Ubuntu
poppler package

evince crashed with SIGSEGV in JPXStream::readTilePartData()

Bug #599439 reported by smpahlman on 2010-06-28

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	Poppler	Unknown	Medium	freedesktop-bugs #29615
	poppler (Ubuntu)	Triaged	Medium	Unassigned

Bug Description

evince crashes with the following valgrind output when opening the attached file.

$ valgrind evince sample.pdf
==12903== Memcheck, a memory error detector.
==12903== Copyright (C) 2002-2008, and GNU GPL'd, by Julian Seward et al.
==12903== Using LibVEX rev 1884, a library for dynamic binary translation.
==12903== Copyright (C) 2004-2008, and GNU GPL'd, by OpenWorks LLP.
==12903== Using valgrind-3.4.1-Debian, a dynamic binary instrumentation framework.
==12903== Copyright (C) 2000-2008, and GNU GPL'd, by Julian Seward et al.
==12903== For more details, rerun with: -v
==12903==
Error: PDF file is damaged - attempting to reconstruct xref table...
==12903== Thread 2:
==12903== Use of uninitialised value of size 4
==12903== at 0x4E1E47F: JPXStream::readTilePartData(unsigned int, unsigned int, int) (JPXStream.cc:1951)
==12903== by 0x4E1F5CD: JPXStream::readTilePart() (JPXStream.cc:1924)
==12903== by 0x4E20766: JPXStream::readCodestream(unsigned int) (JPXStream.cc:1366)
==12903== by 0x4E225C9: JPXStream::readBoxes() (JPXStream.cc:735)
==12903== by 0x4E227EC: JPXStream::reset() (JPXStream.cc:272)
==12903== by 0x4EA33E2: ImageStream::reset() (Stream.cc:419)
==12903== by 0x4739923: CairoOutputDev::drawSoftMaskedImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, Stream*, int, int, GfxImageColorMap*) (CairoOutputDev.cc:1485)
==12903== by 0x4E5C9B5: Gfx::doImage(Object*, Stream*, int) (Gfx.cc:3857)
==12903== by 0x4E60894: Gfx::opXObject(Object*, int) (Gfx.cc:3526)
==12903== by 0x4E52AB9: Gfx::execOp(Object*, Object*, int) (Gfx.cc:771)
==12903== by 0x4E5307E: Gfx::go(int) (Gfx.cc:642)
==12903== by 0x4E55AEE: Gfx::display(Object*, int) (Gfx.cc:611)
==12903==
==12903== Use of uninitialised value of size 4
==12903== at 0x4E1E48A: JPXStream::readTilePartData(unsigned int, unsigned int, int) (JPXStream.cc:1952)
==12903== by 0x4E1F5CD: JPXStream::readTilePart() (JPXStream.cc:1924)
==12903== by 0x4E20766: JPXStream::readCodestream(unsigned int) (JPXStream.cc:1366)
==12903== by 0x4E225C9: JPXStream::readBoxes() (JPXStream.cc:735)
==12903== by 0x4E227EC: JPXStream::reset() (JPXStream.cc:272)
==12903== by 0x4EA33E2: ImageStream::reset() (Stream.cc:419)
==12903== by 0x4739923: CairoOutputDev::drawSoftMaskedImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, Stream*, int, int, GfxImageColorMap*) (CairoOutputDev.cc:1485)
==12903== by 0x4E5C9B5: Gfx::doImage(Object*, Stream*, int) (Gfx.cc:3857)
==12903== by 0x4E60894: Gfx::opXObject(Object*, int) (Gfx.cc:3526)
==12903== by 0x4E52AB9: Gfx::execOp(Object*, Object*, int) (Gfx.cc:771)
==12903== by 0x4E5307E: Gfx::go(int) (Gfx.cc:642)
==12903== by 0x4E55AEE: Gfx::display(Object*, int) (Gfx.cc:611)
==12903==
==12903== Conditional jump or move depends on uninitialised value(s)
==12903== at 0x4E1E509: JPXStream::readTilePartData(unsigned int, unsigned int, int) (JPXStream.cc:1977)
==12903== by 0x4E1F5CD: JPXStream::readTilePart() (JPXStream.cc:1924)
==12903== by 0x4E20766: JPXStream::readCodestream(unsigned int) (JPXStream.cc:1366)
==12903== by 0x4E225C9: JPXStream::readBoxes() (JPXStream.cc:735)
==12903== by 0x4E227EC: JPXStream::reset() (JPXStream.cc:272)
==12903== by 0x4EA33E2: ImageStream::reset() (Stream.cc:419)
==12903== by 0x4739923: CairoOutputDev::drawSoftMaskedImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, Stream*, int, int, GfxImageColorMap*) (CairoOutputDev.cc:1485)
==12903== by 0x4E5C9B5: Gfx::doImage(Object*, Stream*, int) (Gfx.cc:3857)
==12903== by 0x4E60894: Gfx::opXObject(Object*, int) (Gfx.cc:3526)
==12903== by 0x4E52AB9: Gfx::execOp(Object*, Object*, int) (Gfx.cc:771)
==12903== by 0x4E5307E: Gfx::go(int) (Gfx.cc:642)
==12903== by 0x4E55AEE: Gfx::display(Object*, int) (Gfx.cc:611)
==12903==
==12903== Use of uninitialised value of size 4
==12903== at 0x4E1E515: JPXStream::readTilePartData(unsigned int, unsigned int, int) (JPXStream.cc:1978)
==12903== by 0x4E1F5CD: JPXStream::readTilePart() (JPXStream.cc:1924)
==12903== by 0x4E20766: JPXStream::readCodestream(unsigned int) (JPXStream.cc:1366)
==12903== by 0x4E225C9: JPXStream::readBoxes() (JPXStream.cc:735)
==12903== by 0x4E227EC: JPXStream::reset() (JPXStream.cc:272)
==12903== by 0x4EA33E2: ImageStream::reset() (Stream.cc:419)
==12903== by 0x4739923: CairoOutputDev::drawSoftMaskedImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, Stream*, int, int, GfxImageColorMap*) (CairoOutputDev.cc:1485)
==12903== by 0x4E5C9B5: Gfx::doImage(Object*, Stream*, int) (Gfx.cc:3857)
==12903== by 0x4E60894: Gfx::opXObject(Object*, int) (Gfx.cc:3526)
==12903== by 0x4E52AB9: Gfx::execOp(Object*, Object*, int) (Gfx.cc:771)
==12903== by 0x4E5307E: Gfx::go(int) (Gfx.cc:642)
==12903== by 0x4E55AEE: Gfx::display(Object*, int) (Gfx.cc:611)
==12903==
==12903== Invalid read of size 4
==12903== at 0x4E1E515: JPXStream::readTilePartData(unsigned int, unsigned int, int) (JPXStream.cc:1978)
==12903== by 0x4E1F5CD: JPXStream::readTilePart() (JPXStream.cc:1924)
==12903== by 0x4E20766: JPXStream::readCodestream(unsigned int) (JPXStream.cc:1366)
==12903== by 0x4E225C9: JPXStream::readBoxes() (JPXStream.cc:735)
==12903== by 0x4E227EC: JPXStream::reset() (JPXStream.cc:272)
==12903== by 0x4EA33E2: ImageStream::reset() (Stream.cc:419)
==12903== by 0x4739923: CairoOutputDev::drawSoftMaskedImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, Stream*, int, int, GfxImageColorMap*) (CairoOutputDev.cc:1485)
==12903== by 0x4E5C9B5: Gfx::doImage(Object*, Stream*, int) (Gfx.cc:3857)
==12903== by 0x4E60894: Gfx::opXObject(Object*, int) (Gfx.cc:3526)
==12903== by 0x4E52AB9: Gfx::execOp(Object*, Object*, int) (Gfx.cc:771)
==12903== by 0x4E5307E: Gfx::go(int) (Gfx.cc:642)
==12903== by 0x4E55AEE: Gfx::display(Object*, int) (Gfx.cc:611)
==12903== Address 0x10 is not stack'd, malloc'd or (recently) free'd
==12903==
==12903== Process terminating with default action of signal 11 (SIGSEGV)
==12903== Access not within mapped region at address 0x10
==12903== at 0x4E1E515: JPXStream::readTilePartData(unsigned int, unsigned int, int) (JPXStream.cc:1978)
==12903== by 0x4E1F5CD: JPXStream::readTilePart() (JPXStream.cc:1924)
==12903== by 0x4E20766: JPXStream::readCodestream(unsigned int) (JPXStream.cc:1366)
==12903== by 0x4E225C9: JPXStream::readBoxes() (JPXStream.cc:735)
==12903== by 0x4E227EC: JPXStream::reset() (JPXStream.cc:272)
==12903== by 0x4EA33E2: ImageStream::reset() (Stream.cc:419)
==12903== by 0x4739923: CairoOutputDev::drawSoftMaskedImage(GfxState*, Object*, Stream*, int, int, GfxImageColorMap*, Stream*, int, int, GfxImageColorMap*) (CairoOutputDev.cc:1485)
==12903== by 0x4E5C9B5: Gfx::doImage(Object*, Stream*, int) (Gfx.cc:3857)
==12903== by 0x4E60894: Gfx::opXObject(Object*, int) (Gfx.cc:3526)
==12903== by 0x4E52AB9: Gfx::execOp(Object*, Object*, int) (Gfx.cc:771)
==12903== by 0x4E5307E: Gfx::go(int) (Gfx.cc:642)
==12903== by 0x4E55AEE: Gfx::display(Object*, int) (Gfx.cc:611)
==12903== If you believe this happened as a result of a stack overflow in your
==12903== program's main thread (unlikely but possible), you can try to increase
==12903== the size of the main thread stack using the --main-stacksize= flag.
==12903== The main thread stack size used in this run was 8388608.
==12903==
==12903== ERROR SUMMARY: 5 errors from 5 contexts (suppressed: 243 from 4)
==12903== malloc/free: in use at exit: 262,485,146 bytes in 86,891 blocks.
==12903== malloc/free: 263,012 allocs, 176,121 frees, 277,245,884 bytes allocated.
==12903== For counts of detected errors, rerun with: -v
==12903== Use --track-origins=yes to see where uninitialised values come from
==12903== searching for pointers to 86,891 not-freed blocks.
==12903== checked 212,587,460 bytes.
==12903==
==12903== LEAK SUMMARY:
==12903== definitely lost: 25,170 bytes in 994 blocks.
==12903== possibly lost: 202,348 bytes in 229 blocks.
==12903== still reachable: 262,257,628 bytes in 85,668 blocks.
==12903== suppressed: 0 bytes in 0 blocks.
==12903== Rerun with --leak-check=full to see details of leaked memory.
Killed

