Evince crashes with "bogus memory allocation size" error

[Alex Chekholko]

Viewing certaing pages in a PDF makes evince crash with that error. The PDF is the "Agile Web Developement with Rails: Second Edition" Beta Book from
http://pragmaticprogrammer.com/

I was reading the book, and when I got to p.296 Evince crashed without an error message. Double-clicking on the file again makes it open to the same page and crash. If I launch evince from the command line and then open the file, it prints the message "Bogus memory allocation size" to (I assume) stderr.

I found another bug report about this issue: https://bugs.freedesktop.org/show_bug.cgi?id=6881

[Albert Astals Cid (aacid)]

"It only crashes when evince is maximised."

That would seem to me that is an evince bug and not a poppler one, but without
the document there's nothing to be done.

[Alex Chekholko (alex-chekholko)]

I have just encountered the same bug and also filed it here:
https://launchpad.net/distros/ubuntu/+source/evince/+bug/51538

[Alex Chekholko (alex-chekholko)]

Viewing certaing pages in a PDF makes evince crash with that error. The PDF is the "Agile Web Developement with Rails: Second Edition" Beta Book from
http://pragmaticprogrammer.com/

I was reading the book, and when I got to p.296 Evince crashed without an error message. Double-clicking on the file again makes it open to the same page and crash. If I launch evince from the command line and then open the file, it prints the message "Bogus memory allocation size" to (I assume) stderr.

I found another bug report about this issue: https://bugs.freedesktop.org/show_bug.cgi?id=6881

[Jim Menard (jimm-io)]

I see the same problem with the same file (not sure about the page number). Here is a workaround: delete the line in ~/.gnome2/evince/ev-metadata.xml that refers to the file that is crashing. The next time you open the file, evince won't crash because it won't try to jump to the same page with the same settings.

[Daniel Holbach (dholbach)]

Thanks for your bug report. Could you please try to get a backtrace by running
   gdb evince
   (gdb) run
   .... open the page that makes it crash
   ....
   (gdb) thread apply all bt

and copy the output to a comment.

[Alex Chekholko (alex-chekholko)]

   gdb evince
   (gdb) run
   .... open the page that makes it crash
   ....
   (gdb) thread apply all bt

I tried this, there is no output, just a gdb prompt again.

[Sebastien Bacher (seb128)]

It's not crashing but just exiting. Maybe you could install valgrind and run "valgrind evince example.pdf" and get a log about the issue? Do you have some public example to point or attach to the bug page?

[Sebastien Bacher (seb128)]

No reply, closing the bug. Feel free to reopen with the asked details if you still get the issue

[Scott (sworley)]

A publicly accessible .pdf that triggers this error: http://nlp.stanford.edu/IR-book/pdf/irbookonlinereading.pdf . Note: this document will probably be updated in place, and redistribution is not permitted, so this is potentially a time-limited example.

The problem area is on page 59.

Viewing this page in 'fit page width' mode with a small window yields a lot of "Error: Bad bounding box in Type 3 glyph" messages. Slowly increasing the window size causes evince to exit with the message "Out of memory". Maximizing the window or scrolling to page 59 in a large or maximized window causes evince to exit with the message "Bogus memory allocation size"

See attached gdb backtrace from a breakpoint on exit(). T3FontCache() in libpoppler calls gmallocn(8,284192164).

(Note: Trace is not from an ubuntu install. Versions: evince-2.22.0, poppler-0.6.1 )

[Alex Chekholko (alex-chekholko)]

I tried to reproduce this, but was unable to.

I tried page 59 of the PDF, and page 59 of the manuscript (page 94 of the PDF).

Stock Ubuntu 7.10 , evince 2.20.1

document:
$ md5sum /tmp/irbookonlinereading.pdf
5612fc4ea997806d6dd8ad2929d4fd2d /tmp/irbookonlinereading.pdf

On Fri, Apr 4, 2008 at 7:07 PM, Scott <email address hidden> wrote:
> A publicly accessible .pdf that triggers this error:
> http://nlp.stanford.edu/IR-book/pdf/irbookonlinereading.pdf . Note:
> this document will probably be updated in place, and redistribution is
> not permitted, so this is potentially a time-limited example.
>
> The problem area is on page 59.
>
> Viewing this page in 'fit page width' mode with a small window yields a
> lot of "Error: Bad bounding box in Type 3 glyph" messages. Slowly
> increasing the window size causes evince to exit with the message "Out
> of memory". Maximizing the window or scrolling to page 59 in a large or
> maximized window causes evince to exit with the message "Bogus memory
> allocation size"
>
> See attached gdb backtrace from a breakpoint on exit(). T3FontCache()
> in libpoppler calls gmallocn(8,284192164).
>
> (Note: Trace is not from an ubuntu install. Versions: evince-2.22.0,
> poppler-0.6.1 )
>
> ** Attachment added: "gdb backtrace of the "Bogus memory allocation size" error"
> http://launchpadlibrarian.net/13123201/poppler-bogus-memory-allocation-size-backtrace
>
>
> --
> Evince crashes with "bogus memory allocation size" error
> https://bugs.launchpad.net/bugs/51538
> You received this bug notification because you are a direct subscriber
> of the bug.
>

[Scott (sworley)]

Ah ha: The problem goes away when I build poppler-bindings with cairo support.

Instead, I get a number of unrelated (different places in the document) and apparently harmless "cairo context error: NULL pointer" messages.

[Albert Astals Cid (aacid)]

Any chance you can try with a newer poppler?

[Adam Buchbinder (adam-buchbinder)]

It's definitely a Poppler issue. I can reproduce this with poppler 0.11.1 thusly:

$ pdfimages --version
pdfimages version 0.11.1
[snip]
$ pdfimages 1972.pdf tmp
Error (147774): 3 extraneous bytes after segment
Bogus memory allocation size

The PDF in question is 1972.pdf; it's linked to from the following URL:

http://doddcenter.uconn.edu/collections/nutmeg/index.htm

I'm not attaching it here because it's 18MB, and also because I'm not sure how redistributable it is. The file I have was last modified Thu, 11 Jun 2009 20:08:45 GMT, and has md5sum 9ee38b8f90dbe343163f9927d37c35bd.

[Adam Buchbinder (adam-buchbinder)]

This is still present on Jaunty, with poppler-utils 0.10.5-1ubuntu2.2. I've sent a testcase upstream; as this can be reproduced with pdfimages (part of poppler-utils), I'm reassigning this to poppler.

[Albert Astals Cid (aacid)]

Why was this posted here? What relation does this has with the first post?

[Albert Astals Cid (aacid)]

The first report in this bug never seemed a poppler bug and the second one works here on poppler 0.12 so i'm closing the bug.

If any of you still have problems after updating to poppler >= 0.12 please open a new bug and explain it again.

[Sebastien Bacher (seb128)]

the issue should be fixed in karmic closing the bug, you can open a new bug if you still have issues there though