "mpeg4", "mpeg4_cuvid", "msmpeg4", "vc1_cuvid", "vp8", "libvpx", "vp8_cuvid", "vp9", "libvpx-vp9", "vp9_cuvid", "aac", "ac3", "dca", "flac", "mp3", "truehd"]
[14:13:07] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available encoders: ["libsvtav1", "av1_nvenc", "av1_vaapi", "libx264", "h264_nvenc", "h264_v4l2m2m", "h264_vaapi", "libx265", "hevc_nvenc", "hevc_vaapi", "mjpeg_vaapi", "aac", "ac3", "alac", "dca", "flac", "libmp3lame", "libopus", "truehd", "libvorbis", "srt"]
[14:13:07] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available filters: ["deinterlace_vaapi", "flip_vulkan", "hwupload_cuda", "libplacebo", "overlay_vaapi", "overlay_vulkan", "procamp_vaapi", "scale_vaapi", "scale_vulkan", "tonemap_vaapi", "transpose_vaapi", "transpose_vulkan"]
[14:13:07] [WRN] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Filter: scale_cuda with option format is not available
[14:13:07] [WRN] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Filter: tonemap_cuda with option GPU accelerated HDR to SDR tonemapping is not available
[14:13:07] [WRN] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Filter: tonemap_opencl with option bt2390 is not available
[14:13:07] [WRN] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Filter: overlay_opencl with option Action to take when encountering EOF from secondary input is not available
[14:13:07] [INF] [10] Emby.Server.Implementations.HttpServer.WebSocketManager: WS xxxx:xxxx:xxxx:2:a980:30fb:1b3e:e713 request
[14:13:07] [WRN] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Filter: transpose_opencl with option rotate by half-turn is not available
[14:13:07] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: Available hwaccel types: ["vdpau", "cuda", "vaapi", "drm", "vulkan"]
[14:13:07] [INF] [1] MediaBrowser.MediaEncoding.Encoder.MediaEncoder: FFmpeg: ffmpeg
[14:13:07] [INF] [1] Emby.Server.Implementations.ApplicationHost: ServerId: 1e0c7e2eee044cd7a0aa2d1b47afdcea
[14:13:07] [INF] [1] Emby.Server.Implementations.ApplicationHost: Core startup complete
[14:13:07] [INF] [1] Main: Startup complete 0:00:04.2334414
[14:13:10] [INF] [16] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean Transcode Directory Completed after 0 minute(s) and 0 seconds
[14:13:10] [INF] [17] Emby.Server.Implementations.ScheduledTasks.TaskManager: Clean up collections and playlists Completed after 0 minute(s) and 0 seconds
[14:13:12] [INF] [17] Emby.Server.Implementations.ScheduledTasks.TaskManager: Update Plugins Completed after 0 minute(s) and 1 seconds
[14:13:13] [INF] [17] Emby.Server.Implementations.Library.LibraryManager: Validating media library
Segmentation fault (core dumped)

FFmpeg logs

Client / Browser logs

No response

Relevant screenshots or videos

No response

Additional information

Would love to provide more logs or information... but there doesn't seem to be any more hints or logs I can find

[felix920506]

please enable debug logging. https://jellyfin.org/docs/general/administration/troubleshooting#debug-logging

[oychang]

Similar issue to OP. Enabled debug logging and this seems like the relevant section after triggering a manual library scan:

