segfault on saving pdf

[Florian Klink]

Simple-Scan crashes when trying to save a pdf

#0 0x0000555555a12800 in ()
#1 0x00007ffff6c2d216 in deflateInit2_ () at /usr/lib/libz.so.1
#2 0x00007ffff6c2d45e in deflateInit_ () at /usr/lib/libz.so.1
#3 0x000055555556835d in book_save ()
#4 0x0000555555586dd8 in ()
#5 0x00007ffff62811a4 in () at /usr/lib/libgobject-2.0.so.0
#6 0x00007ffff629b8cd in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#7 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#8 0x00007ffff75f5d6d in () at /usr/lib/libgtk-3.so.0
#9 0x00007ffff75f5dd5 in () at /usr/lib/libgtk-3.so.0
#10 0x00007ffff6280f75 in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#11 0x00007ffff629295c in () at /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff629bbdc in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#13 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#14 0x00007ffff75f41d0 in () at /usr/lib/libgtk-3.so.0
#15 0x00007fffeff4d1c8 in ffi_call_unix64 () at /usr/lib/libffi.so.6
#16 0x00007fffeff4cc2a in ffi_call () at /usr/lib/libffi.so.6
#17 0x00007ffff6281c8a in g_cclosure_marshal_generic_va () at /usr/lib/libgobject-2.0.so.0
#18 0x00007ffff62811a4 in () at /usr/lib/libgobject-2.0.so.0
#19 0x00007ffff629b8cd in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#20 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#21 0x00007ffff76afbd1 in () at /usr/lib/libgtk-3.so.0
#22 0x00007ffff6283d27 in g_cclosure_marshal_VOID__BOXEDv () at /usr/lib/libgobject-2.0.so.0
#23 0x00007ffff62811a4 in () at /usr/lib/libgobject-2.0.so.0
#24 0x00007ffff629b8cd in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#25 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#26 0x00007ffff76ace9e in () at /usr/lib/libgtk-3.so.0
#27 0x00007ffff76ae4cb in () at /usr/lib/libgtk-3.so.0
#28 0x00007ffff76b114d in () at /usr/lib/libgtk-3.so.0
#29 0x00007ffff767e57e in gtk_event_controller_handle_event () at /usr/lib/libgtk-3.so.0
#30 0x00007ffff784339b in () at /usr/lib/libgtk-3.so.0
#31 0x00007ffff76f8bf1 in () at /usr/lib/libgtk-3.so.0
#32 0x00007ffff62811a4 in () at /usr/lib/libgobject-2.0.so.0
#33 0x00007ffff629b3a1 in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#34 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#35 0x00007ffff784563c in () at /usr/lib/libgtk-3.so.0
#36 0x00007ffff76f5bce in () at /usr/lib/libgtk-3.so.0
#37 0x00007ffff76f7c3e in gtk_main_do_event () at /usr/lib/libgtk-3.so.0
#38 0x00007ffff7209d65 in () at /usr/lib/libgdk-3.so.0
#39 0x00007ffff723adf2 in () at /usr/lib/libgdk-3.so.0
#40 0x00007ffff5fa77b7 in g_main_context_dispatch () at /usr/lib/libglib-2.0.so.0
#41 0x00007ffff5fa7a20 in () at /usr/lib/libglib-2.0.so.0
#42 0x00007ffff5fa7acc in g_main_context_iteration () at /usr/lib/libglib-2.0.so.0
#43 0x00007ffff6ede00d in g_application_run () at /usr/lib/libgio-2.0.so.0
#44 0x0000555555576243 in simple_scan_main ()
#45 0x00007ffff5258511 in __libc_start_main () at /usr/lib/libc.so.6
#46 0x0000555555564dca in _start ()

[Florian Klink (flokli)]

Archlinux amd64 here, simple-scan 3.24.1

[Florian Klink (flokli)]

Note there is still a (damaged) PDF being written, which looks like this:

%PDF-1.3
%âãÏÓ
1 0 obj
<<
/Type /Catalog
/Metadata 2 0 R
/MarkInfo << /Marked true >>
/StructTreeRoot 8 0 R
/Pages 3 0 R
>>
endobj

2 0 obj
<<
/Type /Metadata
/Subtype /XML
/Length 711
>>
stream
<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
         xmlns:xmp="http://ns.adobe.com/xap/1.0/">
  <rdf:Description rdf:about=""
                   xmlns:pdfaid="http://www.aiim.org/pdfa/ns/id/"
                   xmlns:xmp="http://ns.adobe.com/xap/1.0/">
    <pdfaid:part>1</pdfaid:part>
    <pdfaid:conformance>A</pdfaid:conformance>
    <xmp:CreatorTool>Simple Scan 3.24.1</xmp:CreatorTool>
    <xmp:CreateDate>2017-04-30T20:52:20+02:00</xmp:CreateDate>
    <xmp:ModifyDate>2017-04-30T20:52:20+02:00</xmp:ModifyDate>
    <xmp:MetadataDate>2017-04-30T20:52:20+02:00</xmp:MetadataDate>
  </rdf:Description>
</rdf:RDF>
<?xpacket end="w"?>
endstream
endobj

