Bug 694290 - on some PDFs ghostscript crashes when converting to JPGs
Summary: on some PDFs ghostscript crashes when converting to JPGs
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: General (show other bugs)
Version: 9.07
Hardware: PC Linux
: P4 normal
Assignee: Ray Johnston
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-06-03 11:37 UTC by David S
Modified: 2014-02-17 04:44 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---


Attachments
file1 (34.72 MB, application/pdf)
2013-06-03 11:37 UTC, David S
Details
file2 (10.80 MB, application/pdf)
2013-06-03 11:38 UTC, David S
Details
file3 (10.86 MB, application/pdf)
2013-06-03 11:41 UTC, David S
Details
city3.pdf (1.32 KB, application/pdf)
2013-06-04 16:36 UTC, Robin Watts
Details

Note You need to log in before you can comment on or make changes to this bug.
Description David S 2013-06-03 11:37:10 UTC
Created attachment 9925 [details]
file1

here are some PDF files i encountered where ghostscript crashes when converting to JPGs:

version: GPL Ghostscript 9.07 (2013-02-14) (windows build)
arguments: -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -r150 -sDEVICE=jpeg -dJPEGQ=85 -dNumRenderingThreads=4 -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -sOutputFile=page-%04d.jpg


output from the first file:
--------------------------------------------
Error: /undefined in --run--
Operand stack:
   --dict:1/1(L)--   Nums
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1932   1   3   %oparray_pop   1931   1   3   %oparray_pop   1915   1   3   %oparray_pop   --nostringval--   --nostringval--   --nostringval--
Dictionary stack:
   --dict:1180/1684(ro)(G)--   --dict:1/20(G)--   --dict:82/200(L)--   --dict:82/200(L)--   --dict:109/127(ro)(G)--   --dict:292/300(ro)(G)--   --dict:25/32(L)--
Current allocation mode is local
GPL Ghostscript 9.07: Unrecoverable error, exit code 1
Comment 1 David S 2013-06-03 11:38:54 UTC
Created attachment 9926 [details]
file2
Comment 2 David S 2013-06-03 11:40:29 UTC
output from the second file:
--------------------------------------------
Processing pages 1 through 16.
Page 1
Page 2
Page 3
Page 4
Page 5
Page 6
Page 7
Page 8
Page 9
Page 10
Page 11
Page 12
Page 13
Page 14
Page 15

then it crashes with an APPCRASH
Comment 3 David S 2013-06-03 11:41:32 UTC
Created attachment 9927 [details]
file3
Comment 4 David S 2013-06-03 11:41:57 UTC
output from the third file:
--------------------------------------------
Processing pages 1 through 16.
Page 1
Page 2
Page 3
Page 4
Page 5
Page 6
Page 7
Page 8
Page 9
Page 10
Page 11
Page 12
Page 13
Page 14
Page 15

then it crashes with an APPCRASH
Comment 5 Ken Sharp 2013-06-03 12:11:34 UTC
This appear to be at least 2 different problems, so you should open 2 bugs. I would also recommend trying to reduce the size of the input files if at all possible. Can you extract the offending page from the second or third file, for example, do you need the whole command line ?

For your first report, an error message and clean exit is not a crash. This first report is a duplicate of an already fixed bug #693929.

In your second report, I can reproduce this crash on Windows using a debug mode executable. Note that using -dNumRenderingThreads=4 has no real effect, since you aren't using a clist. Removing this has no effect on the problem either, nor does removing -dJPEGQ=85, nor the -dGraphicsAlphaBits and -dTextAlphaBits.

For me the rather simpler command line:

-sDEVICE=jpeg --r150 -o out%d.jpg City_KW18_Sudwestern_Ansicht.pdf

reproduces the problem. Extracting just page 16 causes the problem to disappear.
Comment 6 David S 2013-06-03 14:03:47 UTC
(In reply to comment #5)
> This appear to be at least 2 different problems, so you should open 2 bugs.

ok will do next time

> I would also recommend trying to reduce the size of the input files if at
> all possible. Can you extract the offending page from the second or third
> file, for example, do you need the whole command line ?



> For your first report, an error message and clean exit is not a crash. This
> first report is a duplicate of an already fixed bug #693929.

ah you're right. good it's been fixed already.

