Bug 691825 - Regression: seg fault reading PCL 23-02.BIN file at 600 dpi
Summary: Regression: seg fault reading PCL 23-02.BIN file at 600 dpi
Status: RESOLVED FIXED
Alias: None
Product: GhostPCL
Classification: Unclassified
Component: Regression PCL (show other bugs)
Version: master
Hardware: PC All
: P4 normal
Assignee: Henry Stiles
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2010-12-08 21:08 UTC by Marcos H. Woehrmann
Modified: 2011-02-02 18:26 UTC (History)
0 users

See Also:
Customer:
Word Size: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Marcos H. Woehrmann 2010-12-08 21:08:52 UTC
The following command seg fault starting with r11865:

  main/obj/pcl6 -sDEVICE=pbmraw -o test.pbm -dMaxBitmap=10000 -r600 ./23-02.BIN
Comment 1 Marcos H. Woehrmann 2010-12-08 22:03:57 UTC
The debug build of GhostPDL doesn't seg fault, even with -O2.  Here's the valgrind output for the non-debug build:

marcos@amd64:[90]% valgrind ghostpdl/main/obj/pcl6 -sDEVICE=pbmraw -o test.pbm -dMaxBitmap=10000 -r600 ./23-02.BIN
==24211== Memcheck, a memory error detector
==24211== Copyright (C) 2002-2009, and GNU GPL'd, by Julian Seward et al.
==24211== Using Valgrind-3.6.0.SVN-Debian and LibVEX; rerun with -h for copyright info
==24211== Command: ghostpdl/main/obj/pcl6 -sDEVICE=pbmraw -o test.pbm -dMaxBitmap=10000 -r600 ./23-02.BIN
==24211== 
==24211== Conditional jump or move depends on uninitialised value(s)
==24211==    at 0x4F7D1C: sgets (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E83F3: cmd_read_data (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EBD14: clist_playback_band (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EF977: clist_playback_file_bands (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EFBB2: clist_render_rectangle (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EFE6E: clist_rasterize_lines (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F04D8: clist_get_bits_rectangle (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x500534: clist_get_bits_rect_mt (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x64E2CF: gx_default_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E26C6: gdev_prn_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x5B196F: pbm_print_page_loop (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E31DB: gdev_prn_output_page (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211== 
==24211== Conditional jump or move depends on uninitialised value(s)
==24211==    at 0x4F7D1C: sgets (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E859A: top_up_cbuf (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E92F5: clist_playback_band (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EF977: clist_playback_file_bands (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EFBB2: clist_render_rectangle (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4EFE6E: clist_rasterize_lines (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F04D8: clist_get_bits_rectangle (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x500534: clist_get_bits_rect_mt (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x64E2CF: gx_default_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E26C6: gdev_prn_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x5B196F: pbm_print_page_loop (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E31DB: gdev_prn_output_page (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211== 
==24211== Invalid read of size 8
==24211==    at 0x5031A3: memfile_get_pdata (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x503732: memfile_fseek (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F018C: clist_read_icctable (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F025A: clist_close_writer_and_init_reader (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F0438: clist_get_bits_rectangle (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x500534: clist_get_bits_rect_mt (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x64E2CF: gx_default_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E26C6: gdev_prn_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x5B196F: pbm_print_page_loop (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E31DB: gdev_prn_output_page (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x5B17F7: ppm_output_page (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4057AE: pcl_end_page_top (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==  Address 0x8 is not stack'd, malloc'd or (recently) free'd
==24211== 
==24211== 
==24211== Process terminating with default action of signal 11 (SIGSEGV)
==24211==  Access not within mapped region at address 0x8
==24211==    at 0x5031A3: memfile_get_pdata (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x503732: memfile_fseek (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F018C: clist_read_icctable (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F025A: clist_close_writer_and_init_reader (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4F0438: clist_get_bits_rectangle (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x500534: clist_get_bits_rect_mt (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x64E2CF: gx_default_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E26C6: gdev_prn_get_bits (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x5B196F: pbm_print_page_loop (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4E31DB: gdev_prn_output_page (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x5B17F7: ppm_output_page (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==    by 0x4057AE: pcl_end_page_top (in /home/marcos/artifex/ghostpdl/main/obj/pcl6)
==24211==  If you believe this happened as a result of a stack
==24211==  overflow in your program's main thread (unlikely but
==24211==  possible), you can try to increase the size of the
==24211==  main thread stack using the --main-stacksize= flag.
==24211==  The main thread stack size used in this run was 8388608.
==24211== 
==24211== HEAP SUMMARY:
==24211==     in use at exit: 9,646,986 bytes in 89 blocks
==24211==   total heap usage: 1,017 allocs, 928 frees, 50,856,248 bytes allocated
==24211== 
==24211== LEAK SUMMARY:
==24211==    definitely lost: 0 bytes in 0 blocks
==24211==    indirectly lost: 0 bytes in 0 blocks
==24211==      possibly lost: 9,579,394 bytes in 84 blocks
==24211==    still reachable: 67,592 bytes in 5 blocks
==24211==         suppressed: 0 bytes in 0 blocks
==24211== Rerun with --leak-check=full to see details of leaked memory
==24211== 
==24211== For counts of detected and suppressed errors, rerun with: -v
==24211== Use --track-origins=yes to see where uninitialised values come from
==24211== ERROR SUMMARY: 3 errors from 3 contexts (suppressed: 4 from 4)
Segmentation fault
Comment 2 Henry Stiles 2010-12-08 22:45:58 UTC
At least an optimized build with symbols XCFLAGS=-g reproduces it and that gives us line numbers in valgrind.

==31876== Memcheck, a memory error detector
==31876== Copyright (C) 2002-2010, and GNU GPL'd, by Julian Seward et al.
==31876== Using Valgrind-3.7.0.SVN and LibVEX; rerun with -h for copyright info
==31876== Command: ./pcl6 -dMaxBitmap=10000 -sDEVICE=pbmraw -o /dev/null -r600 /Users/henrys/tests_private/pcl/pcl5ccet/23-02.BIN
==31876== 
--31876-- run: /usr/bin/dsymutil "./pcl6"
==31876== Invalid read of size 8
==31876==    at 0x1000FEDC8: memfile_get_pdata (gxclmem.c:843)
==31876==    by 0x1000FF3BA: memfile_fseek (gxclmem.c:1110)
==31876==    by 0x1000EC36A: clist_read_icctable (gxclread.c:465)
==31876==    by 0x1000EC42B: clist_close_writer_and_init_reader (gxclread.c:354)
==31876==    by 0x1000EC61A: clist_get_bits_rectangle (gxclread.c:558)
==31876==    by 0x1000FC153: clist_get_bits_rect_mt (gxclthrd.c:532)
==31876==    by 0x10024F08B: gx_default_get_bits (gdevdgbr.c:51)
==31876==    by 0x1000DF316: gdev_prn_get_bits (gdevprn.c:1230)
==31876==    by 0x1001A1957: pbm_print_page_loop (gdevpbm.c:709)
==31876==    by 0x1000DFEB2: gdev_prn_output_page (gdevprn.c:770)
==31876==    by 0x1001A17D9: ppm_output_page (gdevpbm.c:275)
==31876==    by 0x100001CE5: pcl_end_page_top (in ./pcl6)
==31876==  Address 0x8 is not stack'd, malloc'd or (recently) free'd
==31876==
Comment 3 Marcos H. Woehrmann 2011-02-02 18:26:40 UTC
Starting with r11981 this problem has gone away.