ProblemType: Crash
Architecture: i386
DistroRelease: Ubuntu 9.04
ExecutablePath: /usr/bin/evince
Package: evince 2.26.1-0ubuntu1
ProcCmdline: evince tehfu-113_2.pdf
ProcEnviron:
SHELL=/bin/bash
LANG=en_US.UTF-8
Signal: 11
SourcePackage: evince
StacktraceTop:
JPXStream::readTilePartData (this=0x9264fd8, tileIdx=3,
JPXStream::readTilePart (this=0x9264fd8)
JPXStream::readCodestream (this=0x9264fd8, len=0)
JPXStream::readBoxes (this=0x9264fd8) at JPXStream.cc:735
JPXStream::reset (this=0x9264fd8) at JPXStream.cc:272
Title: evince crashed with SIGSEGV in JPXStream::readTilePartData()
Uname: Linux 2.6.28-19-generic i686
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare

Tags:

Revision history for this message

smpahlman (sauli-pahlman) wrote on 2010-06-28:

Reproducer Edit (3.0 MiB, application/pdf)
Dependencies.txt Edit (3.8 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (1.3 KiB, text/plain; charset="utf-8")
ProcMaps.txt Edit (43.0 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (776 bytes, text/plain; charset="utf-8")
Registers.txt Edit (505 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (16.2 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (25.3 KiB, text/plain; charset="utf-8")

smpahlman (sauli-pahlman) on 2010-08-14

visibility:

private → public

Revision history for this message

In freedesktop.org Bugzilla #29615, Pedro Villavicencio (pedro) wrote on 2010-08-17:

Download full text (27.9 KiB)

this report has been filed here:

https://bugs.edge.launchpad.net/ubuntu/+source/poppler/+bug/599439

"evince crashes with the following stacktrace with the attached pdf"

pdf:

https://bugs.edge.launchpad.net/ubuntu/+source/poppler/+bug/599439/+attachment/1438081/+files/sample.pdf.gz

this report has been filed here:

https://bugs.edge.launchpad.net/ubuntu/+source/poppler/+bug/599439

"evince crashes with the following stacktrace with the attached pdf"

pdf:

https://bugs.edge.launchpad.net/ubuntu/+source/poppler/+bug/599439/+attachment/1438081/+files/sample.pdf.gz

