Bug 691652

Summary:	gs segfault with conversion from ps to pxl via ijs and hplip
Product:	Ghostscript	Reporter:	hofer-gs
Component:	General	Assignee:	Henry Stiles <henry.stiles>
Status:	RESOLVED DUPLICATE
Severity:	major	CC:	henry.stiles, michael.vrhel, ray.johnston
Priority:	P1
Version:	master
Hardware:	PC
OS:	Linux
Customer:		Word Size:	---
Attachments:	example ps

Description hofer-gs 2010-09-29 13:24:46 UTC

The following gs command throw a seg fault with some ps documents:

gs -sPAPERSIZE=a4 -dFIXMEDIA -dFirstPage=1 -q -dBATCH -dPARANOIDSAFER -dQUIET -dNOPAUSE -sDEVICE=ijs -sIjsServer=hpijs  -sDeviceManufacturer=HEWLETT-PACKARD -dDuplex=true -dTumble=false -sIjsParams="Quality:Quality=2,Quality:ColorMode=0,Quality:MediaType=0,Quality:PenSet=0,Quality:FullBleed=0,PS:MediaPosition=7" -sDeviceModel='hp LaserJet_4' -r600  -dIjsUseOutputFD -sOutputFile=- d.ps >d-ijs.pxl

Stack trace:
£0  0x000000000065ebb7 in clist_icc_writetable ()
£1  0x000000000065f667 in clist_end_page ()
£2  0x00000000004d6ac5 in gx_pattern_cache_add_entry ()
£3  0x00000000004d711c in pattern_paint_finish ()
£4  0x00000000004e1c46 in interp ()
£5  0x00000000004e31fb in gs_interpret ()
£6  0x00000000004d7fc5 in gs_main_run_string_end ()
£7  0x00000000004d916e in run_string ()
£8  0x00000000004d98de in runarg ()
£9  0x00000000004db184 in gs_main_init_with_args ()
£10 0x0000000000464184 in main ()

I have tried to find a single page in the documents that triggers this error but failed. The gs versions with this error are:

8.72
9.00
HEAD

hplip/ijs version: 3.10.2

OS versions: linux i686 and amd64 with ubuntu 10.4 oder debian lenny

Without ijs thre is no error:
gs -sPAPERSIZE=a4 -sDEVICE=pxlmono -r600 -dBATCH -dNOPAUSE -sOutputFile=d-gs_pxl.pxl d.ps


I have several ps documents with the same error (one is attached).

Comment 1 hofer-gs 2010-09-29 13:25:59 UTC

Created attachment 6760 [details]
example ps

Comment 2 hofer-gs 2010-09-29 14:34:50 UTC

Due to other tests i work on, i have tried the above gs command with an extra option (MaxPatternBitmap). Now it works without segfault.

The smallest value for this option, used on the attached ps, that works is 26000000.

Comment 3 Ray Johnston 2011-08-30 16:23:51 UTC

Henry graciously agreed to take this one. I don't have any particular background
for this bug anyway. Also I am not sure why it is P1 other than being a segv.

Comment 4 Henry Stiles 2011-09-28 16:38:42 UTC

(In reply to comment #3)
> Henry graciously agreed to take this one. I don't have any particular
> background
> for this bug anyway. Also I am not sure why it is P1 other than being a segv.

Has nothing to do with ijs, it is memory corruption handling the icc profiles in the clist patterns and can be reproduced with any device.

Start it from the beginning? (y or n) y
Starting program: /Users/henrys/ghostpdl/gs/debugbin/gs -r600 -sDEVICE=ppmraw -o /dev/null ~/Downloads/d.ps
GPL Ghostscript GIT PRERELEASE 9.05 (2011-03-30)
Copyright (C) 2010 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.

Program received signal EXC_BAD_ACCESS, Could not access memory.
Reason: 13 at address: 0x0000000000000000
0x00000001003d66b6 in clist_icc_writetable (cldev=0x106020c58) at gxclist.c:1078
(gdb) bt
#0  0x00000001003d66b6 in clist_icc_writetable (cldev=0x106020c58) at gxclist.c:1078
#1  0x00000001003d5b48 in clist_end_page (cldev=0x106020c58) at gxclist.c:804
#2  0x000000010010460d in gx_pattern_cache_add_entry (pis=0x102051458, fdev=0x106020c58, pctile=0x7fff5fbfda48) at gxpcmap.c:954
#3  0x0000000100106c1c in pattern_paint_finish (i_ctx_p=0x10206d778) at zpcolor.c:324
#4  0x000000010011833d in do_call_operator (op_proc=0x100106ad0 <pattern_paint_finish>, i_ctx_p=0x10206d778) at interp.c:84
#5  0x000000010011baab in interp (pi_ctx_p=0x1019142e8, pref=0x7fff5fbfeab0, perror_object=0x7fff5fbfed40) at interp.c:1163
#6  0x0000000100118d66 in gs_call_interp (pi_ctx_p=0x1019142e8, pref=0x7fff5fbfec18, user_errors=1, pexit_code=0x7fff5fbfed50, perror_object=0x7fff5fbfed40) at interp.c:490
#7  0x0000000100118b2c in gs_interpret (pi_ctx_p=0x1019142e8, pref=0x7fff5fbfec18, user_errors=1, pexit_code=0x7fff5fbfed50, perror_object=0x7fff5fbfed40) at interp.c:448
#8  0x00000001001075f9 in gs_main_interpret (minst=0x101914250, pref=0x7fff5fbfec18, user_errors=1, pexit_code=0x7fff5fbfed50, perror_object=0x7fff5fbfed40) at imain.c:239
#9  0x000000010010898e in gs_main_run_string_end (minst=0x101914250, user_errors=1, pexit_code=0x7fff5fbfed50, perror_object=0x7fff5fbfed40) at imain.c:591
#10 0x00000001001087b1 in gs_main_run_string_with_length (minst=0x101914250, str=0x1019228d0 "<2f55736572732f68656e7279732f446f776e6c6f6164732f642e7073>.runfile", length=66, user_errors=1, pexit_code=0x7fff5fbfed50, perror_object=0x7fff5fbfed40) at imain.c:549
#11 0x00000001001086c6 in gs_main_run_string (minst=0x101914250, str=0x1019228d0 "<2f55736572732f68656e7279732f446f776e6c6f6164732f642e7073>.runfile", user_errors=1, pexit_code=0x7fff5fbfed50, perror_object=0x7fff5fbfed40) at imain.c:531
#12 0x000000010010ca97 in run_string (minst=0x101914250, str=0x1019228d0 "<2f55736572732f68656e7279732f446f776e6c6f6164732f642e7073>.runfile", options=3) at imainarg.c:823
#13 0x000000010010c97f in runarg (minst=0x101914250, pre=0x100777740 "", arg=0x101916020 "/Users/henrys/Downloads/d.ps", post=0x100780102 ".runfile", options=3) at imainarg.c:813
#14 0x000000010010c4bf in argproc (minst=0x101914250, arg=0x7fff5fbffaf1 "/Users/henrys/Downloads/d.ps") at imainarg.c:746
#15 0x000000010010a5ec in gs_main_init_with_args (minst=0x101914250, argc=6, argv=0x7fff5fbff920) at imainarg.c:221
#16 0x0000000100000e32 in main (argc=6, argv=0x7fff5fbff920) at gs.c:94
(gdb)

Comment 5 Henry Stiles 2011-09-28 20:27:12 UTC

Should have been fixed with:

http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=36925c8f0864e8ecd54625011696d4bcdbc26fcc

Please reopen if it is still broken.

*** This bug has been marked as a duplicate of bug 692517 ***