evince crashed with SIGSEGV in CairoOutputDev::setSoftMask()

Bug #209943 reported by JohnBender
8
Affects Status Importance Assigned to Milestone
Poppler
Won't Fix
Medium
poppler (Ubuntu)
Invalid
Medium
Unassigned

Bug Description

Binary package hint: evince

Hardy Beta, evince 2.22-0-0ubuntu2

Crashed when trying to open a PDF file. Problem could be with the file itself -- GIMP reported an error importing the same file. This doesn't justify a coredump, though. File is very large (31 MB), though I could provide it if someone is serious about duplicating this.

ProblemType: Crash
Architecture: amd64
Date: Mon Mar 31 17:32:05 2008
DistroRelease: Ubuntu 8.04
ExecutablePath: /usr/bin/evince
Package: evince 2.22.0-0ubuntu2
PackageArchitecture: amd64
ProcCmdline: evince file:///home/username/Documents/posters/SfN_2007_mtrax.pdf
ProcEnviron:
 PATH=/home/username/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games
 LANG=en_US.UTF-8
 SHELL=/bin/bash
Signal: 11
SourcePackage: evince
StacktraceTop:
 CairoOutputDev::setSoftMask ()
 Gfx::doSoftMask () from /usr/lib/libpoppler.so.2
 Gfx::opSetExtGState () from /usr/lib/libpoppler.so.2
 Gfx::go () from /usr/lib/libpoppler.so.2
 Gfx::display () from /usr/lib/libpoppler.so.2
Title: evince crashed with SIGSEGV in CairoOutputDev::setSoftMask()
Uname: Linux 2.6.24-12-generic x86_64
UserGroups: adm admin audio cdrom dialout dip floppy lpadmin netdev plugdev powerdev scanner video
SegvAnalysis:
 Segfault happened at: 0x7f56f666ad0e <_ZN14CairoOutputDev11setSoftMaskEP8GfxStatePdiP8FunctionP8GfxColor+222>: callq *0x28(%rax)
 PC (0x7f56f666ad0e) ok
 source "*0x28(%rax)" (0x00000028) not located in a known VMA region (needed readable region)!
SegvReason: reading NULL VMA

Tags: apport-crash
Revision history for this message
JohnBender (johnnyb01) wrote :
Revision history for this message
Apport retracing service (apport) wrote : Symbolic stack trace

StacktraceTop:CairoOutputDev::setSoftMask (this=0x6f2870, state=<value optimized out>,
Gfx::doSoftMask (this=0xa9d6c0, str=0x41e44b10, alpha=0,
Gfx::opSetExtGState (this=0xa9d6c0, args=<value optimized out>,
Gfx::go (this=0xa9d6c0, topLevel=1) at Gfx.cc:594
Gfx::display (this=0xa9d6c0, obj=0x41e44ec0, topLevel=1) at Gfx.cc:557

Revision history for this message
Apport retracing service (apport) wrote : Symbolic threaded stack trace
Changed in evince:
importance: Undecided → Medium
Revision history for this message
In , Pedro Villavicencio (pedro) wrote :
Download full text (45.0 KiB)

This report has been filed here:

https://bugs.edge.launchpad.net/ubuntu/+source/poppler/+bug/209943

"Crashed when trying to open a PDF file. Problem could be with the file itself -- GIMP reported an error importing the same file. This doesn't justify a coredump, though. File is very large (31 MB), though I could provide it if someone is serious about duplicating this."

