Bug 690591 - Infinite loop processing a stream
Summary: Infinite loop processing a stream
Status: RESOLVED FIXED
Alias: None
Product: MuPDF
Classification: Unclassified
Component: mupdf (show other bugs)
Version: unspecified
Hardware: Macintosh MacOS X
: P4 normal
Assignee: Tor Andersson
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-07-02 11:21 UTC by Krzysztof Kowalczyk
Modified: 2009-07-02 14:18 UTC (History)
0 users

See Also:
Customer:
Word Size: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Krzysztof Kowalczyk 2009-07-02 11:21:04 UTC
This is from: http://code.google.com/p/sumatrapdf/issues/detail?id=554

In http://www.un.org/Depts/Cartographic/map/profile/world.pdf, there's an
infinite loop (e.g. when using pdfshow).

This is a recent regression. 

Most likely caused by incorrect refcounting on a filter. This seems to fix it:

--- mupdf/mupdf/pdf_stream.c    (revision 1186)
+++ mupdf/mupdf/pdf_stream.c    (working copy)
@@ -334,7 +334,6 @@
                               fz_dropfilter(base);
                               return fz_rethrow(error, "cannot create filter
chain");
                       }
-                       fz_dropfilter(base);
               }

               *filterp = pipe;


This is what valgraind says. You can see invalid reads caused most likely by
accessing freed object.

kjkmaclap:mupdf kkowalczyk$ valgrind obj-dbg/pdfdraw ~/Downloads/world.pdf 
==19735== Memcheck, a memory error detector.
==19735== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==19735== Using LibVEX rev 1899, a library for dynamic binary translation.
==19735== Copyright (C) 2004-2009, and GNU GPL'd, by OpenWorks LLP.
==19735== Using valgrind-3.5.0.SVN, a dynamic binary instrumentation framework.
==19735== Copyright (C) 2000-2009, and GNU GPL'd, by Julian Seward et al.
==19735== For more details, rerun with: -v
==19735== 
--19735-- obj-dbg/pdfdraw:
--19735-- dSYM directory is missing; consider using --auto-run-dsymutil=yes
Drawing pages 1-1...
draw bug-554.pdf:001 ==19735== Invalid read of size 4
==19735==    at 0x220EE: fz_processpipeline (in obj-dbg/pdfdraw)
==19735==    by 0x28F22: fz_process (in obj-dbg/pdfdraw)
==19735==    by 0x22117: fz_processpipeline (in obj-dbg/pdfdraw)
==19735==    by 0x28F22: fz_process (in obj-dbg/pdfdraw)
==19735==    by 0x29BCC: fz_readimp (in obj-dbg/pdfdraw)
==19735==    by 0x2A4CF: fz_peekbytex (in obj-dbg/pdfdraw)
==19735==    by 0x4B7DD: fz_peekbyte (in obj-dbg/pdfdraw)
==19735==    by 0x4C089: pdf_lex (in obj-dbg/pdfdraw)
==19735==    by 0x4AC10: pdf_runcsi (in obj-dbg/pdfdraw)
==19735==    by 0x4F7AD: runone (in obj-dbg/pdfdraw)
==19735==    by 0x4FC7E: loadpagecontents (in obj-dbg/pdfdraw)
==19735==    by 0x5018F: pdf_loadpage (in obj-dbg/pdfdraw)
==19735==  Address 0xa199a0 is 16 bytes inside a block of size 36 free'd
==19735==    at 0x54D7FB: free (vg_replace_malloc.c:323)
==19735==    by 0x11A56: fz_free (in obj-dbg/pdfdraw)
==19735==    by 0x290B4: fz_dropfilter (in obj-dbg/pdfdraw)
==19735==    by 0x5EBEE: pdf_buildfilter (in obj-dbg/pdfdraw)
==19735==    by 0x5EF92: pdf_openstream (in obj-dbg/pdfdraw)
==19735==    by 0x4F72B: runone (in obj-dbg/pdfdraw)
==19735==    by 0x4FC7E: loadpagecontents (in obj-dbg/pdfdraw)
==19735==    by 0x5018F: pdf_loadpage (in obj-dbg/pdfdraw)
==19735==    by 0x62706: drawloadpage (in obj-dbg/pdfdraw)
==19735==    by 0x6287D: drawpnm (in obj-dbg/pdfdraw)
==19735==    by 0x6372C: drawpages (in obj-dbg/pdfdraw)
==19735==    by 0x63B7C: main (in obj-dbg/pdfdraw)
==19735== 
==19735== Invalid read of size 4
==19735==    at 0x28EF4: fz_process (in obj-dbg/pdfdraw)
==19735==    by 0x22117: fz_processpipeline (in obj-dbg/pdfdraw)
==19735==    by 0x28F22: fz_process (in obj-dbg/pdfdraw)
==19735==    by 0x22117: fz_processpipeline (in obj-dbg/pdfdraw)
==19735==    by 0x28F22: fz_process (in obj-dbg/pdfdraw)
==19735==    by 0x29BCC: fz_readimp (in obj-dbg/pdfdraw)
==19735==    by 0x2A4CF: fz_peekbytex (in obj-dbg/pdfdraw)
==19735==    by 0x4B7DD: fz_peekbyte (in obj-dbg/pdfdraw)
==19735==    by 0x4C089: pdf_lex (in obj-dbg/pdfdraw)
==19735==    by 0x4AC10: pdf_runcsi (in obj-dbg/pdfdraw)
==19735==    by 0x4F7AD: runone (in obj-dbg/pdfdraw)
==19735==    by 0x4FC7E: loadpagecontents (in obj-dbg/pdfdraw)

... and more