Debug log created by Adobe Reader browser plugin (nppdf.so)

Bug #986841 reported by Martin Kalén on 2012-04-22
868
This bug affects 195 people
Affects Status Importance Assigned to Milestone
NULL Project
Undecided
Unassigned
acroread (Ubuntu)
Low
Unassigned

Bug Description

Steps to reproduce:
1. Start Firefox (do this from the command-line to get a specific working-directory since the log is saved relative to the FF working dir)
2. Open a PDF, e.g. http://partners.adobe.com/public/developer/en/xml/AdobeXMLFormsSamples.pdf
3. Close Firefox

Result: In the working directory from step 1 there will be a file called "C:\nppdf32Log\debuglog.txt" (yes, this Windows-like path will be present on a Linux filesystem)

Exected result: No debug log should be produced.

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 11.10
Release: 11.10
Codename: oneiric

$ uname -a
Linux xpc 3.0.0-17-generic #30-Ubuntu SMP Thu Mar 8 20:45:39 UTC 2012 x86_64 x86_64 x86_64 GNU/Linux

$ dpkg -l | grep acroread
ii acroread 9.5.1-1oneiric1 Adobe Reader
ii acroread-common 9.5.1-1oneiric1 Adobe Reader - Common Files

$ apt-cache policy acroread
acroread:
  Installerad: 9.5.1-1oneiric1
  Kandidat: 9.5.1-1oneiric1
  Versionstabell:
 *** 9.5.1-1oneiric1 0
        500 http://archive.canonical.com/ubuntu/ oneiric/partner amd64 Packages
        100 /var/lib/dpkg/status

Strings reveal that someone probably forgot some Windows-constant and debug flag in the binary:
$ strings /opt/Adobe/Reader9/Browser/intellinux/nppdf.so | grep -i debug
UnixDebugWriteToFile
C:\nppdf32Log\debuglog.txt
ACRODEBUG
ACRO_NPPDF_DEBUG_FILE

See also https://bugs.gentoo.org/show_bug.cgi?id=412051

I have reported this bug to Adobe but they don't seem to have a public bug tracker for Adobe Reader. Reported at https://www.adobe.com/cfusion/mmform/index.cfm?name=wishform
Response: "Thanks for your feedback! Requests and suggestions from our customers are what help us to continue creating cutting-edge, world-class software. Due to the volume of submissions we receive, responses to inquiries are generally not possible. However, we may contact you if we need clarification on your submission."

Is this something that only Adobe can fix or is it created during Canonical partner packaging?

Martin Kalén (martin-kalen) wrote :

Tried the following work-arounds
A) set ACRODEBUG environment variable to 0
export ACRODEBUG=0

B) set ACRODEBUG environment variable to false
export ACRODEBUG=false

C) set ACRO_NPPDF_DEBUG_FILE to /dev/null
export ACRO_NPPDF_DEBUG_FILE=/dev/null

D) ACRO_NPPDF_DEBUG_FILE=/dev/null in /etc/environment

Unfortunately, neither helped.

summary: - Debug log created by the browser plugin (nppdf.so)
+ Debug log created by Adobe Reader browser plugin (nppdf.so)
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in acroread (Ubuntu):
status: New → Confirmed

The file is also created when opening PDFs in the Konqueror browser (at least on Trinity Desktop Environment). A workaround is to use Okteta or another binary/hex editor to modify /opt/Adobe/Reader9/Browser/intellinux/nppdf.so and replace C:\nppdf32Log\debuglog.txt with /dev/null (and trailing NULs to overwrite the remaining characters).

Harry Willis (hwillis19) wrote :

It should be noted that in Firefox (tested in 12.0), the necessary nppdf plugin is located in /usr/lib/firefox-addons/plugins:

$ locate nppdf
/home/harry/C:\nppdf32Log\debuglog.txt
/opt/Adobe/Reader9/Browser/intellinux/nppdf.so
/usr/lib/firefox-addons/plugins/nppdf.so
/usr/lib/mozilla/plugins/nppdf.so

The fix described in #3 above will have no effect in Firefox unless the file edited is /usr/lib/firefox-addons/plugins/nppdf.so (of course, there's no harm in searching for all instances of the plugin and editing them all)

Adam Porter (alphapapa) wrote :

I've no idea how this happened, but I just found this "C:\nppdf32Log\debuglog.txt" in the directory I'm building a kernel in. It wasn't there, and then suddenly it was. Rather annoying!

Cody Nybo (cmnybo) wrote :

The hack in post #3 worked for me. I am using firefox 13 and didn't find the file anywhere other than in /opt.
It was rather annoying that the file kept showing up even with the plugin disabled in firefox.

