Bug 696626 - A PDF file causes ps2pdf crash (segmentation fault)
Summary: A PDF file causes ps2pdf crash (segmentation fault)
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: PDF Writer (show other bugs)
Version: 9.16
Hardware: PC Linux
: P4 major
Assignee: Ken Sharp
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2016-03-03 07:10 UTC by Tomasz Kuchta
Modified: 2017-10-02 05:38 UTC (History)
2 users (show)

See Also:
Customer:
Word Size: ---


Attachments
The document that crashes ps2pdf (5.19 MB, application/pdf)
2016-03-03 07:10 UTC, Tomasz Kuchta
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Tomasz Kuchta 2016-03-03 07:10:02 UTC
Created attachment 12364 [details]
The document that crashes ps2pdf

ps2pdf crashes on a document that can be opened e.g. by Evince and Okular.
I have tested that on Ubuntu 15.10, with Ghostscript 9.16.


The file is "481945.pdf", from Govdocs1 data set (http://digitalcorpora.org/corpora/govdocs)

The file can be found in the following archive: http://digitalcorpora.org/corp/files/govdocs1/zipfiles/481945.zip

I would be grateful for confirming.
Comment 1 Robin Watts 2016-03-03 07:21:57 UTC
The engineer responsible for this code is travelling at the moment, but I suspect he'd say:

Could you retest with 9.18 please? (or the latest version from git). Lots of bugs have been solved in this area recently.

Also, could you please try to report the problem using ghostscript directly rather than calling via a script?

Something like:

 gs -sDEVICE=pdfwrite -o out.pdf 481945.pdf

One obvious other question might be why you are feeding a .pdf file to ps2pdf :)
Comment 2 Tomasz Kuchta 2016-03-03 07:32:28 UTC
Hi Robin,

I'm using ps2pdf because it's known to have this feature of recovering broken PDF documents (I'm not sure if the document is corrupt though). Am I wrong to do that?

gs -sDEVICE=pdfwrite -o out.pdf 481945.pdf 

also ends with a segfault: 

gs -sDEVICE=pdfwrite -o out.pdf 481945.pdf
GPL Ghostscript 9.16 (2015-03-30)
Copyright (C) 2015 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
Processing pages 1 through 770.
Page 1
Page 2
Segmentation fault (core dumped)

I've checked that on the 9.18 binary release downloaded from 
https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs918/ghostscript-9.18-linux-x86_64.tgz


(In reply to Robin Watts from comment #1)
> The engineer responsible for this code is travelling at the moment, but I
> suspect he'd say:
> 
> Could you retest with 9.18 please? (or the latest version from git). Lots of
> bugs have been solved in this area recently.
> 
> Also, could you please try to report the problem using ghostscript directly
> rather than calling via a script?
> 
> Something like:
> 
>  gs -sDEVICE=pdfwrite -o out.pdf 481945.pdf
> 
> One obvious other question might be why you are feeding a .pdf file to
> ps2pdf :)
Comment 3 Robin Watts 2016-03-03 07:48:11 UTC
(In reply to Tomasz Kuchta from comment #2)
> Hi Robin,
> 
> I'm using ps2pdf because it's known to have this feature of recovering
> broken PDF documents (I'm not sure if the document is corrupt though). Am
> I wrong to do that?

That's reasonable, I guess, though it doesn't "recover" a document so much as make a completely new one that contains the same visual contents.

> I've checked that on the 9.18 binary release downloaded from 
> https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/
> gs918/ghostscript-9.18-linux-x86_64.tgz

And that goes wrong too? Perfect. I'm sure Ken will look when he gets a mo.

Could you attach the file to the bug directly please? Links to other sites have  a habit of going stale...

Thanks.
Comment 4 Tomasz Kuchta 2016-03-03 07:50:18 UTC
Hi Robin,

Thanks. I've attached the file. 

