Evince crashes when loading some pdf files

[vlad]

Binary package hint: libpoppler2

Ubuntu 8.04.1, evince 2.22.2-0ubuntu, libpoppler2 0.6.4-1ubuntu3
running with gdb
-------------------------
(gdb) run PowerShot_A300.pdf
Starting program: /usr/bin/evince PowerShot_A300.pdf
[Thread debugging using libthread_db enabled]
[New Thread 0xb6bcd720 (LWP 21669)]
[New Thread 0xb6a3bb90 (LWP 21670)]
Error: FormWidgetChoice:: invalid Opt entry

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb6a3bb90 (LWP 21670)]
0xb6fd93ce in GooString::cmp () from /usr/lib/libpoppler.so.2
(gdb) bt
#0 0xb6fd93ce in GooString::cmp () from /usr/lib/libpoppler.so.2
#1 0xb6f52f87 in FormWidgetChoice::loadDefaults ()
   from /usr/lib/libpoppler.so.2
#2 0xb6f4e261 in FormField::loadChildrenDefaults ()
   from /usr/lib/libpoppler.so.2
#3 0xb6f518ea in Form::createFieldFromDict () from /usr/lib/libpoppler.so.2
#4 0xb6f52330 in FormField::FormField () from /usr/lib/libpoppler.so.2
#5 0xb6f518cd in Form::createFieldFromDict () from /usr/lib/libpoppler.so.2
#6 0xb6f51ba5 in Form::Form () from /usr/lib/libpoppler.so.2
#7 0xb6f47098 in Catalog::Catalog () from /usr/lib/libpoppler.so.2
#8 0xb6fa6926 in PDFDoc::setup () from /usr/lib/libpoppler.so.2
#9 0xb6fa6bc3 in PDFDoc::PDFDoc () from /usr/lib/libpoppler.so.2
#10 0xb774a3b5 in poppler_document_new_from_file ()
   from /usr/lib/libpoppler-glib.so.2
#11 0xb584da59 in pdf_document_load (document=0x8404ea0,
    uri=0x84271c0 "file:///home/vlad/PowerShot_A300.pdf", error=0x83cd314)
    at /build/buildd/evince-2.22.2/./backend/pdf/ev-poppler.cc:291
#12 0xb7fb5091 in ev_document_load (document=0x8404ea0,
    uri=0x84271c0 "file:///home/vlad/PowerShot_A300.pdf", error=0x83cd314)
    at /build/buildd/evince-2.22.2/./libdocument/ev-document.c:122
#13 0xb7fb59e5 in ev_document_factory_get_document (
    uri=0x39594420 <Address 0x39594420 out of bounds>, error=0x83cd314)
    at /build/buildd/evince-2.22.2/./libdocument/ev-document-factory.c:242
---Type <return> to continue, or q <return> to quit---
#14 0x08060c24 in ev_job_load_run (job=0x83cd2f0)
    at /build/buildd/evince-2.22.2/./shell/ev-jobs.c:568
#15 0x0805f469 in handle_job (job=0x83cd2f0)
    at /build/buildd/evince-2.22.2/./shell/ev-job-queue.c:133
#16 0x0805fa5c in ev_render_thread (data=0x0)
    at /build/buildd/evince-2.22.2/./shell/ev-job-queue.c:264
#17 0xb7566d2f in ?? () from /usr/lib/libglib-2.0.so.0
#18 0xb73464fb in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#19 0xb72c8e5e in clone () from /lib/tls/i686/cmov/libc.so.6

----------------------------
in Ubuntu 7.04 evince works fine:
evince 0.8.1-0ubuntu1, libpoppler1 0.5.4-0ubuntu8

ProblemType: Crash
Architecture: i386
Date: Tue Jan 27 09:25:03 2009
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/bin/evince
NonfreeKernelModules: nvidia
Package: evince 2.22.2-0ubuntu2
PackageArchitecture: i386
ProcCmdline: evince file:///home/User Name/PowerShot_A300.pdf
ProcEnviron:
 PATH=/home/User Name/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=ru_RU.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: evince
StacktraceTop:
 GooString::cmp () from /usr/lib/libpoppler.so.2
 FormWidgetChoice::loadDefaults ()
 FormField::loadChildrenDefaults ()
 Form::createFieldFromDict () from /usr/lib/libpoppler.so.2
 FormField::FormField () from /usr/lib/libpoppler.so.2
Title: evince crashed with SIGSEGV in GooString::cmp()
Uname: Linux 2.6.24-23-generic i686
UserGroups: adm admin audio cdrom dialout dip floppy fuse lpadmin plugdev scanner video

[Apport retracing service (apport)]

StacktraceTop:GooString::cmp () from /usr/lib/libpoppler.so.2
FormWidgetChoice::loadDefaults ()
FormField::loadChildrenDefaults ()
Form::createFieldFromDict () from /usr/lib/libpoppler.so.2
FormField::FormField () from /usr/lib/libpoppler.so.2