As a temporary workaround I disabled the Adobe Reader plugin and installed the following extension to display pdf files:

https://addons.mozilla.org/en-US/firefox/addon/pdfjs/

Harry Willis (hwillis19) wrote :

alphapapa, I've just had a look into this. The acroread package (version 9.5.1) does intend to install a copy of the plugin to /usr/lib/firefox/plugins (symlinked to /usr/lib/firefox-addons/plugins) - this is triggered by a postinst trigger to /opt/Adobe/Reader9/install_browser_plugin. However, this script only copies the plugin across if `uname -m | cut -c 1` returns "i" - in other words, it's looking for an i386/i686 architecture to be returned by uname, whereas if it sees something different (eg. x86_64 or amd64) it will behave differently and try to use nspluginwrapper, which is not installed by default.

(I'm running 32-bit Precise on a 64-bit processor, hence i686 is returned for me.)

You can tell whether or not this has happened by seeing if the Adobe Reader config file that's built by postinst contains instructions to remove the plugins from subsidiary locations on uninstall, which implies that they were copied there by install_browser_plugin:

$ cat /opt/Adobe/Reader9/Reader/GlobalPrefs/.config
remove /usr/lib/firefox/plugins/nppdf.so
remove /usr/lib/firefox/plugins/nppdf.so
remove /usr/lib/firefox-addons/plugins/nppdf.so
remove /usr/lib/mozilla/plugins/nppdf.so
remove /usr/lib/firefox/plugins/nppdf.so
remove /usr/lib/firefox/plugins/nppdf.so
remove /usr/lib/firefox-addons/plugins/nppdf.so
remove /usr/lib/mozilla/plugins/nppdf.so

The functional end result appears to be the same - after all, your acroread install clearly does work as a Firefox plugin from its /opt location, although exactly how Firefox knows to look there, I'm not sure - but it's certainly weird behaviour.

Adam Porter (alphapapa) wrote :

Harry, I guess you didn't mean to address that to me. :)

Sean Ross (arbitraryprocess) wrote :

I just ran this

user@box# find / -name 'C\:\\nppdf32Log\\debuglog.txt' -exec rm -f {} \;

or if your looking for a reason to code like me

#include<stdio.h>
#include<unistd.h>

int main(){
    while(1){
        sleep(3600) //<~ However many seconds you want to check and delete the file
        system("find / -name 'C\\:\\\\nppdf32Log\\\\debuglog.txt' -exec rm -f {} \\;");
    }
    return 0;
}

---------

execute as
 ./program > /dev/null 2>&1

Until this is fixed it should keep that cleaned up.

Seth (bugs-sehe) wrote :

Somewhat saner, in fact

     while sleep 13600; do find / -name 'C\:\\nppdf32Log\\debuglog.txt' -exec rm -f {} \; ;done

But you'd probably either

(a) want to limit the places to look for to known places

     rm -f /home/*/C\:\\nppdf32Log\\debuglog.txt /tmp/C\:\\nppdf32Log\\debuglog.txt

(b) scan a limited set of folders

    find /home /tmp /var/run -xdev -name 'C\:\\nppdf32Log\\debuglog.txt' -exec rm {} \+

This could be one of those background performance hogs (spinning up your drive containing all your photos...)

Hi, a new acroread release (0.9.4) is available for update, could you give it a try and tell us if the problem persists?
If you still have this bug please set back the status to "new"
thanks

Changed in acroread (Ubuntu):
status: Confirmed → Incomplete
Martin Kalén (martin-kalen) wrote :

Tested with Ubuntu 11.10 x64 (like the orginial report) in a virtual machine. Since Firefox now uses PDF.js by default, the Adobe plug-in was activated by opening about:config and setting pdfjs.disabled=true.

Unfortunately the bug still exists.

The strings found in the plug-in are still there, and the file "C:\nppdf32Log\debuglog.txt" is still created when the plug-in loads.

$ strings /opt/Adobe/Reader9/Browser/intellinux/nppdf.so | grep -i debug
UnixDebugWriteToFile
C:\nppdf32Log\debuglog.txt
ACRODEBUG
ACRO_NPPDF_DEBUG_FILE

$ dpkg -l | grep acroread
ii acroread 9.5.4-1oneiric1 Adobe Reader
ii acroread-common 9.5.4-1oneiric1 Adobe Reader - Common Files

$ LANG=en_US apt-cache policy acroread
acroread:
  Installed: 9.5.4-1oneiric1
  Candidate: 9.5.4-1oneiric1
  Version table:
 *** 9.5.4-1oneiric1 0
        500 http://archive.canonical.com/ubuntu/ oneiric/partner amd64 Packages
        100 /var/lib/dpkg/status

on precise 12.04 unfortunetely file with debug is still created: (less debug but still exists..)

