CMapCache::getCMap SEGV with 'Creusage_-_Tunnel_sous_la_Manche.pdf'

[Paul Sladen]

The following PDF reliably causes xpdf and Evince to crash/hang:

  http://www.gramme.be/unite9/pmwiki/uploads/PrGC0708/Creusage_-_Tunnel_sous_la_Manche.pdf

Even when the file is split up into separate pages using 'pdftk burst', all pages still cause the crash, including the smallest one at 11kB; the crash is likely related to the loading of one of the embedded fonts.

Ideally even if Poppler can't handle a particular font, it should not result in a crash.

[Paul Sladen (sladen)]

Created attachment 58289
Page 7 11kB minimal from 'pdftk burst Creusage*.pdf'

Forwarded from: https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/952314

The following PDF reliably causes xpdf and Evince to crash/hang:

  http://www.gramme.be/unite9/pmwiki/uploads/PrGC0708/Creusage_-_Tunnel_sous_la_Manche.pdf

Even when the file is split up into separate pages using 'pdftk burst', all pages still cause the crash, including the smallest one at 11kB; the crash is likely related to the loading of one of the embedded fonts.

Ideally even if Poppler can't handle a particular font, it should not result in a crash.

[Albert Astals Cid (aacid)]

Which poppler version are you using?

Which bactrace do you get?

[Paul Sladen (sladen)]

Hello Aacid,

$ ldd /usr/bin/xpdf.real | grep poppler
libpoppler.so.19 => /usr/lib/x86_64-linux-gnu/libpoppler.so.19 (0x00007fc59cef5000)

$ COLUMNS=200 dpkg -l libpoppler19 | tail -1 | awk '{print $2,$3}'
libpoppler19 0.18.4-1ubuntu2

$ gdb --args /usr/bin/xpdf.real Creusage_-_Tunnel_sous_la_Manche.pdf
Starting program: /usr/bin/xpdf.real Creusage_-_Tunnel_sous_la_Manche.pdf
***** MediaBox = ll:0,0 ur:841.89,595.276
***** CropBox = ll:0,0 ur:841.89,595.276
***** Rotate = 0

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff77095e8 in CMapCache::getCMap(GooString*, GooString*, Stream*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
(gdb) bt
#0 0x00007ffff77095e8 in CMapCache::getCMap(GooString*, GooString*, Stream*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#1 0x00007ffff774a3ad in GlobalParams::getCMap(GooString*, GooString*, Stream*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#2 0x00007ffff7732363 in GfxCIDFont::GfxCIDFont(XRef*, char*, Ref, GooString*, Dict*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#3 0x00007ffff7733353 in GfxFont::makeFont(XRef*, char*, Ref, Dict*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#4 0x00007ffff77334ff in GfxFontDict::GfxFontDict(XRef*, Ref*, Dict*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#5 0x00007ffff771b16d in GfxResources::GfxResources(XRef*, Dict*, GfxResources*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#6 0x00007ffff772dbca in Gfx::Gfx(XRef*, OutputDev*, int, Dict*, Catalog*, double, double, PDFRectangle*, PDFRectangle*, int, bool (*)(void*), void*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#7 0x00007ffff7761937 in Page::createGfx(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, Catalog*, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19
#8 0x00007ffff7761bbd in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, Catalog*, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) () from /usr/lib/x86_64-linux-gnu/libpoppler.so.19

[Albert Astals Cid (aacid)]

I'm sorry, i don't support popple- patched xpdf as a valid source of backtraces, give me a evince or okular one or a pdftoppm or pdftocairo or something that their original developers coded to use poppler, not something that someone in a distribution patched against its developer decision.

Also install your distro poppler debug packages so that your backtrace is more useful.

And if you can run it through valgrind also that'd be even better :-)

[Adrian Bunk (bunk)]

I ran into the same segfault with another document, and for both documents the crash goes away and the document gets shown properly after downgrading libpoppler19 to the unmodified 0.18.4-1 package from Debian experimental.

When I recompile the poppler 0.18.4-1 package from Debian experimental on my up-to-date amd64 precise and install the libpoppler19 binary package built, xpdf does crash on both documents.

Can someone confirm that observation?

It smells like a bug in Ubuntu's gcc to me (but I might be wrong on that).

[Sebastien Bacher (seb128)]

upstream asked for an evince backtrace is somebody wants to provide one

[Albert Astals Cid (aacid)]

User didn't follow up

[madbiologist (me-again)]

The document in this bug's description doesn't crash evince on Ubuntu 14.04 "Trusty Tahr", but it does take a long time for each page to be displayed.

evince 3.10.3-0ubuntu10.2
poppler 0.24.5-2ubuntu4.2