[Pedro Villavicencio (pedro)]

this report has been filed here:

https://bugs.edge.launchpad.net/poppler/+bug/321764

example file:

http://launchpadlibrarian.net/21670487/POWER_SHOT-A300.pdf

".
Thread 2 (process 18846):
#0 0xb7f33410 in __kernel_vsyscall ()
#1 0xb72a5589 in __lll_lock_wait () from /lib/tls/i686/cmov/libpthread.so.0
#2 0xb72a0ba6 in _L_lock_95 () from /lib/tls/i686/cmov/libpthread.so.0
#3 0xb72a058a in pthread_mutex_lock ()
   from /lib/tls/i686/cmov/libpthread.so.0
#4 0xb7f0cb36 in ev_document_fc_mutex_lock ()
    at /build/buildd/evince-2.22.2/./libdocument/ev-document.c:105
No locals.
#5 0x0805e166 in ev_application_open_uri_at_dest (application=0x80da940,
    uri=0x8100888 "file:///home/vlad/PowerShot_A300.pdf", screen=0x80cc0b0,
    dest=0x0, mode=EV_WINDOW_MODE_NORMAL, search_string=0x0,
    unlink_temp_file=0, print_settings=0x0, timestamp=0)
    at /build/buildd/evince-2.22.2/./shell/ev-application.c:563
 new_window = (EvWindow *) 0x8112028
 __PRETTY_FUNCTION__ = "ev_application_open_uri_at_dest"
#6 0x0805e3d6 in ev_application_open_uri (application=0x80da940,
    uri=0x8100888 "file:///home/vlad/PowerShot_A300.pdf", args=0x80da918,
    timestamp=0, error=0x0)
    at /build/buildd/evince-2.22.2/./shell/ev-application.c:603
 dest = (EvLinkDest *) 0x0
 mode = EV_WINDOW_MODE_NORMAL
 search_string = (const gchar *) 0x0
 unlink_temp_file = 0
 print_settings = (const gchar *) 0x842cda8 "\002"
 screen = (GdkScreen *) 0x80cc0b0
#7 0x0808d480 in main (argc=2, argv=)
    at /build/buildd/evince-2.22.2/./shell/main.c:230
 enable_metadata = 1
 context = <value optimized out>
 args = (GHashTable *) 0x80da918
 program = (GnomeProgram *) 0x80ac058
.
Thread 1 (process 18847):
#0 0xb6f313ce in GooString::cmp () from /usr/lib/libpoppler.so.2
#1 0xb6eaaf87 in FormWidgetChoice::loadDefaults ()
   from /usr/lib/libpoppler.so.2
#2 0xb6ea6261 in FormField::loadChildrenDefaults ()
   from /usr/lib/libpoppler.so.2
#3 0xb6ea98ea in Form::createFieldFromDict () from /usr/lib/libpoppler.so.2
#4 0xb6eaa330 in FormField::FormField () from /usr/lib/libpoppler.so.2
#5 0xb6ea98cd in Form::createFieldFromDict () from /usr/lib/libpoppler.so.2
#6 0xb6ea9ba5 in Form::Form () from /usr/lib/libpoppler.so.2
#7 0xb6e9f098 in Catalog::Catalog () from /usr/lib/libpoppler.so.2
#8 0xb6efe926 in PDFDoc::setup () from /usr/lib/libpoppler.so.2
#9 0xb6efebc3 in PDFDoc::PDFDoc () from /usr/lib/libpoppler.so.2
#10 0xb76a23b5 in poppler_document_new_from_file ()
   from /usr/lib/libpoppler-glib.so.2
#11 0xb5a89a59 in pdf_document_load (document=0x83fb790,
    uri=0x842a740 "file:///home/vlad/PowerShot_A300.pdf", error=0x83cd314)
    at /build/buildd/evince-2.22.2/./backend/pdf/ev-poppler.cc:291
 poppler_error = (GError *) 0x0
#12 0xb7f0d091 in ev_document_load (document=0x83fb790,
    uri=0x842a740 "file:///home/vlad/PowerShot_A300.pdf", error=0x83cd314)
    at /build/buildd/evince-2.22.2/./libdocument/ev-document.c:122
 retval = 962151456
#13 0xb7f0d9e5 in ev_document_factory_get_document (
    uri=0x39594420 <Address 0x39594420 out of bounds>, error=0x83cd314)
    at /build/buildd/evince-2.22.2/./libdocument/ev-document-factory.c:242
 document = (EvDocument *) 0x83fb790
 ...

[Albert Astals Cid (aacid)]

Will be fixed in poppler 0.10.4, thanks for the report

[Pedro Villavicencio (pedro)]

Thanks for the report, could you please attach the pdf file which is causing the issue? thanks.

[Pedro Villavicencio (pedro)]

don't worry didn't saw the file you attached, will test. thanks.

[Pedro Villavicencio (pedro)]

Managed to reproduce the same with Jaunty, I've sent this upstream at: http://bugs.freedesktop.org/show_bug.cgi?id=19790

[Pedro Villavicencio (pedro)]

this has been fixed upstream, thanks for reporting!.

[Sebastien Bacher (seb128)]

the new version is in jaunty now