[2024-11-14 16:03:43.150 -08:00] [INF] [10] Microsoft.AspNetCore.Hosting.Diagnostics: Request starting "HTTP/1.1" "POST" "http"://"...:8096""""/ScheduledTasks/Running/7738148ffcd07979c7ceb148e06b3aed""" - null 0
[2024-11-14 16:03:43.152 -08:00] [INF] [10] Microsoft.AspNetCore.Hosting.Diagnostics: Request finished "HTTP/1.1" "POST" "http"://"...:8096""""/ScheduledTasks/Running/7738148ffcd07979c7ceb148e06b3aed""" - 204 null null 2.0178ms
[2024-11-14 16:03:43.160 -08:00] [INF] [10] Microsoft.AspNetCore.Hosting.Diagnostics: Request starting "HTTP/1.1" "GET" "http"://"...:8096""""/ScheduledTasks""?IsEnabled=true" - null null
[2024-11-14 16:03:43.163 -08:00] [INF] [10] Microsoft.AspNetCore.Hosting.Diagnostics: Request finished "HTTP/1.1" "GET" "http"://"...:8096""""/ScheduledTasks""?IsEnabled=true" - 200 null "application/json; charset=utf-8" 3.1176ms
[2024-11-14 16:03:44.436 -08:00] [FTL] [1] : Failed to create/read logger configuration
System.ArgumentException: A source source must be provided. (Parameter 'source')
   at Serilog.Configuration.LoggerMinimumLevelConfiguration.Override(String source, LoggingLevelSwitch levelSwitch)
   at Serilog.Settings.Configuration.ConfigurationReader.<>c__DisplayClass11_1.<ApplyMinimumLevel>b__3(LoggerMinimumLevelConfiguration configuration, LoggingLevelSwitch levelSwitch)
   at Serilog.Settings.Configuration.ConfigurationReader.<>c__DisplayClass11_0.<ApplyMinimumLevel>g__ApplyMinimumLevelConfiguration|1(IConfigurationSection directive, Action`2 applyConfigAction)
   at Serilog.Settings.Configuration.ConfigurationReader.ApplyMinimumLevel(LoggerConfiguration loggerConfiguration)
   at Serilog.Settings.Configuration.ConfigurationReader.Configure(LoggerConfiguration loggerConfiguration)
   at Serilog.Configuration.LoggerSettingsConfiguration.Settings(ILoggerSettings settings)
   at Serilog.ConfigurationLoggerConfigurationExtensions.Configuration(LoggerSettingsConfiguration settingConfiguration, IConfiguration configuration, ConfigurationReaderOptions readerOptions)
   at Jellyfin.Server.Helpers.StartupHelpers.InitializeLoggingFramework(IConfiguration configuration, IApplicationPaths appPaths)

[...exited on signal 11 (no core dump - other error)...]

[2024-11-14 16:03:44.465 -08:00] [INF] [1] Main: Jellyfin version: "10.10.1"
[2024-11-14 16:03:44.469 -08:00] [INF] [1] Main: Environment Variables: ["[JELLYFIN_LOG_DIR, /var/db/jellyfin/log]"]
[2024-11-14 16:03:44.470 -08:00] [INF] [1] Main: Arguments: ["/usr/local/jellyfin/jellyfin.dll", "--datadir", "/var/db/jellyfin", "--cachedir", "/var/cache/jellyfin", "--ffmpeg", "/usr/local/bin/ffmpeg"]
[2024-11-14 16:03:44.470 -08:00] [INF] [1] Main: Operating system: "FreeBSD 14.1-RELEASE-p5 FreeBSD 14.1-RELEASE-p5 GENERIC"
[2024-11-14 16:03:44.470 -08:00] [INF] [1] Main: Architecture: X64
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: 64-Bit Process: True
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: User Interactive: True
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Processor count: 16
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Program data path: "/var/db/jellyfin"
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Log directory path: "/var/db/jellyfin/log"
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Config directory path: "/var/db/jellyfin/config"
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Cache path: "/var/cache/jellyfin"
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Temp directory path: "/tmp/jellyfin"
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Web resources path: "/usr/local/jellyfin/jellyfin-web"
[2024-11-14 16:03:44.471 -08:00] [INF] [1] Main: Application directory: "/usr/local/jellyfin/"
[2024-11-14 16:03:44.556 -08:00] [INF] [1] Emby.Server.Implementations.AppBase.BaseConfigurationManager: Setting cache path: "/var/cache/jellyfin"
[2024-11-14 16:03:44.585 -08:00] [INF] [1] Emby.Server.Implementations.ApplicationHost: Loading assemblies

[robn]

tl;dr bug in Skia, calling libjpeg incorrectly. I am writing a bug report for Skia right now, and will edit this comment with the link once I have it.

Actually, looking again, I think it's jpeg-turbo not quite being compatible with other libjpegs. I've filed a bug there: libjpeg-turbo/libjpeg-turbo#795.

Update 2024-11-19: jpeg-turbo has declined. Bug logged against Skia: https://issues.skia.org/issues/379669745

FWIW, I'm just a Jellyfin user, and do not have time to get involved anywhere beyond this. I'd be quite happy if Jellyfin could work around it somehow, though I recognise you're some distance away.

