bugThe FreeType Project - Bugs: bug #23045, evince crashed with SIGSEV in...

 
 

bug #23045: evince crashed with SIGSEV in FT_Get_PS_Font_Info when trying to print a document

Submitted by:  None
Submitted on:  Fri 25 Apr 2008 08:02:37 PM UTC  
 
Severity: 3 - NormalItem Group: Crash
Status: InvalidPrivacy: Public
Assigned to: Werner LEMBERG <wl>Open/Closed: Closed
Planned Release: None

Add a New Comment(Rich Markup)
   

You are not logged in

Please log in, so followups can be emailed to you.

 

(Jump to the original submission Jump to the original submission)

Mon 28 Apr 2008 10:17:47 PM UTC, comment #7:

The FT_Done_Face would have been valid. Only access after it will be invalid, so, no, I don't think you should see any FT_Done_Face in the valgrind log.

Behdad Esfahbod <behdad>
Mon 28 Apr 2008 10:08:38 PM UTC, comment #6:

Just to make sure it is really the same bug: Shouldn't I be seeing an FT_Done_Face call (the problem fixed by Chris Wilson) in the valgrind log...?
Anyway - the bug seems to have gone away when using the latest poppler release (0.8.1).

Marcel Stimberg <mstimberg>
Mon 28 Apr 2008 04:06:02 PM UTC, comment #5:

Cairo hacker extraordinaire Chris Wilson already fixed this in poppler a few weeks ago. See:
http://cgit.freedesktop.org/poppler/poppler/commit/?id=42db4890e8295aaec5a1be12d1414fc0a9048550

Behdad Esfahbod <behdad>
Sun 27 Apr 2008 06:03:20 AM UTC, comment #4:

Looks more like an evince issue to me. The FT_Face is created by evince and passed to cairo. Seems like evince freed it then...

I'm composing a mail to cairo list about this. Most probably one of our PDF/evince hackers will figure this out and fix it.

Behdad Esfahbod <behdad>
Sat 26 Apr 2008 11:26:53 PM UTC, comment #3:

Yes, this seems to be very likely. Behdad?

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Sat 26 Apr 2008 10:58:21 PM UTC, comment #2:

In the ubuntu bug tracker the same problem has been reported quite a while ago: https://bugs.launchpad.net/ubuntu/+source/evince/+bug/157797 (relevant comments start at 2007-12-03).

The following document is given there to reproduce the crash (when opening and printing it with evince):
http://www.cs.berkeley.edu/~vazirani/algorithms/all.pdf

In the bug comments it is speculated that the bug comes from libcairo calling FT_Get_PS_Font_Info with garbage arguments...

Marcel Stimberg <mstimberg>
Sat 26 Apr 2008 06:33:35 AM UTC, comment #1:

Usually, this error can't happen -- the module management is normally done at run time, and the list of modules can be dynamically extended in a safe way.

I rather suspect that something is overwriting the array which holds the valid modules.

Can you run valgrind, please? This should give a hint where the overwriting takes place in case my suspicion is correct.

Werner LEMBERG <wl>
Project AdministratorIn charge of this item.
Fri 25 Apr 2008 08:02:37 PM UTC, original submission:

I habe a pdftex generated PDF document that reproducibly crashes when trying to print it. gdb tells me that the crash happens in FT_Get_PS_Font_Info, therefore I file this bug here - please tell me if it is rather a cairo or evince problem.
Unfortunately, I cannot publish the PDF file and did not yet manage to get a minimal example file...
The freetype version is 2.3.5. I attach a backtrace and the output of the pdffonts utility (are the [none] entries the cause of the problem...?).

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #15526:  valgrind.log added by mstimberg (247KiB - application/octet-stream - valgrind log of the crash)
file #15520:  gdb-evince.txt added by None (11KiB - text/plain - gdb and pdffonts output)
file #15521:  pdffonts_output.txt added by None (6KiB - text/plain - gdb and pdffonts output)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by behdad (Posted a comment)
  • -unavailable- added by wl (Please look at this; maybe it's a Pango/Cairo issue (at least I think so).)
  • -unavailable- added by mstimberg (Updated the item)
  • -unavailable- added by wl (Posted a comment)
  • -unavailable- added by mstimberg (Original poster (unfortunately filed anonymously))
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 9 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Tue 29 Apr 2008 05:10:49 AM UTCwlStatusNeed Info=>Invalid
      Open/ClosedOpen=>Closed
    Sat 26 Apr 2008 09:31:43 AM UTCwlCarbon-Copy-=>Added behdad
    Sat 26 Apr 2008 09:01:15 AM UTCmstimbergAttached File-=>Added valgrind.log, #15526
    Sat 26 Apr 2008 06:33:35 AM UTCwlStatusNone=>Need Info
      Assigned toNone=>wl
    Fri 25 Apr 2008 08:07:38 PM UTCmstimbergCarbon-Copy-=>Added mstimberg
    Fri 25 Apr 2008 08:02:37 PM UTCNoneAttached File-=>Added gdb-evince.txt, #15520
      Attached File-=>Added pdffonts_output.txt, #15521

    Back to the top


    Powered by Savane 3.1-cleanup1