Evince crashes with _cairo_gstate_set_dash

Bug #1610714 reported by Jean-Louis Dupond
20
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Poppler
Unknown
Unknown
poppler (Ubuntu)
Fix Released
Medium
Unassigned
Xenial
Fix Released
Medium
Unassigned

Bug Description

When opening the following PDF in Evince (https://dl.ubnt.com/guides/edgemax/EdgeSwitch_ES-48_QSG.pdf), it crashes with the following backtrace:
Thread 7 "EvJobScheduler" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0x7fb17ef8d700 (LWP 11109)]
0x00007fb19c16c7b1 in _cairo_gstate_set_dash (gstate=0x7fb16c538d80, dash=0x0, num_dashes=2, offset=6.9366816791018826e-310) at ../../../../src/cairo-gstate.c:542
542 ../../../../src/cairo-gstate.c: Bestand of map bestaat niet.
(gdb) bt full
#0 0x00007fb19c16c7b1 in _cairo_gstate_set_dash (gstate=0x7fb16c538d80, dash=0x0, num_dashes=2, offset=6.9366816791018826e-310) at ../../../../src/cairo-gstate.c:542
        dash_total = 0
        on_total = 0
        off_total = 0
        i = 0
        j = 0
#1 0x00007fb19c15fa92 in cairo_set_dash (cr=0x5615ded8dc70, dashes=<optimized out>, num_dashes=<optimized out>, offset=<optimized out>) at ../../../../src/cairo.c:1080
        status = <optimized out>

Upstream seems to have fixed this already:
https://bugs.freedesktop.org/show_bug.cgi?id=62905

Revision history for this message
Jean-Louis Dupond (dupondje) wrote :

The following debdiff fixes the issue.

Revision history for this message
Jean-Louis Dupond (dupondje) wrote :

And for SRU:

[Impact]

Evince crashes while opening some PDF's.

[Test Case]

Open the PDF https://dl.ubnt.com/guides/edgemax/EdgeSwitch_ES-48_QSG.pdf and scroll to page 7 for example.
This crashes every time.

[Regression Potential]

Should be safe. Patch also got included upstream.

Revision history for this message
Jean-Louis Dupond (dupondje) wrote :

The version in Yakkety already includes this patch.
https://cgit.freedesktop.org/poppler/poppler/commit/?id=7d8dfb09d2b9d69d4e80838ce58fdbd091bce7ec

Was committed pre 0.43.

Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "fix.patch" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

tags: added: patch
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in poppler (Ubuntu):
status: New → Confirmed
Mathew Hodson (mhodson)
Changed in poppler (Ubuntu):
importance: Undecided → Medium
Revision history for this message
Julian Andres Klode (juliank) wrote :

Targetting to xenial and marking as released in yakkety as per comment #3

Changed in poppler (Ubuntu):
status: Confirmed → Fix Released
Revision history for this message
Julian Andres Klode (juliank) wrote :

Uploaded.

Revision history for this message
Julian Andres Klode (juliank) wrote :

And JFTR: I changed the version to 0.41.0-0ubuntu1.1 from -0ubuntu2.

Mathew Hodson (mhodson)
Changed in poppler (Ubuntu Xenial):
importance: Undecided → Medium
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Jean-Louis, or anyone else affected,

Accepted poppler into xenial-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/poppler/0.41.0-0ubuntu1.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in poppler (Ubuntu Xenial):
status: New → Fix Committed
tags: added: verification-needed
Revision history for this message
Bryan Quigley (bryanquigley) wrote :

Verified with both the PDF on this bug (going to page 7) and the one on my dup. Thanks!

tags: added: verification-done
removed: verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package poppler - 0.41.0-0ubuntu1.1

---------------
poppler (0.41.0-0ubuntu1.1) xenial; urgency=medium

  * debian/patches/fix-fillToStrokePathClip-crash-and-rendering.patch
    - Fix crash in _cairo_gstate_set_dash (LP: #1610714)

 -- Jean-Louis Dupond <email address hidden> Sun, 07 Aug 2016 18:45:07 +0200

Changed in poppler (Ubuntu Xenial):
status: Fix Committed → Fix Released
Revision history for this message
Martin Pitt (pitti) wrote : Update Released

The verification of the Stable Release Update for poppler has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.