Relevant FreeBSD bug: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=282704

Debugging session follows.

---

Also seeing exactly this on FreeBSD 14.1 on upgrade from the packaged version.

I've been trying to debug this at the system level (I don't know any Jellyfin-specifics, so I started with what I know).

First, an aside: the docs for enabling debug logging seem a little off, yielding the Failed to create/read logger configuration error that @oychang reported. I ended up using this for my logging.json:

{
    "Serilog": {
        "MinimumLevel": {
            "Default": "Debug",
            "Override": {
            }
        }
    }
}

After requesting a scan, the last log lines before the restart are:

[2024-11-17 11:00:16.940 +11:00] [INF] [40] Emby.Server.Implementations.Library.LibraryManager: Validating media library
[2024-11-17 11:00:16.990 +11:00] [DBG] [40] Jellyfin.Drawing.ImageProcessor: Getting image size for item "AggregateFolder" "/var/db/jellyfin/metadata/library/f2/f27caa37e5142225cceded48f6553502/poster.jpg"
---
[2024-11-17 11:00:18.237 +11:00] [INF] [1] Main: Jellyfin version: "10.10.1"

If I remove the file in question, it regenerates it by whatever means, then crashes again:

[2024-11-17 10:50:44.637 +11:00] [INF] [17] Emby.Server.Implementations.Library.LibraryManager: Validating media library
[2024-11-17 10:50:44.663 +11:00] [DBG] [17] MediaBrowser.Providers.Folders.FolderMetadataService: "FolderImageProvider" reports change to "/var/db/jellyfin/root"
[2024-11-17 10:50:44.672 +11:00] [DBG] [17] MediaBrowser.Providers.Folders.FolderMetadataService: Running "FolderImageProvider" for "/var/db/jellyfin/root"
[2024-11-17 10:50:44.785 +11:00] [DBG] [17] Emby.Server.Implementations.Data.SqliteItemRepository: "GetItemList" query time (slow): 107.5595ms. Query: "select type,data,StartDate,EndDate,ChannelId,IsMovie,IsSeries,EpisodeTitle,IsRepeat,CommunityRating,CustomRating,IndexNumber,IsLocked,PreferredMetadataLanguage,PreferredMetadataCountryCode,Width,Height,DateLastRefreshed,Name,Path,PremiereDate,Overview,ParentIndexNumber,ProductionYear,OfficialRating,ForcedSortName,RunTimeTicks,Size,DateCreated,DateModified,guid,Genres,ParentId,Audio,ExternalServiceId,IsInMixedFolder,DateLastSaved,LockedFields,Studios,Tags,TrailerTypes,OriginalTitle,PrimaryVersionId,DateLastMediaAdded,Album,LUFS,NormalizationGain,CriticRating,IsVirtualItem,SeriesName,SeasonName,SeasonId,SeriesId,PresentationUniqueKey,InheritedParentalRatingValue,ExternalSeriesId,Tagline,ProviderIds,Images,ProductionLocations,ExtraIds,TotalBitrate,ExtraType,Artists,AlbumArtists,ExternalId,SeriesPresentationUniqueKey,ShowId,OwnerId from TypedBaseItems A where Images like '%Primary%' AND Guid in (select itemId from AncestorIds where AncestorId=@AncestorId) ORDER BY IsFolder ASC,SortName ASC LIMIT 1"
[2024-11-17 10:50:44.799 +11:00] [DBG] [17] MediaBrowser.Providers.Manager.ProviderManager: Saving image to "/var/db/jellyfin/metadata/library/f2/f27caa37e5142225cceded48f6553502/poster.jpg"
[2024-11-17 10:50:44.811 +11:00] [DBG] [18] Jellyfin.Drawing.ImageProcessor: Getting image size for item "AggregateFolder" "/var/db/jellyfin/metadata/library/f2/f27caa37e5142225cceded48f6553502/poster.jpg"
---
[2024-11-17 10:50:46.054 +11:00] [INF] [1] Main: Jellyfin version: "10.10.1"

This behaviour is consistent, allowing plenty of testing. I moved the file out of the way, and then compared with the new version. The both have the same sha256sum, which I suppose means its just downloaded from somewhere, or its generated in some deterministic way: poster.jpg

So I put ktrace() on it, to see if it's anything obviously related to the image, or if that's just the last debug line: kdump.txt

Not especially enlightening. Opens the file, does a bunch of 1K reads, and eventually does some kind of read to unmapped memory (ie, NULL deref or other invalid address).