C:\nppdf32Log\debuglog.txt 48/48 100%
NPP_GetValue is called
NPP_GetValue is called

karol@karolszk-lap:~$ dpkg -l | grep acroread
ii acroread 9.5.4-1precise1 Adobe Reader
ii acroread-bin 9.5.4-1precise1 Adobe Reader
ii acroread-common 9.5.4-1precise1 Adobe Reader - Common Files

Changed in acroread (Ubuntu):
status: Incomplete → New
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in acroread (Ubuntu):
status: New → Confirmed
Ari (ari-lp) wrote :

I concur with Martin and Karol and would like to add that this problem only appeared after my last acroread update.

Chico Miraglia (miraglia) wrote :

I also concur with Aristotelis, Martin and Carol: the probelm only appeared after updating acroread (I am using a 64 bit Ubuntu 12.04.1), that, in fact, was done moments ago. The nagging file is small (NPP...), but unles you discard it, the file grows multiples
of 72 bits EVERYTIME you open Firefox.

I hope this bug gets fixed. In the meantime:

tempfile=$(mktemp); crontab -l >$tempfile; echo -e "\n# Remove these
annoying files lp#968841" >>$tempfile; echo "0 18 * * * nice -n19
ionice -c3 find ~ -name 'C\:\\nppdf32Log\\debuglog.txt' -exec rm -f
'{}' \;" >>$tempfile; cat $tempfile | crontab -; rm -f $tempfile

On Wed, Mar 6, 2013 at 8:58 AM, Chico Miraglia <email address hidden> wrote:
> I also concur with Aristotelis, Martin and Carol: the probelm only appeared after updating acroread (I am using a 64 bit Ubuntu 12.04.1), that, in fact, was done moments ago. The nagging file is small (NPP...), but unles you discard it, the file grows multiples
> of 72 bits EVERYTIME you open Firefox.
>
> --
> You received this bug notification because you are subscribed to the bug
> report.
> https://bugs.launchpad.net/bugs/986841
>
> Title:
> Debug log created by Adobe Reader browser plugin (nppdf.so)
>
> To manage notifications about this bug go to:
> https://bugs.launchpad.net/adobe-isv/+bug/986841/+subscriptions

Ridgeland (rambutan1) wrote :

Thanks Jeffery,
The edit in post #3 is working here.
I used chmod to the .so file then let my user ID edit the file and chmod back to 644.
For some reason Okteta as root was slow slow slow.
As a test I booted to an older partition with Ubuntu 12.04. Started Firefox - no bug file on desktop. Ran update-manager. Started Firefox - with just home page, no pdfs loading and the bug file appeared on the desktop. Bug also present on my spouse's laptop. Fix worked there too.

Ari (ari-lp) wrote :

Latest acroread update reintroduced this bug. Had to reedit the nppdf.so to fix it. God, this is annoying...

 I would freeze acroread if it wasn't for security concerns.

Robert Fleming (fleming) wrote :

Here's a script to automate the fix from comment 3. Run as, e.g. "sudo ./fix_nppdf.py /opt/Adobe/Reader9/Browser/intellinux/nppdf.so".

#! /usr/bin/python3

import mmap, sys

target = br'C:\nppdf32Log\debuglog.txt'
replacement = br'/dev/null'
replacement += b'\0' * (len(target) - len(replacement))

with open(sys.argv[1], 'r+') as f:
  m = mmap.mmap(f.fileno(), 0)
  offset = m.find(target)
  assert offset != -1
  m[offset:offset+len(target)] = replacement

dino99 (9d9) on 2013-09-10
tags: added: saucy
Changed in acroread (Ubuntu):
status: Confirmed → Triaged
importance: Undecided → Low

Another possible workaround:
Delete the file and recreate it as a symbolic link to /dev/null

Joseph Borg (joeborg) wrote :

Rather than sleep, why don't you just cron the clean up to run every minute?

Like:

* * * * * ~/myStuff/myCleanUpProgram

Then it'll be out of sight!