"
Hilo 5 (Thread 0xb2f27b70 (LWP 20834)):
#0  JPXStream::readTilePartData (this=0xb5b23f10, tileIdx=3, tilePartLen=164, 
    tilePartToEOC=0) at JPXStream.cc:1951
        resLevel = 0xb5b37ac4
        subband = 0xa4
        ttVal = <value optimized out>
        cbX = <value optimized out>
        i = <value optimized out>
        tileComp = 0xb5b22348
        cbY = <value optimized out>
        n = <value optimized out>
        tile = 0xb5b24584
        precinct = 0xf703064
        bits = 258352228
        nx = <value optimized out>
        cb = <value optimized out>
        sb = 258352483
        level = <value optimized out>
#1  0x0f66516f in JPXStream::readTilePart (this=0xb5b23f10)
    at JPXStream.cc:1924
        tileComp = <value optimized out>
        subband = 0xb2f26748
        tilePartLen = 164
        tilePartIdx = 1
        precinctSize = 258352550
        nSBs = 3
        sb = 3
        nTileParts = 5
        n = <value optimized out>
        r = <value optimized out>
        style = 3002230648
        sby0 = 12408932
        segType = 147
        cb = 0xf6624ec
        tileIdx = 3
        segLen = 0
        i = <value optimized out>
        cbX = 3048357648
        tile = 0xb2f26740
        comp = 3002230816
        j = <value optimized out>
        cbY = 3002230588
        resLevel = 0xb5b57b14
        sbx0 = 56
        k = <value optimized out>
        cbi = <value optimized out>
        level = <value optimized out>
#2  0x0f665dd1 in JPXStream::readCodestream (this=0xb5b23f10, len=0)
    at JPXStream.cc:1366
        style = 22
        segLen = 10
        i = <value optimized out>
        haveQCD = 1
        j = <value optimized out>
        r = <value optimized out>
        tile = 0xb5b220e8
        segType = 144
        capabilities = 0
        haveSIZ = 1
        haveCOD = 1
        precinctSize = 17
        comp = 1
#3  0x0f667b11 in JPXStream::readBoxes (this=0xb5b23f10) at JPXStream.cc:735
        boxType = 1785737827
        boxLen = 0
        dataLen = 0
        bpc1 = 7
        unknownColorspace = 1
        ipr = 0
        i = 1
        compression = 7
        j = 1
#4  0x0f667c9d in JPXStream::reset (this=0xb5b23f10) at JPXStream.cc:272
No locales.
#5  0x0f6fa6d3 in ImageStream::reset (this=0xb5b31348) at Stream.cc:424
No locales.
#6  0x1fdfb610 in CairoOutputDev::drawSoftMaskedImage (this=0x20803400, 
    state=0xb5b22600, ref=0xb2f26c40, str=0xb5b243e0, width=3601, height=4650, 
    colorMap=0xb5b31f30, interpolate=0, maskStr=0xb5b23f10, maskWidth=3601, 
    maskHeight=4650, maskColorMap=0xb5b23408, maskInterpolate=0)
    at CairoOutputDev.cc:2124
        maskBuffer = <value optimized out>
        buffer = <value optimized out>
        y = <value optimized out>
        filter = 66
        maskFilter = 3048210552
        maskMatrix = {xx = -2.7986440511830212e-63, 
          yx = 8.4346675822179524e-181, xy = -4.8461152427267585e-50, 
          yy = 2.4208894198688419e-234, x0 = 2.7585945612584392e-313, 
          y0 = 1.9115867441958893e-234}
        matrix = {xx = 1.4274871875923142e-311, yx = 1.2731974745791634e-313, 
          xy = 3.5457948719095513e-313, yy = 4.1742140256357039e-305, 
          x0 = -4.8461181371750054e-50, y0 = 2.1892507115421206e-305}
        row_stride = 66
        maskImage = 0x54
        image = 0xbb1db0
        pix = <value optimized out>
        maskPattern = 0xbb1c7f
        pattern = <value optimized out>
#7  0x0f6adb3f in Gfx::doImage (this=0xb5b0ff38, ref=0xb2f26c40, 
    str=0xb5b243e0, inlineImg=0) at Gfx.cc:4164
        maskBits = 8
        interpolate = 0
        maskColors = {-1292735784, 259809268, 445382644, -1292735388, 
          -1292735784, 6, -1246619232, -1246619208, -1, 259809268, 259809268, 
          16, -1292735624, 259031298, -1246756848, -1292735388, 0, 12406772, 
          -1246756848, -1246638472, -1292735720, 11452211, 2, 32, 2, 
          259809268, -1292735400, -1246638472, -1292735688, 259201712, 6, 
          -1292735672, 0, -1246619232, -1246636104, -1246638472, -1292735640, 
          259201918, -1246636104, -1246638472, 13, 134, -1246589552, 0, 
          -1292735624, 258920236, -1292735400, 0, -1292735576, 258920363, 
          -1246638472, 73, -1292735592, 258920487, -1246691952, 134, 0, 
          259809268, -1246643220, 73, -1292735544, 258547859, -1246643220, 
          -1292735424}
        maskInterpolate = 0
        obj1 = {type = objNone, {booln = 0, intg = 0, uintg = 0, 
            real = 1.0889997482299805, string = 0x0, name = 0x0, array = 0x0, 
            dict = 0x0, stream = 0x0, ref = {num = 0, gen = 1072786571}, 
            cmd = 0x0}}
        maskColorSpace = <value optimized out>
        obj2 = {type = objNone, {booln = 0, intg = 0, uintg = 0, 
            real = -4.9547452488571297e-50, string = 0x0, name = 0x0, 
            array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
              gen = -1246590540}, cmd = 0x0}}
        dict = 0xb5b23e78
        haveColorKeyMask = <value optimized out>
        i = <value optimized out>
        width = 3601
        height = 4650
        colorSpace = <value optimized out>
        maskWidth = 3601
        maskHeight = 4650
        maskDict = <value optimized out>
        bits = 8
        mask = <value optimized out>
        invert = <value optimized out>
        maskObj = {type = objNull, {booln = 0, intg = 0, uintg = 0, 
            real = -4.5569137487044296e-50, string = 0x0, name = 0x0, 
            array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
              gen = -1246688088}, cmd = 0x0}}
        smaskObj = {type = objStream, {booln = -1246609648, 
            intg = -1246609648, uintg = 3048357648, 
            real = -2.7988016924151013e-63, string = 0xb5b23f10, 
            name = 0xb5b23f10 "\b4|\017\001", array = 0xb5b23f10, 
            dict = 0xb5b23f10, stream = 0xb5b23f10, ref = {num = -1246609648, 
              gen = -1292735496}, cmd = 0xb5b23f10 "\b4|\017\001"}}
        maskInvert = <value optimized out>
        maskStr = 0xb5b23f10
        csMode = streamCSDeviceRGB
#8  0x0f6b3638 in Gfx::opXObject (this=0xb5b0ff38, args=0xb2f26d34, numArgs=1)
    at Gfx.cc:3779
        obj1 = {type = objStream, {booln = -1246608416, intg = -1246608416, 
            uintg = 3048358880, real = 2.2726047308455822e-313, 
            string = 0xb5b243e0, name = 0xb5b243e0 "\b4|\017\001", 
            array = 0xb5b243e0, dict = 0xb5b243e0, stream = 0xb5b243e0, ref = {
              num = -1246608416, gen = 10}, cmd = 0xb5b243e0 "\b4|\017\001"}}
        obj3 = {type = objNone, {booln = 0, intg = 0, uintg = 0, 
            real = -4.8317921994188675e-50, string = 0x0, name = 0x0, 
            array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
              gen = -1246620688}, cmd = 0x0}}
        refObj = {type = objRef, {booln = 134, intg = 134, uintg = 134, 
            real = 6.6204796542727037e-322, string = 0x86, 
            name = 0x86 <Address 0x86 out of bounds>, array = 0x86, 
            dict = 0x86, stream = 0x86, ref = {num = 134, gen = 0}, 
            cmd = 0x86 <Address 0x86 out of bounds>}}
        name = 0xb5b10ca8 "Im0"
        obj2 = {type = objName, {booln = -1246636104, intg = -1246636104, 
            uintg = 3048331192, real = -4.5468350478649064e-50, 
            string = 0xb5b1d7b8, name = 0xb5b1d7b8 "Image", 
            array = 0xb5b1d7b8, dict = 0xb5b1d7b8, stream = 0xb5b1d7b8, ref = {
              num = -1246636104, gen = -1246690560}, cmd = 0xb5b1d7b8 "Image"}}
        opiDict = {type = objNull, {booln = 0, intg = 0, uintg = 0, 
            real = 2.453130862965955e-234, string = 0x0, name = 0x0, 
            array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
              gen = 258945809}, cmd = 0x0}}
#9  0x0f6a2716 in Gfx::execOp (this=0xb5b0ff38, cmd=0xb2f26ed4, 
    args=0xb2f26d34, numArgs=1) at Gfx.cc:840
        op = <value optimized out>
        name = 0xb5b213f0 "Do"
        argPtr = 0xb2f26d34
        i = 1
#10 0x0f6a32dc in Gfx::go (this=0xb5b0ff38, topLevel=1) at Gfx.cc:700
        timer = {start_time = {tv_sec = 1282062306, tv_usec = 705531}, 
          end_time = aviso: can't find linker symbol for virtual table for `timeval' value
aviso:   found `Lexer::getObj(Object*, int)' instead
{tv_sec = 258885133, tv_usec = 259809268}, active = 1}
        obj = {type = objCmd, {booln = -1246620688, intg = -1246620688, 
            uintg = 3048346608, real = 1728.4801853012723, 
            string = 0xb5b213f0, name = 0xb5b213f0 "Do", array = 0xb5b213f0, 