(In reply to Robin Watts from comment #3)
> (In reply to Tomasz Kuchta from comment #2)
> > Hi Robin,
> > 
> > I'm using ps2pdf because it's known to have this feature of recovering
> > broken PDF documents (I'm not sure if the document is corrupt though). Am
> > I wrong to do that?
> 
> That's reasonable, I guess, though it doesn't "recover" a document so much
> as make a completely new one that contains the same visual contents.
> 
> > I've checked that on the 9.18 binary release downloaded from 
> > https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/
> > gs918/ghostscript-9.18-linux-x86_64.tgz
> 
> And that goes wrong too? Perfect. I'm sure Ken will look when he gets a mo.
> 
> Could you attach the file to the bug directly please? Links to other sites
> have  a habit of going stale...
> 
> Thanks.
Comment 5 Marcos H. Woehrmann 2016-03-03 18:15:27 UTC
I can confirm the segfault continues with the current master and also with every version I tested back to 8.54.

Here's the stack trace:

(gdb) run -sDEVICE=pdfwrite -o test.pdf ./481945.pdf 
Starting program: /home/marcos/artifex/ghostpdl/debugbin/gs -sDEVICE=pdfwrite -o test.pdf ./481945.pdf
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
GPL Ghostscript GIT PRERELEASE 9.19 (2015-09-23)
Copyright (C) 2015 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
Processing pages 1 through 770.
Page 1
Page 2

