Bug 689366

Summary:	Most japanese market printer drivers produce zero-length output/floating point exceptions
Product:	Ghostscript	Reporter:	Till Kamppeter <till.kamppeter>
Component:	Printer Driver	Assignee:	Default assignee <ghostpdl-bugs>
Status:	NOTIFIED FIXED
Severity:	normal	CC:	htl10
Priority:	P4
Version:	master
Hardware:	All
OS:	All
Customer:		Word Size:	---
Attachments:	CUPS test page with which the bug occurred patch

Description Till Kamppeter 2007-07-25 13:46:17 UTC

If I run the following command line

cat /usr/share/cups/data/testprint.ps | gs -q -dBATCH -dPARANOIDSAFER -dQUIET
-dNOPAUSE -sDEVICE=rpdl -sOutputFile=- - | cat - > x

The file x will have zero-length, which means that the driver has no output at
all on a valid PostScript input file.

If I do (direct output into x, no pipe)

cat /usr/share/cups/data/testprint.ps | gs -q -dBATCH -dPARANOIDSAFER -dQUIET
-dNOPAUSE -sDEVICE=rpdl -sOutputFile=x -

I get

Floating point exception (core dumped)

Ghostscript version is a recent (yesterday) snapshot of the trunf of the SVN
repo, so it is more or less GS 8.60.

Comment 1 Alex Cherepanov 2007-07-25 16:07:06 UTC

Please attach the sample file. Different versions of cups may have different
samples. Please also specify your platform and OS. This bug cannot happen on
all platforms because x86 doesn't detect floating point exceptions and MS Windows
doesn't dump core.

Comment 2 Till Kamppeter 2007-07-25 16:56:39 UTC

This is on Ubuntu Gutsy 32-bit x86 Linux and Ubuntu Feisty 64-bit x86 Linux.

On both systems I get the described results.

Comment 3 Till Kamppeter 2007-07-25 16:58:36 UTC

Created attachment 3206 [details]
CUPS test page with which the bug occurred

Test page of CUPS 1.2.x as it comes with the current Ubuntu distributions. The
problem occurred with this test page.

Comment 4 Alex Cherepanov 2007-07-26 13:41:29 UTC

The problem is reproduced on peeves with:
  gs -sDEVICE=rpdl -sOutputFile=x -c showpage

The immediate cause of the crash is division by 0 in 
rpdl_print_page_copies( ...... )
{ 
   .....
   int maxY = lprn->BlockLine / lprn->nBh * lprn->nBh;
   .....
}

nBh seems to be initialised and a non-0 value is reported by currentpagedevice
but it's value is 0 at the rendering time. Probably, the structure is only
partly copied.

Comment 5 Till Kamppeter 2007-07-26 14:05:58 UTC

Same behavior with the "bjc880j" driver:

------------------------------------------------------------------------------
till@till-desktop:~/printing-tests$ cat /usr/share/cups/data/testprint.ps | gs
-q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=bjc880j -sOutputFile=- -
-sOutputFile=- - | cat -> x
till@till-desktop:~/printing-tests$ ls -l x
-rw-r--r-- 1 till till 0 2007-07-26 22:09 x
till@till-desktop:~/printing-tests$ cat /usr/share/cups/data/testprint.ps | gs
-q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=bjc880j -sOutputFile=- -
-sOutputFile=x -
Floating point exception (core dumped)
till@till-desktop:~/printing-tests$ 
------------------------------------------------------------------------------

Comment 6 Till Kamppeter 2007-07-26 14:18:56 UTC

There are more drivers with this problem, here a list:

- rpdl
- bjc880v
- lips4
- lips3
- lips2p
- lips4v
- lp2000
- escpage

It seems that all drivers for japanese market laser printer vector PDLs are
affected by this bug.

Comment 7 Till Kamppeter 2007-07-26 14:49:21 UTC

Also

- npdl

is affected.

Comment 8 Alex Cherepanov 2007-07-26 21:30:39 UTC

Created attachment 3226 [details]
patch 

Add a missing member to the initializer macro for the device structure of
Japanese laser printer vector PDLs. Fix a FPE crash. Bug 689366.

The patch is committed as a rev. 8146.