            dict = 0xb5b213f0, stream = 0xb5b213f0, ref = {num = -1246620688, 
              gen = 1083900395}, cmd = 0xb5b213f0 "Do"}}
        numArgs = 1
        i = <value optimized out>
        lastAbortCheck = 0
        args = {{type = objName, {booln = -1246688088, intg = -1246688088, 
              uintg = 3048279208, real = 1728.4801852859473, 
              string = 0xb5b10ca8, name = 0xb5b10ca8 "Im0", 
              array = 0xb5b10ca8, dict = 0xb5b10ca8, stream = 0xb5b10ca8, 
              ref = {num = -1246688088, gen = 1083900395}, 
              cmd = 0xb5b10ca8 "Im0"}}, {type = objNone, {booln = 0, intg = 0, 
              uintg = 0, real = 1728.4794921875, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = 1083900395}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = 1728.4794921875, string = 0x0, 
              name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, ref = {
                num = 0, gen = 1083900395}, cmd = 0x0}}, {type = objNone, {
              booln = 2232, intg = 2232, uintg = 2232, 
              real = 1728.4794921880075, string = 0x8b8, 
              name = 0x8b8 <Address 0x8b8 out of bounds>, array = 0x8b8, 
              dict = 0x8b8, stream = 0x8b8, ref = {num = 2232, 
                gen = 1083900395}, 
              cmd = 0x8b8 <Address 0x8b8 out of bounds>}}, {type = objNone, {
              booln = 0, intg = 0, uintg = 0, real = 1728.4794921875, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 1083900395}, cmd = 0x0}}, {type = objNone, 
            {booln = 0, intg = 0, uintg = 0, real = 1728.4794921875, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 1083900395}, cmd = 0x0}}, {type = objNone, 
            {booln = 0, intg = 0, uintg = 0, real = -4.9587746243661187e-50, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1246589552}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -4.9587746243661187e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246589552}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = 2.5097438178117895e-234, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 258992996}, cmd = 0x0}}, {type = objNone, {
              booln = 0, intg = 0, uintg = 0, real = 4.2439915819305446e-314, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 2}, cmd = 0x0}}, {type = objNone, {
              booln = 0, intg = 0, uintg = 0, real = -4.276717174848573e-50, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1246756792}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -4.9587746243661187e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246589552}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = 1.6975966327722179e-313, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 8}, cmd = 0x0}}, {type = objNone, {
              booln = 0, intg = 0, uintg = 0, real = -4.276684548326233e-50, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1246756800}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -5.1202922232102522e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246549948}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = -4.9587746243661187e-50, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1246589552}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = 4.462070725775242e-234, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = 259809268}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = -2.8000982691846878e-63, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1292734936}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = 5.4323092248710971e-312, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = 256}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = -4.5449724415279923e-50, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1246691016}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = 3.0047253499040237e-234, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = 259201918}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = -2.8002095453692085e-63, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1292734888}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = 2.1219957909652723e-314, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, gen = 1}, 
              cmd = 0x0}}, {type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -5.1202922232102522e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246549948}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = 2.3819108611527771e-234, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 258886447}, cmd = 0x0}}, {type = objNone, {
              booln = 0, intg = 0, uintg = 0, real = -2.8003208215537291e-63, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1292734840}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -4.9587746243661187e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246589552}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = 3.5590276894092623e-234, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 259432924}, cmd = 0x0}}, {type = objNone, {
              booln = 0, intg = 0, uintg = 0, real = -5.1202922232102522e-50, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1246549948}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -5.1202269701655722e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246549964}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = -2.8010904818299967e-63, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = -1292734508}, cmd = 0x0}}, {
            type = objNone, {booln = 0, intg = 0, uintg = 0, 
              real = -4.9587746243661187e-50, string = 0x0, name = 0x0, 
              array = 0x0, dict = 0x0, stream = 0x0, ref = {num = 0, 
                gen = -1246589552}, cmd = 0x0}}, {type = objNone, {booln = 0, 
              intg = 0, uintg = 0, real = 8.4346643691717757e-181, 
              string = 0x0, name = 0x0, array = 0x0, dict = 0x0, stream = 0x0, 
              ref = {num = 0, gen = 445382644}, cmd = 0x0}}}
#11 0x0f6a3d29 in Gfx::display (this=0xb5b0ff38, obj=0xb2f26fd4, topLevel=1)
    at Gfx.cc:667
        obj2 = {type = objNone, {booln = -1246589552, intg = -1246589552, 
            uintg = 3048377744, real = 2.0544739091288128e-234, 
            string = 0xb5b28d90, name = 0xb5b28d90 "hM|\017\001", 
            array = 0xb5b28d90, dict = 0xb5b28d90, stream = 0xb5b28d90, ref = {
              num = -1246589552, gen = 258613527}, 
            cmd = 0xb5b28d90 "hM|\017\001"}}
        i = <value optimized out>
#12 0x0f6f08c0 in Page::displaySlice (this=0xb5b1af50, out=0x20803400, 
    hDPI=72, vDPI=72, rotate=0, useMediaBox=0, crop=1, sliceX=-1, sliceY=-1, 
    sliceW=-1, sliceH=-1, printing=0, catalog=0xb5b0feb0, abortCheckCbk=0, 
    abortCheckCbkData=0x0, annotDisplayDecideCbk=0, 
    annotDisplayDecideCbkData=0x0) at Page.cc:474
        gfx = 0xb5b0ff38
        obj = {type = objArray, {booln = -1246645832, intg = -1246645832, 
            uintg = 3048321464, real = 1.5060709128428942e-314, 
            string = 0xb5b1b1b8, 
            name = 0xb5b1b1b8 "\220\375\260\265б\261\265\b", 
            array = 0xb5b1b1b8, dict = 0xb5b1b1b8, stream = 0xb5b1b1b8, ref = {
              num = -1246645832, gen = 0}, 
            cmd = 0xb5b1b1b8 "\220\375\260\265б\261\265\b"}}
        i = <value optimized out>
#13 0x1fdf20f1 in _poppler_page_render (page=0xb5b224a0, cairo=0x48c934, 
    printing=0) at poppler-page.cc:336
        output_dev = 0x20803400
        __PRETTY_FUNCTION__ = "void _poppler_page_render(PopplerPage*, cairo_t*, GBool)"
#14 0x0d8d62d9 in ?? () from /usr/lib/evince/2/backends/libpdfdocument.so
No symbol table info available.
#15 0x005e8568 in ev_document_render () from /usr/lib/libevdocument.so.2
No symbol table info available.
#16 0x0098e581 in ?? () from /usr/lib/libevview.so.2
No symbol table info available.
#17 0x0098b331 in ev_job_run () from /usr/lib/libevview.so.2
No symbol table info available.
#18 0x0098f328 in ?? () from /usr/lib/libevview.so.2
No symbol table info available.
#19 0x00a1687f in g_thread_create_proxy (data=0x207815a0)
    at /build/buildd/glib2.0-2.25.13/glib/gthread.c:1897
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#20 0x0073bcc9 in start_thread (arg=0xb2f27b70) at pthread_create.c:304
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = 0xb2f27b70
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {7655412, 0, 4001536, 
                -1292733688, 620034328, 661228157}, mask_was_saved = 0}}, 
          priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#21 0x00b4b6ae in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locales.

