Bug 690338

I had a look at the original launchpad bug. I can't reproduce with trunk or
jaunty's binary (8.64.dfsg.1-0ubuntu2). Assuming it's one of the system test
pages, I tried:

cat /usr/share/cups/data/testprint.ps | debugobj/gs -dQUIET -dPARANOIDSAFER
-dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout
-I/usr/share/cups/fonts -sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595
-dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8 -dcupsColorOrder=0
-dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c -f -_ | md5sum

cat /usr/share/system-config-printer/testpage-a4.ps | debugobj/gs -dQUIET
-dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr
-sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaType=Plain -r720x360
-dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8
-dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c
-f -_ | md5sum

cat /usr/share/system-config-printer/testpage-letter.ps | debugobj/gs -dQUIET
-dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups -sstdout=%stderr
-sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaType=Plain -r720x360
-dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8
-dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c
-f -_ | md5sum

and with /usr/bin/gs. Command line based on the launchpad report. No segfaults.
This is on x86_64 though.

We're not going to be able to do anything without a reproducible command-line
and file.

I succeeded to reproduce the bug on 64-bit with the following command line:

cat /usr/share/system-config-printer/testpage-a4.ps |
/usr/lib/cups/filter/pstopdf 1 1 1 1 '' | gs -dPARANOIDSAFER -dNOPAUSE -dBATCH
-sDEVICE=cups -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts
-sMediaType=Plain -r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842
-dcupsBitsPerColor=8 -dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5
-scupsPageSizeName=A4 -c -f -_ > output

I get a segfault and the file "output" stays empty.

See also the Ubuntu bug report mentioned above and in addition this bug report
containing the backtrace info produced by my command line:

https://bugs.launchpad.net/ubuntu/+source/ghostscript/+bug/345576

Created attachment 4852 [details]
pdf-testpage-a4.pdf

PDF input file which causes the crash. Created by

cat /usr/share/system-config-printer/testpage-a4.ps |
/usr/lib/cups/filter/pstopdf 1 1 1 1 '' > pdf-testpage-a4.pdf

on Ubuntu Jaunty.

Using this file, the following Ghostscript command line causes the crash:

cat pdf-testpage-a4.pdf | gs -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups
-sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts -sMediaType=Plain
-r720x360 -dDEVICEWIDTHPOINTS=595 -dDEVICEHEIGHTPOINTS=842 -dcupsBitsPerColor=8
-dcupsColorOrder=0 -dcupsColorSpace=1 -dcupsRowFeed=5 -scupsPageSizeName=A4 -c
-f -_ > x

Simpler command line which still segfaults. It contains only the color space
parameters for the "cups" device.

gs -sDEVICE=cups -sOutputFile=x -dcupsBitsPerColor=8 -dcupsColorOrder=0
-dcupsColorSpace=1 -dcupsRowFeed=5 pdf-testpage-a4.pdf

The following is sufficient to reproduce for me:

debugobj/gs -sDEVICE=cups -o /dev/null -dcupsColorSpace=1 pdf-testpage-a4.pdf

valgrind reports some unitialized value decisions in the garbage collector
before the final attempt to execute a null transform proc. Running with -dNOGC
the segfault still happens, but the gc report is replaced by several hundred
unitialized value warnings in errprintf called from cups_put_params.

Since the file runs ok with other devices, the cups parameter handling
clobbering memory seems a likely place to look.

https://bugs.launchpad.net/bugs/343171 seems to be the same problem.

Problem seems to be that there is no get_color_comp_index() function in
cups/gdevcups.c.

Input data format (PDF or PostScript) does not matter.

gs -sDEVICE=cups -o /dev/null -dcupsColorSpace=1
/usr/share/system-config-printer/testpage-a4.ps

crashes as well.

Created attachment 4864 [details]
testpage-a4.ps

Example PostScript file of the previous comment.

Fixed in SVN repository, rev 9595.

rev 9595 was only a bad workaround, leading to color corruption with other files. The real fix is rev 11120 in the SVN repository.