Program received signal SIGSEGV, Segmentation fault.
__memcpy_avx_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:146
146     ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S: No such file or directory.
(gdb) where
#0  __memcpy_avx_unaligned () at ../sysdeps/x86_64/multiarch/memcpy-avx-unaligned.S:146
#1  0x0000000000691b22 in sputs (s=0x7fffffffbb00, str=0x0, wlen=4, pn=0x7fffffffb868) at ./base/stream.c:580
#2  0x00000000004714b5 in gs_function_ElIn_serialize (pfn=0x2776ff0, s=0x7fffffffbb00) at ./base/gsfunc3.c:223
#3  0x000000000046b940 in gx_serialize_device_n_map (pcs=0x2777150, m=0x27771e0, s=0x7fffffffbb00) at ./base/gscdevn.c:735
#4  0x00000000005466da in gx_serialize_Separation (pcs=0x2777150, s=0x7fffffffbb00) at ./base/gscsepr.c:515
#5  0x0000000000726594 in pdf_color_space_named (pdev=0x1fe7948, pis=0x1f85ab8, pvalue=0x7fffffffbd90, ppranges=0x7fffffffbd80, pcs_in=0x2777150, pcsn=0xc3c300 <pdf_color_space_names>, by_name=1, res_name=0x0, name_length=0, keepICC=0)
    at ./devices/vector/gdevpdfc.c:1020
#6  0x0000000000732928 in write_color_unchanged (pdev=0x1fe7948, pis=0x1f85ab8, pcc=0x26296b0, current=0x7fffffffbf70, psc=0x1fe9948, ppscc=0xc63c00 <psdf_set_stroke_color_commands>, used_process_color=0x1fe96c8, pcs=0x2777150, pdc=0x2629540)
    at ./devices/vector/gdevpdfg.c:532
#7  0x0000000000735d06 in new_pdf_reset_color (pdev=0x1fe7948, pis=0x1f85ab8, pdc=0x2629540, psc=0x1fe9948, used_process_color=0x1fe96c8, ppscc=0xc63c00 <psdf_set_stroke_color_commands>) at ./devices/vector/gdevpdfg.c:1440
#8  0x0000000000737008 in pdf_reset_color (pdev=0x1fe7948, pis=0x1f85ab8, pdc=0x2629540, psc=0x1fe9948, used_process_color=0x1fe96c8, ppscc=0xc63c00 <psdf_set_stroke_color_commands>) at ./devices/vector/gdevpdfg.c:1679
#9  0x00000000007379e7 in pdf_set_drawing_color (pdev=0x1fe7948, pis=0x1f85ab8, pdc=0x2629540, psc=0x1fe9948, used_process_color=0x1fe96c8, ppscc=0xc63c00 <psdf_set_stroke_color_commands>) at ./devices/vector/gdevpdfg.c:1891
#10 0x0000000000728c3a in pdf_setstrokecolor (vdev=0x1fe7948, pis=0x1f85ab8, pdc=0x2629540) at ./devices/vector/gdevpdfd.c:155
#11 0x000000000077a21a in gdev_vector_update_color (vdev=0x1fe7948, pis=0x1f85ab8, pdcolor=0x2629540, sc=0x1fe9948, setcolor=0x728b64 <pdf_setstrokecolor>) at ./base/gdevvec.c:402
#12 0x000000000077a866 in gdev_vector_prepare_stroke (vdev=0x1fe7948, pis=0x1f85ab8, params=0x7fffffffcd20, pdcolor=0x2629540, scale=10) at ./base/gdevvec.c:545
#13 0x000000000072d433 in gdev_pdf_stroke_path (dev=0x1fe7948, pis=0x1f85ab8, ppath=0x1fa2f50, params=0x7fffffffcd20, pdcolor=0x2629540, pcpath=0x2628f10) at ./devices/vector/gdevpdfd.c:1488
#14 0x0000000000a08dd0 in gx_stroke_fill (ppath=0x1fa2f50, pgs=0x1f85ab8) at ./base/gxpaint.c:69
#15 0x00000000008f78a7 in do_stroke (pgs=0x1f85ab8) at ./base/gspaint.c:466
#16 0x00000000008f799a in gs_stroke (pgs=0x1f85ab8) at ./base/gspaint.c:500
#17 0x0000000000ae058d in zstroke (i_ctx_p=0x1fa1d10) at ./psi/zpaint.c:41
#18 0x0000000000a8ef39 in do_call_operator (op_proc=0xae0572 <zstroke>, i_ctx_p=0x1fa1d10) at ./psi/interp.c:86
#19 0x0000000000a91b2b in interp (pi_ctx_p=0x1f52ad0, pref=0x7fffffffd710, perror_object=0x7fffffffd960) at ./psi/interp.c:1298
#20 0x0000000000a8f7fb in gs_call_interp (pi_ctx_p=0x1f52ad0, pref=0x7fffffffd870, user_errors=1, pexit_code=0x7fffffffd958, perror_object=0x7fffffffd960) at ./psi/interp.c:510
#21 0x0000000000a8f5fb in gs_interpret (pi_ctx_p=0x1f52ad0, pref=0x7fffffffd870, user_errors=1, pexit_code=0x7fffffffd958, perror_object=0x7fffffffd960) at ./psi/interp.c:468
#22 0x0000000000a80b05 in gs_main_interpret (minst=0x1f52a30, pref=0x7fffffffd870, user_errors=1, pexit_code=0x7fffffffd958, perror_object=0x7fffffffd960) at ./psi/imain.c:243
#23 0x0000000000a81cad in gs_main_run_string_end (minst=0x1f52a30, user_errors=1, pexit_code=0x7fffffffd958, perror_object=0x7fffffffd960) at ./psi/imain.c:661
#24 0x0000000000a81b25 in gs_main_run_string_with_length (minst=0x1f52a30, str=0x2033020 "<2e2f3438313934352e706466>.runfile", length=34, user_errors=1, pexit_code=0x7fffffffd958, perror_object=0x7fffffffd960) at ./psi/imain.c:619
#25 0x0000000000a81a97 in gs_main_run_string (minst=0x1f52a30, str=0x2033020 "<2e2f3438313934352e706466>.runfile", user_errors=1, pexit_code=0x7fffffffd958, perror_object=0x7fffffffd960) at ./psi/imain.c:601
#26 0x0000000000a856a4 in run_string (minst=0x1f52a30, str=0x2033020 "<2e2f3438313934352e706466>.runfile", options=3) at ./psi/imainarg.c:981
#27 0x0000000000a8561e in runarg (minst=0x1f52a30, pre=0xfbf663 "", arg=0x7fffffffe90c "./481945.pdf", post=0xfbf81d ".runfile", options=3) at ./psi/imainarg.c:971
#28 0x0000000000a85290 in argproc (minst=0x1f52a30, arg=0x7fffffffe90c "./481945.pdf") at ./psi/imainarg.c:904
#29 0x0000000000a8346b in gs_main_init_with_args (minst=0x1f52a30, argc=5, argv=0x7fffffffe588) at ./psi/imainarg.c:239
#30 0x0000000000463a95 in main (argc=5, argv=0x7fffffffe588) at ./psi/gs.c:96
(gdb)
Comment 6 Ken Sharp 2016-03-04 11:17:43 UTC
Fixed in commit f71dca797cbcdf0430fd8009c6c517baed62b4cb