Hilo 4 (Thread 0xb64c6b70 (LWP 20829)):
#0  0x004ba416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00740884 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/i386/i686/../i486/pthread_cond_timedwait.S:236
No locales.
#2  0x007c7ede in g_cond_timed_wait_posix_impl (cond=0xfffffdfc, 
    entered_mutex=0x8, abs_time=0xb64c6198)
    at /build/buildd/glib2.0-2.25.13/gthread/gthread-posix.c:242
        result = <value optimized out>
        end_time = {tv_sec = 1282062307, tv_nsec = 125212000}
        timed_out = <value optimized out>
        __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#3  0x009c59cc in g_async_queue_pop_intern_unlocked (queue=0x206a9be0, 
    try=<value optimized out>, end_time=0xb64c6198)
    at /build/buildd/glib2.0-2.25.13/glib/gasyncqueue.c:423
        retval = <value optimized out>
        __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#4  0x00a1880b in g_thread_pool_wait_for_new_task (data=0x206ab1f8)
    at /build/buildd/glib2.0-2.25.13/glib/gthreadpool.c:269
        end_time = {tv_sec = 1282062307, tv_usec = 125212}
#5  g_thread_pool_thread_proxy (data=0x206ab1f8)
    at /build/buildd/glib2.0-2.25.13/glib/gthreadpool.c:303
        task = <value optimized out>
        pool = 0x206ab1f8
#6  0x00a1687f in g_thread_create_proxy (data=0x206aad78)
    at /build/buildd/glib2.0-2.25.13/glib/gthread.c:1897
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7  0x0073bcc9 in start_thread (arg=0xb64c6b70) at pthread_create.c:304
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = 0xb64c6b70
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {7655412, 0, 4001536, 
                -1236507896, 1490352401, 661228157}, mask_was_saved = 0}}, 
          priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#8  0x00b4b6ae in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locales.

