atril-thumbnailer crashed with SIGSEGV in cmsGetColorSpace()

[Sora Célestinia]

atril-thumbnailer crashed with SIGSEGV in cmsGetColorSpace()

ProblemType: Crash
DistroRelease: Ubuntu 16.04
Package: atril 1.12.2-1
ProcVersionSignature: Ubuntu 4.4.0-45.66-generic 4.4.21
Uname: Linux 4.4.0-45-generic x86_64
ApportVersion: 2.20.1-0ubuntu2.1
Architecture: amd64
CrashCounter: 1
CurrentDesktop: MATE
Date: Sat Oct 22 09:43:08 2016
ExecutablePath: /usr/bin/atril-thumbnailer
InstallationDate: Installed on 2016-05-14 (160 days ago)
InstallationMedia: Ubuntu-MATE 16.04 LTS "Xenial Xerus" - Release amd64 (20160420.1)
ProcCmdline: atril-thumbnailer -s 128 file:///home/username/Documents/jedi_complaint.pdf /tmp/.mate_desktop_thumbnail.8JDPPY
SegvAnalysis:
 Segfault happened at: 0x7fdcb0258990 <cmsGetColorSpace>: mov 0x50(%rdi),%eax
 PC (0x7fdcb0258990) ok
 source "0x50(%rdi)" (0x00000050) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading NULL VMA
Signal: 11
SourcePackage: atril
StacktraceTop:
 cmsGetColorSpace () from /usr/lib/x86_64-linux-gnu/liblcms2.so.2
 GfxICCBasedColorSpace::parse(Array*, OutputDev*, GfxState*, int) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.58
 GfxColorSpace::parse(GfxResources*, Object*, OutputDev*, GfxState*, int) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.58
 Page::loadThumb(unsigned char**, int*, int*, int*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.58
 poppler_page_get_thumbnail () from /usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
Title: atril-thumbnailer crashed with SIGSEGV in cmsGetColorSpace()
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm cdrom dip lpadmin plugdev sambashare sudo wireshark

[Apport retracing service (apport)]

StacktraceTop:
 cmsGetColorSpace (hProfile=0x0) at cmsio0.c:926
 GfxICCBasedColorSpace::parse(Array*, OutputDev*, GfxState*, int) () from /tmp/apport_sandbox_bXFwbg/usr/lib/x86_64-linux-gnu/libpoppler.so.58
 GfxColorSpace::parse(GfxResources*, Object*, OutputDev*, GfxState*, int) () from /tmp/apport_sandbox_bXFwbg/usr/lib/x86_64-linux-gnu/libpoppler.so.58
 Page::loadThumb(unsigned char**, int*, int*, int*) () from /tmp/apport_sandbox_bXFwbg/usr/lib/x86_64-linux-gnu/libpoppler.so.58
 poppler_page_get_thumbnail () from /tmp/apport_sandbox_bXFwbg/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Vlad Orlov (monsta)]

Uploaded a reproducer for the crash. Will upload the patch as well later.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Debdiff for Xenial to fix the crash" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Michael Terry (mterry)]

Thanks for adapting the patch for Ubuntu, Vlad! I've uploaded to zesty.

[Launchpad Janitor (janitor)]

This bug was fixed in the package poppler - 0.44.0-3ubuntu3

---------------
poppler (0.44.0-3ubuntu3) zesty; urgency=medium

  * debian/patches/proper-init.patch:
    - Fix crashes in atril's and evince's thumbnailers on some PDFs
      (LP: #1635812). Patch by Marek Kasik.

 -- Vlad Orlov <email address hidden> Sun, 23 Oct 2016 21:04:55 +0300

[Vlad Orlov (monsta)]

Thanks. Can anyone add entries for Xenial and Yakkety please?

I'll try to find some time to add description for SRU later...

[madbiologist (me-again)]

Has this patch been submitted upstream?

[madbiologist (me-again)]

I just read the upstream bug report. The patch has been taken from that report, but has not yet been accepted by upstream. Perhaps we should revert and wait?

[Rafael David Tinoco (rafaeldtinoco)]

@Sponsors

(Yakkety) Facing intermittent seg faults in multiple PDFs here. If opening it with strace it rarely occurs, suggesting it is a timing/sync issue.

Program terminated with signal SIGSEGV, Segmentation fault.
#0 0x00007f3e05ed1940 in cmsGetColorSpace () from /usr/lib/x86_64-linux-gnu/liblcms2.so.2
[Current thread is 1 (Thread 0x7f3e06ffb700 (LWP 6665))]
(gdb) info threads
  Id Target Id Frame
* 1 Thread 0x7f3e06ffb700 (LWP 6665) 0x00007f3e05ed1940 in cmsGetColorSpace ()

Foud this bug, the fix looks good for me, fixed the issue for my case.

I have an easy way to verify it when it lands -proposed, if needed.

Thank you!

Rafael

[Vlad Orlov (monsta)]

BTW, the patch is finally accepted upstream, it's available in poppler 0.50 (though neither Debian nor Ubuntu picked that version yet). There's a correction for this patch as well in the repo.

Patch:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=9b016440725de086fa87fcbf776e27acee2c01b7

Correction:
https://cgit.freedesktop.org/poppler/poppler/commit/?id=1511523450f40b539fb1d58950a907f3712fd5c7

Looks like it does no harm, so maybe that correction should be added to Ubuntu patches as well.