 58164 154359 .NET TP Worker 0.000001473 CALL  F64  pread(0x21e,0x4937b1d2d0,0x400,0x55bf)
 58164 154359 .NET TP Worker 0.000001533 GIO   F64  fd 542 read 1024 bytes
       0x0000 0303 0303 0303 0303 0303 0303 0303 0303 0303 0303 0303 0303 0303  |..........................|
       0x001a 0303 0303 0303 0303 0303 0303 0303 0303 0303 0303 ffc0 0011 0805  |..........................|
       0x0034 9203 e803 0111 0002 1101 0311 01ff dd00 0400 7dff c401 a200 0000  |..................}.......|
...
       0x03c2 e2e0 0af5 db05 6d28 f328 7d3f 445f 236b 8ffe 39bf f6b5 5fdb 8a7c  |......m(.(}?D_#k..9..._..||
       0x03dc c74d 34e4 9af5 2046 aaeb 6f4e b6d2 a433 af93 d1eb 4d7f a34f fc74  |.M4... F..oN...3....M..O.t|
       0x03f6 ff00 927d d198 0f9f 4cbc                                          |...}....L.|

 58164 154359 .NET TP Worker 0.000001292 RET   F64  pread 1024/0x400
 58164 154359 .NET TP Worker 0.000013977 CALL  F64  mmap(0,0x1000,0x3<PROT_READ|PROT_WRITE>,0x1<MAP_SHARED>,0x9,0x46fb000)
 58164 154359 .NET TP Worker 0.000003617 RET   F64  mmap 34384502784/0x80179e000
 58164 154359 .NET TP Worker 0.000001392 CALL  F64  munmap(0x80179d000,0x1000)
 58164 154359 .NET TP Worker 0.000002064 RET   F64  munmap 0
 58164 154359 .NET TP Worker 0.000122403 PSIG  F64  SIGSEGV caught handler=0x80108e890 mask=0x0 code=SEGV_MAPERR

I wouldn't expect that from a managed language though (I mean, I have no actual idea) which suggests a native function or libary of some sort. So instead, I throw gdb at it, and hello:

Thread 17 ".NET TP Worker" received signal SIGSEGV, Segmentation fault.
Address not mapped to object.
[Switching to LWP 157330 of process 60013]
0x0000004923c0d5f0 in jpeg_core_output_dimensions () from /usr/local/lib/libjpeg.so.8
(gdb) bt
#0  0x0000004923c0d5f0 in jpeg_core_output_dimensions () from /usr/local/lib/libjpeg.so.8
#1  0x0000004923c0db59 in jpeg_calc_output_dimensions () from /usr/local/lib/libjpeg.so.8
#2  0x000000492398e614 in ?? () from /usr/local/lib/libSkiaSharp.so
#3  0x00000049235d6a60 in sk_codec_get_scaled_dimensions () from /usr/local/lib/libSkiaSharp.so
#4  0x000000080d42aff9 in ?? ()
#5  0x000000001f88190f in ?? ()
#6  0x0000000802643b68 in ?? () from /usr/local/jellyfin/libcoreclr.so
#7  0x00007fffde3aed90 in ?? ()
#8  0x0000000807d4d990 in ?? ()
#9  0x000000493a6dcf48 in ?? ()
#10 0x00007fffde3ac630 in ?? ()
#11 0x000000080d42aff9 in ?? ()
#12 0x00007fffde3ac6d0 in ?? ()
#13 0x000000088704a7a0 in ?? ()
#14 0x0000004923359f00 in ?? ()
#15 0x0000004922a1e000 in ?? ()
#16 0x0000000000000080 in ?? ()
#17 0x0000000000000000 in ?? ()

Quick disassembly shows that it's a null pointer deref.