Hilo 3 (Thread 0xb6cc7b70 (LWP 20828)):
#0  0x004ba416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00740884 in pthread_cond_timedwait@@GLIBC_2.3.2 ()
    at ../nptl/sysdeps/unix/sysv/linux/i386/i686/../i486/pthread_cond_timedwait.S:236
No locales.
#2  0x007c7ede in g_cond_timed_wait_posix_impl (cond=0xfffffdfc, 
    entered_mutex=0xa, abs_time=0xb6cc7198)
    at /build/buildd/glib2.0-2.25.13/gthread/gthread-posix.c:242
        result = <value optimized out>
        end_time = {tv_sec = 1282062307, tv_nsec = 125275000}
        timed_out = <value optimized out>
        __PRETTY_FUNCTION__ = "g_cond_timed_wait_posix_impl"
#3  0x009c59cc in g_async_queue_pop_intern_unlocked (queue=0x206a9be0, 
    try=<value optimized out>, end_time=0xb6cc7198)
    at /build/buildd/glib2.0-2.25.13/glib/gasyncqueue.c:423
        retval = <value optimized out>
        __PRETTY_FUNCTION__ = "g_async_queue_pop_intern_unlocked"
#4  0x00a1880b in g_thread_pool_wait_for_new_task (data=0x206ab1f8)
    at /build/buildd/glib2.0-2.25.13/glib/gthreadpool.c:269
        end_time = {tv_sec = 1282062307, tv_usec = 125275}
#5  g_thread_pool_thread_proxy (data=0x206ab1f8)
    at /build/buildd/glib2.0-2.25.13/glib/gthreadpool.c:303
        task = <value optimized out>
        pool = 0x206ab1f8
#6  0x00a1687f in g_thread_create_proxy (data=0x206ab1d0)
    at /build/buildd/glib2.0-2.25.13/glib/gthread.c:1897
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#7  0x0073bcc9 in start_thread (arg=0xb6cc7b70) at pthread_create.c:304
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = 0xb6cc7b70
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {7655412, 0, 4001536, 
                -1228115192, 1492449552, 661228157}, mask_was_saved = 0}}, 
          priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#8  0x00b4b6ae in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locales.