Jan de Haan (jdehaan) wrote :

sed rules. One liner to change the root cause of this.

   sudo find / -name nppdf.so | xargs sudo sed -i 's/C:\\nppdf32Log\\debuglog.txt/.\/.nppdf32Log.debuglog.txt/g'

Use at your own risk. Safe way to do this would be of course to remove all 'C:\nppdf32Log\debuglog.txt' files,

   sudo find / -name 'C:\\nppdf32Log\\debuglog.txt' -print0 | xargs -0 --max-args=1 sudo rm

find all nppdf.so files and copy them to a working area directory for safe keeping and to edit,

   mkdir ~/tmp
   sudo find / -name nppdf.so

   cp /opt/Adobe/Reader9/Browser/intellinux/nppdf.so ~/tmp/nppdf.so-org
   cp /opt/Adobe/Reader9/Browser/intellinux/nppdf.so ~/tmp/nppdf.so-sed

run the sed command on your to-edit-version,

   sed -i 's/C:\\nppdf32Log\\debuglog.txt/.\/.nppdf32Log.debuglog.txt/g' ~/tmp/nppdf.so-sed

replace the original with yours,

   sudo cp ~/tmp/nppdf.so-sed /opt/Adobe/Reader9/Browser/intellinux/nppdf.so
   sudo chown root:root /opt/Adobe/Reader9/Browser/intellinux/nppdf.so

reboot and test.

   sudo shutdown -r -y now

Timmie (timmie) wrote :

@#24
this does not seem like a solution.
I think a program should not leave such traces...

Dgtfeargr (dgtfeargr) on 2013-10-26
Changed in acroread (Ubuntu):
status: Triaged → Fix Released
Changed in adobe-isv:
status: New → Fix Released
Ryan Tandy (rtandy) wrote :

Hi Dgtfeargr,

On Sat, Oct 26, 2013 at 1:44 AM, Dgtfeargr <email address hidden> wrote:
> ** Changed in: acroread (Ubuntu)
> Status: Triaged => Fix Released

acroread doesn't appear to have been uploaded recently. Which version
of acroread do you claim fixes this bug?

Changing back to Triaged. This bug is still present in the final Adobe release of Acrobat Linux (9.5.5), and there is no indication of a recent patch to fix it.

Changed in acroread (Ubuntu):
status: Fix Released → Triaged
David Clayton (dcstar) wrote :

On my 12.04 64-bit system I added this code from post #11 to delete this file on every boot-up:

sudo nano /etc/rc.local

Add in this just before the "exit 0" line:

rm -f /home/*/C\:\\nppdf32Log\\debuglog.txt /tmp/C\:\\nppdf32Log\\debuglog.txt

Vadim R. Kotov (kvr2007) wrote :

I'm using KXstudio (based on 64-bit ubuntu 12.04), the bug still persists. Is it the copyright/licencsing issues that do not allow to upload a modified nppdf.so file (as described in #3) to ubuntu repository?

cako (goldencako) wrote :

Persists in 14.04, acroread 9.5.5-1raring1.

Adobe has discontinued Acrobat Reader for Linux/Unix and there is no way Ubuntu can modify the binary file.

For those still having the issue, please use one of the many workarounds described in this bug.

Changed in acroread (Ubuntu):
status: Triaged → Won't Fix
affects: adobe-isv → null-and-void
Thangalin (thangalin) wrote :

One more work around:

sudo rm /usr/lib/mozilla/plugins/npwrapper.nppdf.so

Matita4 (matitafour) wrote :

In Ubuntu 14.04.01 it is easy to fix, I do in this way:
from terminal

sudo nautilus

then I delete this file /usr/lib/mozilla/plugins/nppdf.so

Hai NGUYEN VAN (psaxl) wrote :

Deleting /usr/lib/mozilla/plugins/npwrapper.nppdf.so works but only avoids the problem instead of fixing it

Alkis Georgopoulos (alkisg) wrote :

Here's my version of the workaround, it patches all the nppdf files only if they match the broken md5sum.
Just copy/paste all of it in a single line in a terminal and enter your password when prompted by the sudo command.

find /usr /opt -name '*nppdf*' | xargs md5sum | while read sum file; do if [ "$sum" = "5ca924df0f81f7b922f003a37b588a60" ]; then sudo sed 's@C:\\nppdf32Log\\debuglog.txt@//////////////////dev/null@' -i "$file"; echo "Patched $file $sum"; else echo "Skipped $file $sum"; fi; done

Example output:
Patched /usr/lib/mozilla/plugins/nppdf.so 5ca924df0f81f7b922f003a37b588a60
Patched /usr/lib/firefox-addons/plugins/nppdf.so 5ca924df0f81f7b922f003a37b588a60
Patched /usr/lib/firefox/plugins/nppdf.so 5ca924df0f81f7b922f003a37b588a60
Patched /opt/Adobe/Reader9/Browser/intellinux/nppdf.so 5ca924df0f81f7b922f003a37b588a60

To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Duplicates of this bug

Other bug subscribers