 
> -sDEVICE=jpeg --r150 -o out%d.jpg City_KW18_Sudwestern_Ansicht.pdf
> 
> reproduces the problem. Extracting just page 16 causes the problem to
> disappear.

yea next time i'll split the pdf to the offending pages. should i make a seperate bug report now for this case (and close this one)?
Comment 7 Ken Sharp 2013-06-03 14:16:59 UTC
(In reply to comment #6)
> (In reply to comment #5)

> > -sDEVICE=jpeg --r150 -o out%d.jpg City_KW18_Sudwestern_Ansicht.pdf
> > 
> > reproduces the problem. Extracting just page 16 causes the problem to
> > disappear.
> 
> yea next time i'll split the pdf to the offending pages. should i make a
> seperate bug report now for this case (and close this one)?

No we'll carry on with this one, since the other issue is already resolved. In this case, reducing the file to the offending page makes the problem go away, I've no idea why, but if you could do that in future (if it still fails) its easier for us.
Comment 8 Marcos H. Woehrmann 2013-06-03 23:10:43 UTC
This problem has already been fixed in the current development code.  You can download a patch from out git repository: http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=2132b46fea22c8b3fc60d18eba0c2ae58162421c

(In reply to comment #0)
> Created attachment 9925 [details]
> file1
> 
> here are some PDF files i encountered where ghostscript crashes when
> converting to JPGs:
> 
> version: GPL Ghostscript 9.07 (2013-02-14) (windows build)
> arguments: -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -r150 -sDEVICE=jpeg
> -dJPEGQ=85 -dNumRenderingThreads=4 -dTextAlphaBits=4 -dGraphicsAlphaBits=4
> -sOutputFile=page-%04d.jpg
> 
> 
> output from the first file:
> --------------------------------------------
> Error: /undefined in --run--
> Operand stack:
>    --dict:1/1(L)--   Nums
> Execution stack:
>    %interp_exit   .runexec2   --nostringval--   --nostringval--  
> --nostringval--   2   %stopped_push   --nostringval--   --nostringval--  
> --nostringval--   false   1   %stopped_push   1932   1   3   %oparray_pop  
> 1931   1   3   %oparray_pop   1915   1   3   %oparray_pop   --nostringval-- 
> --nostringval--   --nostringval--
> Dictionary stack:
>    --dict:1180/1684(ro)(G)--   --dict:1/20(G)--   --dict:82/200(L)--  
> --dict:82/200(L)--   --dict:109/127(ro)(G)--   --dict:292/300(ro)(G)--  
> --dict:25/32(L)--
> Current allocation mode is local
> GPL Ghostscript 9.07: Unrecoverable error, exit code 1
Comment 9 Marcos H. Woehrmann 2013-06-03 23:13:20 UTC
The minimal command line I was able to narrow this down to is:

bin/gs -r150 -sDEVICE=ppmraw -o test.ppm -dFirstPage=14 ./City_KW18_West_Ansicht.pdf

As Ken mentioned it fails under a debugger:

(gdb) run -r150 -sDEVICE=ppmraw -o test.ppm -dFirstPage=14 City_KW18_West_Ansicht.pdf
Starting program: /Users/marcos/artifex/ghostpdl/gs/debugbin/gs -r150 -sDEVICE=ppmraw -o test.ppm -dFirstPage=14 City_KW18_West_Ansicht.pdf
GPL Ghostscript GIT PRERELEASE 9.08 (2013-01-29)
Copyright (C) 2012 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
Processing pages 14 through 16.
Page 14
Page 15

