[apport] evince crashed with SIGSEGV in poppler_attachment_save_to_callback()

Bug #94903 reported by Exelsion
92
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Poppler
Fix Released
Medium
evince (Ubuntu)
Fix Released
Medium
Ubuntu Desktop Bugs

Bug Description

Binary package hint: evince

Situation : I opened the 42.5 MB Cover_x86.pdf (obtainable from http://clete2.com/gentoocover/, it's a Gentoo DVD Cover) and Evince immediately crashed.
Steps to reproduce : probably opening the .pdf an x number of times, it opened just fine the second time around.
Version information : Evince 0.8.0, Poppler 0.5.4 (cairo)

ProblemType: Crash
Architecture: i386
Date: Thu Mar 22 22:01:42 2007
DistroRelease: Ubuntu 7.04
ExecutablePath: /usr/bin/evince
Package: evince 0.8.0-0ubuntu1
PackageArchitecture: i386
ProcCmdline: evince file:///home/vincenzo/Downloads/Firefox/Cover_x86.pdf
ProcCwd: /home/vincenzo
ProcEnviron:
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: evince
StacktraceTop:
 poppler_attachment_save_to_callback ()
 ?? ()
 ev_document_get_attachments ()
 ?? ()
 ?? ()
Uname: Linux Lohengrin 2.6.20-12-generic #2 SMP Sun Mar 18 03:07:14 UTC 2007 i686 GNU/Linux
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev scanner video

Revision history for this message
Exelsion (exelsion) wrote :
Changed in evince:
importance: Undecided → Medium
Revision history for this message
In , Sebastien Bacher (seb128) wrote :
Download full text (31.2 KiB)

The bug has been opened on https://launchpad.net/bugs/94903

"Binary package hint: evince

Situation : I opened the 42.5 MB Cover_x86.pdf (obtainable from http://clete2.com/gentoocover/, it's a Gentoo DVD Cover) and Evince immediately crashed.
Steps to reproduce : probably opening the .pdf an x number of times, it opened just fine the second time around.
Version information : Evince 0.8.0, Poppler 0.5.4 (cairo)
...
.
Thread 2 (process 17501):
#0 0xb76f68f0 in FlateStream::getChar (this=0x83c1e58) at Stream.cc:3941
 c = <value optimized out>
#1 0xb76f2320 in ImageStream::getLine (this=0x8364a68) at Stream.cc:381
 buf = <value optimized out>
 bits = <value optimized out>
 c = <value optimized out>
 i = 9338
#2 0xb77be0a2 in CairoOutputDev::drawImage (this=0x8312e90, state=0x83bed40, ref=0xb6997c94, str=0x83c1e58, width=4271, height=2876, colorMap=0x83ca398, maskColors=0x0,
    inlineImg=0) at CairoOutputDev.cc:843
 buffer = (unsigned char *) 0xb256a008 "\221¶Í"
 image = <value optimized out>
 pattern = <value optimized out>
 y = 15
 imgStr = (ImageStream *) 0x8364a68
 pix = <value optimized out>
 i = <value optimized out>
 matrix = {xx = 5.2898396800107751e-269, yx = -1.1155082287757394e-45, xy = -1.8081873687300524e-41, yy = 4.321423660979218e-269, x0 = -1.2866916418111052e-41,
  y0 = -1.8081874039428065e-41}
#3 0xb76a98f6 in Gfx::doImage (this=0x8366688, ref=0xb6997c94, str=0x83c1e58, inlineImg=0) at Gfx.cc:3223
 dict = <value optimized out>
 maskDict = <value optimized out>
 width = 4271
 height = 2876
 bits = 8
 maskBits = <value optimized out>
 csMode = streamCSNone
 mask = 0
 invert = <value optimized out>
 colorSpace = (class GfxColorSpace *) 0x83b29b8
 maskColorSpace = <value optimized out>
 colorMap = (GfxImageColorMap *) 0x83ca398
 maskColorMap = <value optimized out>
 maskObj = {type = objNull, {booln = -1208168460, intg = -1208168460, real = -1.9287042025283492e-41, string = 0xb7fccff4, name = 0xb7fccff4 "(\237\001",
    array = 0xb7fccff4, dict = 0xb7fccff4, stream = 0xb7fccff4, ref = {num = -1208168460, gen = -1216683560}, cmd = 0xb7fccff4 "(\237\001"}}
 smaskObj = {type = objNull, {booln = -1218064204, intg = -1218064204, real = -7.6653035788848368e-42, string = 0xb765d0b4, name = 0xb765d0b4 "", array = 0xb765d0b4,
    dict = 0xb765d0b4, stream = 0xb765d0b4, ref = {num = -1218064204, gen = -1218093532}, cmd = 0xb765d0b4 ""}}
 maskColors = {4096, 0, 320, 160, -1223096576, 0, 385, 0, 44589056, 0, 0, 44593152, 0, -1223880783, 0, -1231455672, -1231455648, -1231455640, 13, 138157336, -1223004172,
  -1223880783, 104, 40, -1223096576, -1222999776, 138145712, 138146192, 138145712, -1223880783, 24, -1208239397, -1223096676, 5822, -1226342412, 138146192, 0, -1223878463, 584,
  104, -1223096576, -1208168460, -1230134008, 26, -1231455448, -1208238270, 40, 0, -1223096676, -1222999776, 153, 211026, -1231455500, -1231455500, -1231455260, -837507378,
  -1216684000, 79, -1218106812, -1218114144, -1218044048, -837507378, -1218044020, -1218044044}
 maskWidth = <value optimized out>
 maskHeight = <value optimized out>
 maskInvert = <value optimized out>
 maskStr = <value optimized out>
 obj1 = {type = objNone, {booln = 138095048, intg = 1...