3 0 obj
<<
/Type /Pages
/Kids [ 5 0 R ]
/Count 1
>>
endobj

[WebDawg (webdawg)]

Same issue, same system. Archlinux Rolling Release, updated just an hour ago. Saves jpg's just fine:

gdb simple-scan
GNU gdb (GDB) 7.12.1
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from simple-scan...(no debugging symbols found)...done.
(gdb) run
Starting program: /usr/bin/simple-scan
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe9f1a700 (LWP 7273)]
[New Thread 0x7fffe9719700 (LWP 7274)]
[New Thread 0x7fffe8cfc700 (LWP 7275)]
[New Thread 0x7fffdbfff700 (LWP 7276)]
[New Thread 0x7fffdb7fe700 (LWP 7277)]
[New Thread 0x7fffdaffd700 (LWP 7278)]
[New Thread 0x7fffc7161700 (LWP 7279)]
[New Thread 0x7fffbe269700 (LWP 7280)]
[Thread 0x7fffbe269700 (LWP 7280) exited]
[New Thread 0x7fffbe269700 (LWP 7284)]
[New Thread 0x7fffbda68700 (LWP 7285)]
[New Thread 0x7fffbd267700 (LWP 7287)]
[New Thread 0x7fffbca66700 (LWP 7288)]
[New Thread 0x7fffaffff700 (LWP 7289)]
[Thread 0x7fffbd267700 (LWP 7287) exited]
[Thread 0x7fffaffff700 (LWP 7289) exited]
[Thread 0x7fffbda68700 (LWP 7285) exited]
[Thread 0x7fffbe269700 (LWP 7284) exited]

Thread 1 "simple-scan" received signal SIGSEGV, Segmentation fault.

bt:

(gdb) bt
#0 0x0000000000784b00 in ()
#1 0x00007ffff6c2d216 in deflateInit2_ () at /usr/lib/libz.so.1
#2 0x00007ffff6c2d45e in deflateInit_ () at /usr/lib/libz.so.1
#3 0x0000000000412048 in book_save ()
#4 0x000000000042df51 in ()
#5 0x00007ffff6280f75 in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#6 0x00007ffff6292f82 in () at /usr/lib/libgobject-2.0.so.0
#7 0x00007ffff629bbdc in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#8 0x00007ffff629c46b in g_signal_emit_by_name () at /usr/lib/libgobject-2.0.so.0
#9 0x00007ffff62811a4 in () at /usr/lib/libgobject-2.0.so.0
#10 0x00007ffff629b8cd in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#11 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#12 0x00007ffff75f5d6d in () at /usr/lib/libgtk-3.so.0
#13 0x00007ffff75f5dd5 in () at /usr/lib/libgtk-3.so.0
#14 0x00007ffff6280f75 in g_closure_invoke () at /usr/lib/libgobject-2.0.so.0
#15 0x00007ffff629295c in () at /usr/lib/libgobject-2.0.so.0
#16 0x00007ffff629bbdc in g_signal_emit_valist () at /usr/lib/libgobject-2.0.so.0
#17 0x00007ffff629bfbf in g_signal_emit () at /usr/lib/libgobject-2.0.so.0
#18 0x00007ffff75f41d0 in () at /usr/lib/libgtk-3.so.0
#19 0x00007fffeff4d1c8 in ffi_call_unix64 () at /usr/lib/libffi.so.6
#20 0x00007fffeff4cc2a in ffi_call () at /usr/l...

[WebDawg (webdawg)]

Bug in archlinux has been opened also: https://bugs.archlinux.org/task/53892

[Robert Ancell (robert-ancell)]

Weird, the traceback shows the crash in the zlib initialization code, but we haven't changed anything there recently / the code looks correct.

[WebDawg (webdawg)]

You think the lib was updated?

[Jan Steffens (heftig)]

This seems to be an issue with vala 0.36, which does not initialize (zero) the z_stream passed into deflateInit. A minimal test program shows this:

void main () {
  var stream = ZLib.DeflateStream (ZLib.Level.BEST_COMPRESSION);
}

Compiled with "valac --pkg zlib -C", vala 0.36 produces "z_stream stream;" and vala 0.34 produces "z_stream stream = {0};".

[Jan Steffens (heftig)]

https://bugzilla.gnome.org/show_bug.cgi?id=782056

[Jan Steffens (heftig)]

vala 0.36.3 fixes this, now.