Bug 689269

Summary:	Seg fault during pdf_find_same_resource
Product:	Ghostscript	Reporter:	Ray Johnston <ray.johnston>
Component:	PDF Writer	Assignee:	leonardo <leonardo>
Status:	NOTIFIED FIXED
Severity:	normal	CC:	mmuskens
Priority:	P2
Version:	master
Hardware:	All
OS:	All
Customer:	411	Word Size:	---
Attachments:	patch for gdevpdfu.c

Description Ray Johnston 2007-06-11 11:07:20 UTC

The file causes a Seg fault when converting to PDF using:

   gswin32c -sDEVICE=pdfwrite -o bmw.pdf bmw.eps

The segfault happens in pdf_find_same_resource when attempting to
compare a cos_dict to a cos_array, both in the resourceFunction chain.

A patch that prevents comparing incompatible types is attached.

Analysis is needed to determine if the function data (created with alloc_aside
as cos_generic, then later changed to cos_array) should be in this chain, or
in some other chain.

Comment 1 Ray Johnston 2007-06-11 11:09:13 UTC

Created attachment 3012 [details]
BMW.eps

Adobe Illustrator file that triggers the problem (actually EPSF format)

Comment 2 Ray Johnston 2007-06-11 11:11:02 UTC

Created attachment 3013 [details]
patch for gdevpdfu.c

Comment 3 Ray Johnston 2007-06-11 11:11:34 UTC

Customer bug priority

Comment 4 leonardo 2007-06-13 11:28:05 UTC

rev 8045 with the patch applied has an unexpected regression with pdfwrite 311-
03.ps . Raster devs are fine. The effect is pretty strange, now analyzing it.

Comment 5 leonardo 2007-06-13 12:47:45 UTC

rev 8045 with no path fails also. So the failure is unrelated to the patch. Rev 
8022 doesn't fail.

Comment 6 leonardo 2007-06-13 16:30:09 UTC

The patch has been committed to HEAD as
http://ghostscript.com/pipermail/gs-cvs/2007-June/007629.html
The regression mentioned in Comment #4,5 appears to be unrelated to the patch.
I'll open a separate bug report for it when I understand the effect better. Now 
it is too hard to reproduce.

Comment 7 Ray Johnston 2007-06-14 00:48:19 UTC

Original bug fixed by my patch.

Unrelated problem mentioned in comment #4,5 will be opened as a separate
bug when confirmed.

Comment 8 leonardo 2007-06-17 11:15:57 UTC

The problem mentioned in Comment #4,5 is described in bug 689284.