Dump of assembler code for function jpeg_core_output_dimensions:
   0x0000004923c0d5e0 <+0>:	push   %rbp
   0x0000004923c0d5e1 <+1>:	mov    %rsp,%rbp
   0x0000004923c0d5e4 <+4>:	push   %rbx
   0x0000004923c0d5e5 <+5>:	push   %rax
   0x0000004923c0d5e6 <+6>:	mov    %rdi,%rbx
   0x0000004923c0d5e9 <+9>:	mov    0x238(%rdi),%rax
=> 0x0000004923c0d5f0 <+16>:	cmpl   $0x0,0x14(%rax)

(gdb) i reg
rax            0x0

So either libjpeg has a bug, or something is holding it wrong.

libjpeg here is the FreeBSD-packaged jpeg-turbo 3.0.4. Going to the source there (jdmaster.c:105):

jpeg_core_output_dimensions(j_decompress_ptr cinfo)
/* Do computations that are needed before master selection phase.
 * This function is used for transcoding and full decompression.
 */
{
#ifdef IDCT_SCALING_SUPPORTED
  int ci;
  jpeg_component_info *compptr;

  if (!cinfo->master->lossless) {

Strong indication there that cinfo->master here is NULL, since it's the first test in that function, and is sufficiently far into jpeglib.h that I can believe the 0x238 offset.

Caller is from the FreeBSD-packaged libskiasharp 2.88.3, but actually from the version of skia bundled with it. Following https://github.com/mono/SkiaSharp/tree/v2.88.3/externals, that brings is to the call to jpeg_calc_output_dimensions() at SkJpegCodec.cpp:277:

/*
 *  Calculate output dimensions based on the provided factors.
 *
 *  Not to be used on the actual jpeg_decompress_struct used for decoding, since it will
 *  incorrectly modify num_components.
 */
void calc_output_dimensions(jpeg_decompress_struct* dinfo, unsigned int num, unsigned int denom) {
    dinfo->num_components = 0;
    dinfo->scale_num = num;
    dinfo->scale_denom = denom;
    jpeg_calc_output_dimensions(dinfo);
}

"The actual jpeg_decompress_struct" smells a bit...

sk_codec_get_scaled_dimensions() isn't here directly, but it's easy to imagine that it's a dispatcher for various codecs. I'm getting tired, so I'm not going to prove that, just jump down the file a bit to where the problem almost certainly lies (SkJpegCodec.cpp:L310):

/*
 * Return a valid set of output dimensions for this decoder, given an input scale
 */
SkISize SkJpegCodec::onGetScaledDimensions(float desiredScale) const {
...
    // Set up a fake decompress struct in order to use libjpeg to calculate output dimensions
    jpeg_decompress_struct dinfo;
    sk_bzero(&dinfo, sizeof(dinfo));
    dinfo.image_width = this->dimensions().width();
    dinfo.image_height = this->dimensions().height();
    dinfo.global_state = fReadyState;
    calc_output_dimensions(&dinfo, num, denom);

So Skia is trying to fake a struct that is internal to libjpeg, initialising it "wrong", and and libjpeg blows up. Kinda poor form.

Looks like it's still that way on the head: SkJpegCodec.cpp:255 @ ade3669.

So I started writing a bug report against Skia, and was looking at the jpeg-turbo code again, and noticed part of the comment on jpeg_calc_output_dimensions():

 * Also note that it may be called before the master module is initialized!

If that's true, then maybe Skia isn't calling it wrong; maybe this fork of libjpeg is doing the wrong thing.

I'm not really sure what the canonical libjpeg is at this point, so I just picked the first one I found, mozjpeg. It seems like it's jpeg_calc_output_dimensions() and jpeg_core_output_dimensions() never steps outside of cinfo, so does not exhibit this fault. (jdmaster.c:91).

So I guess I'm writing a bug report against jpeg-turbo then, and possibly also letting FreeBSD know so that they can consider relinking the stack.

[ryannathans]

Looks like the freebsd guys have deployed a workaround to libskiasharp, deployed via package manager. The feature now works after libskiasharp: 2.88.3 -> 2.88.3_1

[felix920506]

closing this as it is an issue specific to the FreeBSD build, which is unsupported. Please report the issue to the maintainers of the FreeBSD build instead. If anyone is experiencing the same issue on Linux Windows or macOS please open a new report.