Hilo 2 (Thread 0xb74c8b70 (LWP 20827)):
#0  0x004ba416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00b3cde6 in *__GI___poll (fds=0xbd4ff4, nfds=3, timeout=-1)
    at ../sysdeps/unix/sysv/linux/poll.c:87
        resultvar = <value optimized out>
        oldtype = 0
        result = <value optimized out>
#2  0x009fcbdb in g_poll (fds=0x206a6ce0, nfds=3, timeout=-1)
    at /build/buildd/glib2.0-2.25.13/glib/gpoll.c:126
No locales.
#3  0x009ef58c in g_main_context_poll (context=0x20689cc8, 
    block=<value optimized out>, dispatch=1, self=0x20689d48)
    at /build/buildd/glib2.0-2.25.13/glib/gmain.c:3063
        poll_func = 0x9fcbb0 <g_poll>
#4  g_main_context_iterate (context=0x20689cc8, block=<value optimized out>, 
    dispatch=1, self=0x20689d48)
    at /build/buildd/glib2.0-2.25.13/glib/gmain.c:2745
        max_priority = 2147483647
        timeout = -1
        some_ready = <value optimized out>
        nfds = 3
        allocated_nfds = <value optimized out>
        fds = <value optimized out>
        __PRETTY_FUNCTION__ = "g_main_context_iterate"
#5  0x009efcf7 in g_main_loop_run (loop=0x20689ca8)
    at /build/buildd/glib2.0-2.25.13/glib/gmain.c:2958
        self = 0x20689d48
        __PRETTY_FUNCTION__ = "g_main_loop_run"
#6  0x00563084 in shared_thread_func (data=0x0)
    at /build/buildd/glib2.0-2.25.13/gio/gdbusprivate.c:247
No locales.
#7  0x00a1687f in g_thread_create_proxy (data=0x20689d48)
    at /build/buildd/glib2.0-2.25.13/glib/gthread.c:1897
        __PRETTY_FUNCTION__ = "g_thread_create_proxy"
#8  0x0073bcc9 in start_thread (arg=0xb74c8b70) at pthread_create.c:304
        __res = <value optimized out>
        __ignore1 = <value optimized out>
        __ignore2 = <value optimized out>
        pd = 0xb74c8b70
        now = <value optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {7655412, 0, 4001536, 
                -1219722488, 1494546707, 661228157}, mask_was_saved = 0}}, 
          priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, 
              cleanup = 0x0, canceltype = 0}}}
        not_first_call = <value optimized out>
        robust = <value optimized out>
        freesize = <value optimized out>
        __PRETTY_FUNCTION__ = "start_thread"
#9  0x00b4b6ae in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:130
No locales.