Revision history for this message
Apport retracing service (apport) wrote : Symbolic stack trace

StacktraceTop:pdf_document_get_attachments (document=0x82d7940) at ev-poppler.cc:366
ev_document_get_attachments (document=0x82d7940) at ev-document.c:228
ev_sidebar_attachments_set_document (page=0x81aaec0, document=0x82d7940) at ev-sidebar-attachments.c:624
ev_sidebar_set_document (sidebar=0x81ade30, document=0x82d7940) at ev-sidebar.c:507

Revision history for this message
Apport retracing service (apport) wrote : Symbolic threaded stack trace
Revision history for this message
Sebastien Bacher (seb128) wrote :

Thanks for your bug report. This bug has been reported to the developers of the software. You can track it and make comments here: https://bugs.freedesktop.org/show_bug.cgi?id=10386

Changed in evince:
assignee: nobody → desktop-bugs
status: Unconfirmed → Confirmed
Changed in poppler:
status: Unknown → Confirmed
Changed in poppler:
status: Confirmed → Triaged
Revision history for this message
In , Sebastien Bacher (seb128) wrote :
Revision history for this message
In , Carlos Garcia Campos (carlosgc) wrote :

I think they are different issues. The first one was a bug in evince that we already fixed some time ago. The second looks like a broken pdf file, it contains a FileSpec object with an empty EF dictionary:

4205 0 obj <</UF(C1.jpg)/F(C1.jpg)/EF<<>>/Desc()/Type/Filespec>> endobj

I'd say this is wrong . . .

In any case we shouldn't crash when EmbFile contains a null stream. Albert, does this make qt frontend crash too? or do I mark this bug as glib only?

Revision history for this message
In , Sebastien Bacher (seb128) wrote :

should this bug be closed if the issue was a fixed evince one and a new one opened about the new crash?

Revision history for this message
Sebastien Bacher (seb128) wrote :

upstream says the issue was an evince one and has been fixed since

affects: poppler (Ubuntu) → evince (Ubuntu)
Changed in evince (Ubuntu):
status: Triaged → Fix Released
Revision history for this message
In , Albert Astals Cid (aacid) wrote :

Crashes too on the Qt frontend, the question is, should we "stop" reporting the Embedded file from the core when we realize it's not a valid one or still report it and fail when trying to save it.

Adobe does the later, but for us would be easier the first and for the user the result is the same as he can't extract the file.

But still i think we should go fixing the frontends, what do you say?

Revision history for this message
In , Carlos Garcia Campos (carlosgc) wrote :

An attachment that can't be opened/saved/... is useless, so I think we might just show an error message saying that an invalid embedded file has been found and ignore such attachment.

Revision history for this message
In , Albert Astals Cid (aacid) wrote :

Carlos: At the end Pino and me think that mimicking Adobe's behaviour is the best so i've added a isOk() method to EmbFile in poppler core you should use in the glib frontend to avoid the crash.

Revision history for this message
In , Carlos Garcia Campos (carlosgc) wrote :

Ok, fixed in glib too. Thanks!

Changed in poppler:
status: Confirmed → Fix Released
Changed in poppler:
importance: Unknown → Medium
Changed in poppler:
importance: Medium → Unknown
Changed in poppler:
importance: Unknown → Medium
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.