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: KERN_INVALID_ADDRESS at address: 0x0000000000000007
0x000000010035c546 in cmd_put_list_op (cldev=0x102092068, pcl=0x1028927c0, size=2) at gxclutil.c:341
341	            if (pcl->tail < pcl->head ||
(gdb) where
#0  0x000000010035c546 in cmd_put_list_op (cldev=0x102092068, pcl=0x1028927c0, size=2) at gxclutil.c:341
#1  0x000000010035c860 in cmd_put_op (cldev=0x102092068, pcls=0x1028920e0, size=2) at gxclutil.c:385
#2  0x000000010037216c in write_image_end_all (dev=0x102092068, pie=0x1023d7e68) at gxclimag.c:2242
#3  0x000000010036e787 in clist_image_end_image (info=0x1023d7e68, draw_last=1) at gxclimag.c:1443
#4  0x0000000100787209 in gx_image_end (info=0x1023d7e68, draw_last=1) at gximage.c:211
#5  0x000000010064c5fe in gs_image_cleanup (penum=0x102386068, pgs=0x102055c68) at gsimage.c:660
#6  0x000000010064c643 in gs_image_cleanup_and_free_enum (penum=0x102386068, pgs=0x102055c68) at gsimage.c:671
#7  0x0000000100187588 in image_cleanup (i_ctx_p=0x102071fc8) at zimage.c:641
#8  0x0000000100187224 in image_file_continue (i_ctx_p=0x102071fc8) at zimage.c:589
#9  0x000000010011b55d in do_call_operator (op_proc=0x100186d60 <image_file_continue>, i_ctx_p=0x102071fc8) at interp.c:86
#10 0x000000010011ee95 in interp (pi_ctx_p=0x10190ce00, pref=0x7fff5fbfeaf8, perror_object=0x7fff5fbfed90) at interp.c:1185
#11 0x000000010011c074 in gs_call_interp (pi_ctx_p=0x10190ce00, pref=0x7fff5fbfec68, user_errors=1, pexit_code=0x7fff5fbfeda0, perror_object=0x7fff5fbfed90) at interp.c:510
#12 0x000000010011be2c in gs_interpret (pi_ctx_p=0x10190ce00, pref=0x7fff5fbfec68, user_errors=1, pexit_code=0x7fff5fbfeda0, perror_object=0x7fff5fbfed90) at interp.c:468
#13 0x0000000100109599 in gs_main_interpret (minst=0x10190cd60, pref=0x7fff5fbfec68, user_errors=1, pexit_code=0x7fff5fbfeda0, perror_object=0x7fff5fbfed90) at imain.c:241
#14 0x000000010010aa8f in gs_main_run_string_end (minst=0x10190cd60, user_errors=1, pexit_code=0x7fff5fbfeda0, perror_object=0x7fff5fbfed90) at imain.c:621
#15 0x000000010010a8b1 in gs_main_run_string_with_length (minst=0x10190cd60, str=0x10191c9c0 "<436974795f4b5731385f576573745f416e73696368742e706466>.runfile", length=62, user_errors=1, pexit_code=0x7fff5fbfeda0, perror_object=0x7fff5fbfed90) at imain.c:579
#16 0x000000010010a7c6 in gs_main_run_string (minst=0x10190cd60, str=0x10191c9c0 "<436974795f4b5731385f576573745f416e73696368742e706466>.runfile", user_errors=1, pexit_code=0x7fff5fbfeda0, perror_object=0x7fff5fbfed90) at imain.c:561
#17 0x000000010010f0b7 in run_string (minst=0x10190cd60, str=0x10191c9c0 "<436974795f4b5731385f576573745f416e73696368742e706466>.runfile", options=3) at imainarg.c:898
#18 0x000000010010ef74 in runarg (minst=0x10190cd60, pre=0x1008174d8 "", arg=0x7fff5fbffba7 "City_KW18_West_Ansicht.pdf", post=0x10080d7da ".runfile", options=3) at imainarg.c:887
#19 0x000000010010ea8f in argproc (minst=0x10190cd60, arg=0x7fff5fbffba7 "City_KW18_West_Ansicht.pdf") at imainarg.c:811
#20 0x000000010010c837 in gs_main_init_with_args (minst=0x10190cd60, argc=7, argv=0x7fff5fbff998) at imainarg.c:233
#21 0x0000000100001482 in main (argc=7, argv=0x7fff5fbff998) at gs.c:96
(gdb)
Comment 10 Marcos H. Woehrmann 2013-06-03 23:14:41 UTC
It's not clear if the image or the clist code is to blame.  Assigning to Robin to eliminate the image code.
Comment 11 Robin Watts 2013-06-04 16:36:43 UTC
Created attachment 9933 [details]
city3.pdf

Radically simplified file. Just contains a clip rectangle with a 1x1 image with a 1x1 smask in it.

  debugbin/gs -r150 -sDEVICE=ppmraw -o out.ppm city3.pdf

This fails with revision 761e413, but passes with the next one e0ba422.

The extra commit changes the handling of zero sized clip regions, but I can't immediately see why it would cause this. At any rate, I think it's a clist issue, so passing to ray.
Comment 12 Ray Johnston 2013-06-05 15:49:09 UTC
Fixed initially by commit e0ba422 Fix clipping bugs 693509 and 690036 (as a
side effect). The commit that prevents this more directly is:

1271b37 Fix bug 694290 caused by an image totally off the page.

Thanks, Robin, for the extremely simple test file.