".
Thread 2 (process 23987):
#0 0x00007f56f2d61174 in __lll_lock_wait () from /lib/libpthread.so.0
#1 0x00007f56f2d5cb08 in _L_lock_104 () from /lib/libpthread.so.0
#2 0x00007f56f2d5c470 in pthread_mutex_lock () from /lib/libpthread.so.0
#3 0x00000000004347f9 in draw_loading_text (view=0x992150, page_area=0x7fff0241ca00,
    expose_area=<value optimized out>) at /build/buildd/evince-2.22.0/./shell/ev-view.c:3658
 layout = <value optimized out>
 font_desc = <value optimized out>
 logical_rect = {x = 10683552, y = 0, width = 10095456, height = 0}
 cr = <value optimized out>
#4 0x00000000004353c6 in ev_view_expose_event (widget=0x992150, event=0x7fff0241d1d0)
    at /build/buildd/evince-2.22.0/./shell/ev-view.c:3751
 page_area = {x = 7, y = 5, width = 994, height = 730}
 border = {left = 1, right = 4, top = 1, bottom = 4}
 view = (EvView *) 0x992150
 cr = (cairo_t *) 0xa9cc00
 i = 0
#5 0x00007f56f723485f in _gtk_marshal_BOOLEAN__BOXED (closure=0x6ea180, return_value=0x7fff0241ccf0,
    n_param_values=<value optimized out>, param_values=0x7fff0241cdd0,
    invocation_hint=<value optimized out>, marshal_data=0x434910)
    at /build/buildd/gtk+2.0-2.12.9/gtk/gtkmarshalers.c:84
 data1 = (gpointer) 0x992150
 data2 = (gpointer) 0x7f56f2d645f0
 v_return = <value optimized out>
 __PRETTY_FUNCTION__ = "_gtk_marshal_BOOLEAN__BOXED"
#6 0x00007f56f58adbcf in IA__g_closure_invoke (closure=0x6ea180, return_value=0x7fff0241ccf0,
    n_param_values=2, param_values=0x7fff0241cdd0, invocation_hint=0x7fff0241ccb0)
    at /build/buildd/glib2.0-2.16.1/gobject/gclosure.c:490
 marshal = (GClosureMarshal) 0x7f56f58ac2b0 <g_type_class_meta_marshal>
 marshal_data = (gpointer) 0x188
 __PRETTY_FUNCTION__ = "IA__g_closure_invoke"
#7 0x00007f56f58c1aa8 in signal_emit_unlocked_R (node=0x6ea1f0, detail=0, instance=0x992150,
    emission_return=0x7fff0241cff0, instance_and_params=0x7fff0241cdd0)
    at /build/buildd/glib2.0-2.16.1/gobject/gsignal.c:2478
 tmp = <value optimized out>
 handler = (Handler *) 0x9cfa78
 accumulator = (SignalAccumulator *) 0x6ea270
 emission = {next = 0x7fff0241d5e0, instance = 0x992150, ihint = {signal_id = 60, detail = 0,
    run_type = G_SIGNAL_RUN_LAST}, state = EMISSION_RUN, chain_type = 10011536}
 class_closure = (GClosure *) 0x6ea180
 handler_list = (Handler *) 0x0
 return_accu = (GValue *) 0x7fff0241ccf0
 accu = {g_type = 20, data = {{v_int = 0, v_uint = 0, v_long = 0, v_ulong = 0, v_int64 = 0,
      v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}, {v_int = 0, v_uint = 0, v_long = 0,
      v_ulong = 0, v_int64 = 0, v_uint64 = 0, v_float = 0, v_double = 0, v_pointer = 0x0}}}
 signal_id = 60
 max_sequential_handler_number = 856
 return_value_altered = 0
#8 0x00007f56f58c2de6 in IA__g_signal_emit_valist (instance=0x992150, signal_id=<value optimized ou...

Revision history for this message
Pedro Villavicencio (pedro) wrote :

Thanks for your bug report. This bug has been reported to the developers of the software. You can track it and make comments here: http://bugs.freedesktop.org/show_bug.cgi?id=15304

Changed in poppler:
assignee: nobody → desktop-bugs
status: New → Triaged
Changed in poppler:
status: Unknown → Confirmed
Revision history for this message
In , Carlos Garcia Campos (carlosgc) wrote :

Is the PDF file available somewhere? without the document I can't do anything.

Kees Cook (kees)
description: updated
Changed in poppler:
importance: Unknown → Medium
Changed in poppler:
importance: Medium → Unknown
Changed in poppler:
importance: Unknown → Medium
Changed in poppler:
status: Confirmed → Won't Fix
Revision history for this message
penalvch (penalvch) wrote :
Changed in poppler (Ubuntu):
assignee: Ubuntu Desktop Bugs (desktop-bugs) → nobody
status: Triaged → Invalid
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.