pstoedit crashed with SIGSEGV in _IO_setb()

[Matthias Mailänder]

Binary package hint: pstoedit

I tried to convert a EPS to SVG file. It segfaults every time.
pstoedit -f svg also crashes every time.

I am using Ubuntu 10.04.1 LTS.

pstoedit:
  Installiert: 3.50-0ubuntu1
  Kandidat: 3.50-0ubuntu1
  Versions-Tabelle:
 *** 3.50-0ubuntu1 0
        500 http://de.archive.ubuntu.com/ubuntu/ lucid/universe Packages
        100 /var/lib/dpkg/status

ProblemType: Crash
DistroRelease: Ubuntu 10.04
Package: pstoedit 3.50-0ubuntu1
ProcVersionSignature: Ubuntu 2.6.32-24.39-generic 2.6.32.15+drm33.5
Uname: Linux 2.6.32-24-generic i686
Architecture: i386
Date: Tue Aug 10 21:07:23 2010
ExecutablePath: /usr/bin/pstoedit
InstallationMedia: Ubuntu 9.10 "Karmic Koala" - Release i386 (20091028.5)
ProcCmdline: pstoedit -f plot-svg 827961_7934010_sciencemoonreligionskyscrapers_orig.eps scienemoonreligionskyscraper.svg
ProcEnviron:
 SHELL=/bin/bash
 LANG=de_DE.utf8
 LANGUAGE=de_DE:de:en
SegvAnalysis:
 Segfault happened at: 0xd3e8fa <_IO_setb+26>: mov 0x1c(%esi),%eax
 PC (0x00d3e8fa) ok
 source "0x1c(%esi)" (0x2000001c) not located in a known VMA region (needed readable region)!
 destination "%eax" ok
SegvReason: reading unknown VMA
Signal: 11
SourcePackage: pstoedit
Stacktrace:
 #0 0x00d3e8fa in _IO_setb () from /lib/tls/i686/cmov/libc.so.6
 No symbol table info available.
 Cannot access memory at address 0x80000004
StacktraceTop: _IO_setb () from /lib/tls/i686/cmov/libc.so.6
ThreadStacktrace:
 .
 Thread 1 (Thread 24970):
 #0 0x00d3e8fa in _IO_setb () from /lib/tls/i686/cmov/libc.so.6
 No symbol table info available.
 Cannot access memory at address 0x80000004
Title: pstoedit crashed with SIGSEGV in _IO_setb()
UserGroups: adm admin audio cdrom davfs2 dialout dip fax floppy fuse lpadmin netdev plugdev sambashare tape video

[Marcel Stimberg (marcelstimberg)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Could you attach an EPS file where you get this segfault? Thanks.

[Matthias Mailänder (mailaender)]

It happens with every EPS file.

[Marcel Stimberg (marcelstimberg)]

I found that on my system (amd64), pstoedit always crashes on exit -- even if I start it without arguments. I can still use it to convert files, because the crash seems to occur after the file creation. Can you confirm that, i.e. that the bug has nothing to do with EPS->SVG conversion?

I tried to debug the problem a bit, but when I build pstoedit from source (and link pthread to get gdb running) I cannot reproduce it anymore...

As a last comment: Please do not confirm your own bugs (https://wiki.ubuntu.com/Bugs/Status).

[Matthias Mailänder (mailaender)]

I can confirm that it segfaults even without arguments on i386. The EPS→SVG conversion does not work correct, too.

[Marcel Stimberg (marcelstimberg)]

Thanks for confirming my observation. When you say that the conversion does not work correctly, do you mean that no file is created or that the generated file is not a faithful conversion? In case of the latter, I think this problem has nothing to do with the crash. I'll try to debug this issue further tonight.

[Matthias Mailänder (mailaender)]

The conversion is either distorted or no file is created.

[Marcel Stimberg (marcelstimberg)]

Some observations:
The segmentation fault also occurs in Ubuntu Maverick but not in Debian Sid. The difference seems to be the version of g++ that was used for compiling -- the package in Debian is built with a 4.4.5 prerelease version, whereas the version in lucid is built with 4.4.3 and the one in maverick with 4.4.4. If I rebuild pstoedit in maverick with the 4.4.5 version which has recently been updated there as well, the crash no longer occurs.

I think distorted files have nothing to do with this crash, maybe this is worth opening another bug...

[Dennis Sheil (dennis-sheil)]

Marcel, you said - "I tried to debug the problem a bit, but when I build pstoedit from source (and link pthread to get gdb running) I cannot reproduce it anymore..."

I think that linking to pthread is what fixed it for you.

When I do a
$ dpkg -L libpstoedit0c2a|grep magic|tail -1
/usr/lib/pstoedit/libp2edrvmagick++.so

and then

$ ldd /usr/lib/pstoedit/libp2edrvmagick++.so |grep libpthread|awk '{print $1,$2}'
libpthread.so.0 =>

I see there are dependencies on the pthread library from one of the libraries in the libpstoedit0c2a package.

I run pstoedit without arguments and get a segmentation fault. I temporarily move the libp2edrvmagick++.so shared library to another directory and run pstoedit without arguments, and there is no segmentation fault.

Just like Marcel, when I patch the source to link to pthread, the segmentation fault goes away.

[Marcel Stimberg (marcelstimberg)]

I'm quite sure it has to do with library unloading, I'll attach a Debian bug pointing to that (and fixing it). Comments in the code suggest also problems with "buggy compilers" in this direction -- I don't think that linking or not linking pthread is the primary reason for this bug. The debian package does not link against pthread and doesn't have the segfault.

Interestingly, the debian package still has the patch to fix the bug I linked whereas in Ubuntu it seems to got lost somehow... I think syncing the latest debian package is the best solution.

[Marcel Stimberg (marcelstimberg)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. However, I am closing it because the bug has been fixed in the latest development version of Ubuntu - Maverick Meerkat.

This is a significant bug in Ubuntu. If you need a fix for the bug in previous versions of Ubuntu, please do steps 1 and 2 of the SRU Procedure [1] to bring the need to a developer's attention.

[1]: https://wiki.ubuntu.com/StableReleaseUpdates#Procedure

[David Monniaux (david-monniaux)]

The problem does not occur if I compile pstoedit 3.50 myself.

[smarf (smarf)]

On my uptodate ubuntu 10.04 the binary package segfaults even on
  pstoedit -help