Bug 705836 - -dNODISPLAY result in crash
Summary: -dNODISPLAY result in crash
Status: RESOLVED FIXED
Alias: None
Product: Ghostscript
Classification: Unclassified
Component: Regression (show other bugs)
Version: 9.56.1
Hardware: PC Linux
: P4 normal
Assignee: Default assignee
URL:
Keywords:
: 705855 (view as bug list)
Depends on:
Blocks:
 
Reported: 2022-08-31 11:30 UTC by thebudget72
Modified: 2022-09-08 10:11 UTC (History)
1 user (show)

See Also:
Customer:
Word Size: ---


Attachments
Article1.pdf (759.40 KB, application/pdf)
2022-08-31 13:04 UTC, thebudget72
Details

Note You need to log in before you can comment on or make changes to this bug.
Description thebudget72 2022-08-31 11:30:36 UTC
With Ghostscript 9.56.1 the following results in an error:

```
$ gs-9561 -q -dNOSAFER -dNODISPLAY -c '(article1.pdf) (r) file runpdfbegin pdfpagecount = quit'
32
free(): double free detected in tcache 2
Aborted (core dumped)
```

With Ghostscript 9.55.0 no error is thrown:

```
$ gs-9550 -q -dNOSAFER -dNODISPLAY -c '(article1.pdf) (r) file runpdfbegin pdfpagecount = quit'
32
```

With Ghostscript 9.56.1 the error disappear if we remove the -dNODISPLAY option:

```
$ gs-9561 -q -dNOSAFER -c '(article1.pdf) (r) file runpdfbegin pdfpagecount = quit'
32
```
Comment 1 Ken Sharp 2022-08-31 11:58:53 UTC
(In reply to thebudget72 from comment #0)

> $ gs-9561 -q -dNOSAFER -dNODISPLAY -c '(article1.pdf) (r) file runpdfbegin
> pdfpagecount = quit'
> 32
> free(): double free detected in tcache 2
> Aborted (core dumped)

You're going to have to attach the file article1.pdf before we can investigate this.

Also, if you're going to access the PDF file programatically, you should close the PDF interpreter before you execute quit.

I don't think this has anything to do with -dNODISPLAY, that simply alters the way the memory is used. Most of the time you won't get the error, but if the memory happens to be laid out in a particular way, you do.

I suspect this has already been fixed, but I'll need the actual input file to be certain.
Comment 2 thebudget72 2022-08-31 13:04:01 UTC
Created attachment 23103 [details]
Article1.pdf
Comment 3 thebudget72 2022-08-31 13:04:38 UTC
Attached article1.pdf for further investigation.
Comment 4 thebudget72 2022-08-31 13:05:36 UTC
How do I close the PDF interpreter before I execute quit?
Comment 5 Ken Sharp 2022-08-31 13:15:43 UTC
(In reply to thebudget72 from comment #4)
> How do I close the PDF interpreter before I execute quit?

Call runpdfend. If, as I suspect, this has already been fixed, that will be enough to resolve the problem in 9.56.1. You could also try the 10.00.0 release candidate which is here:

https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/tag/gs10.0.0rc1


The functions and operators for scripting the PDF interpreter are documented:

https://ghostscript.com/doc/current/Language.htm#PS_functions
Comment 6 thebudget72 2022-08-31 13:20:26 UTC
Indeed calling runpdfend fixes it :)

```
$ gs-9561 -q -dNOSAFER -dNODISPLAY -c '(article1.pdf) (r) file runpdfbegin pdfpagecount = runpdfend quit'
32
```
Comment 7 Ken Sharp 2022-08-31 13:34:17 UTC
(In reply to thebudget72 from comment #6)
> Indeed calling runpdfend fixes it :)

That's excellent, thanks for trying it. Unfortunately I cannot reproduce the problem locally. This isn't entirely surprising as it is so sensitive to the exact memory locations and the way garbage collection in Ghostscript works. It will also
be affected by how the binary was built and assuming you are using a package rather than building from source you will almost certainly be using system shared libraries instead of static linking. The exact toolchain (which C compiler, which version of the compiler etc) will cause the problem to appear/disappear/move around as well unfortunately

However, I think that this is effectively a duplicate of bug #705210 (but exhibiting slightly different symptoms) and should be fixed with commit 2a54c676fe2e5e7b5415302e7a35e34fc3e9db87

It is difficult to be certain, as noted above, but it looks awfully similar to me.

Given that you now have a work-around, and what I believe to be the underlying problem has been resolved I'm going to close this as fixed. If you still get the problem with the 10.00.0 release please reopen the report and I'll try again to reproduce it.
Comment 8 Ken Sharp 2022-09-08 10:11:48 UTC
*** Bug 705855 has been marked as a duplicate of this bug. ***