Bug 707137

9ee1fba489a454e6ab238bf18029664f3da29177 is the first bad commit
Author: Ken Sharp <ken.sharp@artifex.com>
Date:   Sat Jul 8 10:26:30 2023 +0100

    PostScript interpreter - revise use of ref_stack_index()

    Bug #706837 "Segfault on unknown address in real_param (iutil.c:861)"

(In reply to Pascal Desjardins from comment #0)
> We are using this command line to create PNG files from a PDF
> 
> gs -dSAFER -dBATCH -dUseCropBox -sPageList=2 -dNOPAUSE -sDEVICE=png16m
> -sOutputFile=%d.png -r600 -dDownScaleFactor=6 file.pdf

You haven't supplied an example file to test with, we need a specimen file as well.

 
> We tried different PDF and they all triggered the error so it does not seem
> to be related to a specific PDF file containing an error.

People say this a lot, you might be surprised how often it turns out that the input file *does* matter. Even if you think 'any file' will show the problem please always supply a file you *know* causes a problem, it will save time.

Created attachment 24826 [details]
Example file 1

Created attachment 24827 [details]
Example file 2

I see this too in gs 10.02.0, exactly same behavior on split, producing an output file with a blank page. It does not occur in 10.01.2 or 9*.

Test files and results by version are attached as gs_split_error.tar.gz.

$> gs -dNOPAUSE -dBATCH -dSAFER -sDEVICE=pdfwrite -dPDFA=2 -dPDFACompatibilityPolicy=1 -sPageList=2 -sOutputFile=split_signed.pdf test_signed.pdf
GPL Ghostscript 10.02.0 (2023-09-13)
Copyright (C) 2023 Artifex Software, Inc.  All rights reserved.
This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY:
see the file COPYING for details.
Error: /undefined in --runpdf--
Operand stack:   --nostringval--   2   (   **** Error: PDF interpreter encountered an error processing the file.\n)
Execution stack:   %interp_exit   .runexec2   --nostringval--   runpdf   --nostringval--   2   %stopped_push   --nostringval--   runpdf   runpdf   false   1   %stopped_push   1944   1   3   %oparray_pop   1943   1   3   %oparray_pop   1928   1   3   %oparray_pop   1929   1   3   %oparray_pop   runpdf
Dictionary stack:   --dict:754/1123(ro)(G)--   --dict:0/20(G)--   --dict:86/200(L)--   --dict:7/10(L)--
Current allocation mode is local
GPL Ghostscript 10.02.0: Unrecoverable error, exit code 1


$> gs -dNOPAUSE -dBATCH -dSAFER -sDEVICE=pdfwrite -dPDFA=2 -dPDFACompatibilityPolicy=1 -sPageList=2 -sOutputFile=slipt_unsigned.pdf test_unsigned.pdf
GPL Ghostscript 10.02.0 (2023-09-13)
Copyright (C) 2023 Artifex Software, Inc.  All rights reserved.
This software is supplied under the GNU AGPLv3 and comes with NO WARRANTY:
see the file COPYING for details.
Error: /undefined in --runpdf--
Operand stack:   --nostringval--   2   (   **** Error: PDF interpreter encountered an error processing the file.\n)
Execution stack:   %interp_exit   .runexec2   --nostringval--   runpdf   --nostringval--   2   %stopped_push   --nostringval--   runpdf   runpdf   false   1   %stopped_push   1944   1   3   %oparray_pop   1943   1   3   %oparray_pop   1928   1   3   %oparray_pop   1929   1   3   %oparray_pop   runpdf
Dictionary stack:   --dict:754/1123(ro)(G)--   --dict:0/20(G)--   --dict:86/200(L)--   --dict:7/10(L)--
Current allocation mode is local
GPL Ghostscript 10.02.0: Unrecoverable error, exit code 1

Created attachment 24828 [details]
Ghostscript 10.02.0 sPageList error samples

Refer to https://bugs.ghostscript.com/show_bug.cgi?id=707137#c5

(In reply to Pascal Desjardins from comment #0)

Thank you for the files. I will look into this as soon as I have a moment free.


(In reply to Deny Dias from comment #5)
> I see this too in gs 10.02.0, exactly same behavior on split, producing an
> output file with a blank page. It does not occur in 10.01.2 or 9*.

Please don't 'me too' on bugs, either it is the same bug and will be dealt with when someone has a chance to look into it, or it is a different bug and should be reported separately. The simplest way to discover if this is the case is to wait until the original bug is fixed and test your own problem.

(In reply to Ken Sharp from comment #7)
> Please don't 'me too' on bugs, either it is the same bug and will be dealt
> with when someone has a chance to look into it, or it is a different bug and
> should be reported separately. The simplest way to discover if this is the
> case is to wait until the original bug is fixed and test your own problem.

Right, right... things people hear when they think are helping. A 'thank you' for more samples would be much more polite. We devs...

No words from me anymore. Let'e just sit and wait for a fix.

(In reply to Deny Dias from comment #8)

> Right, right... things people hear when they think are helping. A 'thank
> you' for more samples would be much more polite.

I'm sorry you feel I was impolite, I didn't think I was, If I don't state our preferences on bug reporting, then how are people to know ?

We don't want or need more samples, one is sufficient and the original reporter had already supplied 2 (you may notice I didn't complain about getting 2 files).


(In reply to Pascal Desjardins from comment #0)
I believe this commit will resolve the problem:

9b6fe6e1008f1b9b7fc3109b5f94db8d970fbcaa

I've tested your original command line as well as odd, even, comma separated and - options.

Thank you for the report.

Hi Ken,

Last night we've updated Ghostscript to the 10.02.1 version and it seems this problem is occuring once again. 

Is it possible the fix you did was not included in the new version? 

Thanks for your help.

Have a nice day

(In reply to Pascal Desjardins from comment #10)

> Last night we've updated Ghostscript to the 10.02.1 version and it seems
> this problem is occuring once again. 
> 
> Is it possible the fix you did was not included in the new version? 

It is not included.

Any patch version number (major.minr.patch) which is not 0 is a security release. Security releases *only* include code changes required to fix the security issue(s), they are otherwise identical with the previous release.

Hi Ken,

Thanks for the quick reply, I didn't know about the version number. I will now.

Sorry for the trouble.

Have a nice day

*** Bug 707320 has been marked as a duplicate of this bug. ***