Hilo 1 (Thread 0xb7868850 (LWP 20824)):
#0  0x004ba416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x00b3cde6 in *__GI___poll (fds=0xbd4ff4, nfds=5, timeout=82)
    at ../sysdeps/unix/sysv/linux/poll.c:87
        resultvar = <value optimized out>
        oldtype = 0
        result = <value optimized out>
#2  0x009fcbdb in g_poll (fds=0x206ab230, nfds=5, timeout=82)
    at /build/buildd/glib2.0-2.25.13/glib/gpoll.c:126
No locales.
#3  0x009ef58c in g_main_context_poll (context=0x20646cd8, 
    block=<value optimized out>, dispatch=1, self=0x2062f028)
    at /build/buildd/glib2.0-2.25.13/glib/gmain.c:3063
        poll_func = 0x9fcbb0 <g_poll>
#4  g_main_context_iterate (context=0x20646cd8, block=<value optimized out>, 
    dispatch=1, self=0x2062f028)
    at /build/buildd/glib2.0-2.25.13/glib/gmain.c:2745
        max_priority = 2147483647
        timeout = 82
        some_ready = <value optimized out>
        nfds = 5
        allocated_nfds = <value optimized out>
        fds = <value optimized out>
        __PRETTY_FUNCTION__ = "g_main_context_iterate"
#5  0x009efcf7 in g_main_loop_run (loop=0x206b19b0)
    at /build/buildd/glib2.0-2.25.13/glib/gmain.c:2958
        self = 0x2062f028
        __PRETTY_FUNCTION__ = "g_main_loop_run"
#6  0x00fca539 in IA__gtk_main ()
    at /build/buildd/gtk+2.0-2.21.5/gtk/gtkmain.c:1237
        tmp_list = 0x0
        functions = 0x0
        init = 0x0
        loop = 0x206b19b0
#7  0x0036c252 in main ()
No symbol table info available."

Revision history for this message

In freedesktop.org Bugzilla #29615, Albert Astals Cid (aacid) wrote on 2010-08-17:

The crash is not in poppler code but in openjpeg code. Poppler uses openjpeg for JPX decoding.

openjpeg 1.3 release crashes but the code from their svn does not crash so i can only understand that new openjpeg releases will fix the crash.

http://groups.google.com/group/openjpeg/browse_thread/thread/201b1dc1623857cc

Thus i am closing the bug.

Revision history for this message

Pedro Villavicencio (pedro) wrote on 2010-08-17:

reproducible on Maverick,

Changed in poppler (Ubuntu):
importance:	Undecided → Medium
status:	New → Confirmed

Revision history for this message

Pedro Villavicencio (pedro) wrote on 2010-08-17:

Thank you for your bug report. This bug has been reported to the developers of the software. You can track it and make comments at:
https://bugs.freedesktop.org/show_bug.cgi?id=29615

Changed in poppler (Ubuntu):
status:	Confirmed → Triaged

Revision history for this message

In freedesktop.org Bugzilla #29615, Thoger-redhat (thoger-redhat) wrote on 2010-08-18:

(In reply to comment #1)
> The crash is not in poppler code but in openjpeg code. Poppler uses openjpeg
> for JPX decoding.

The file does indeed trigger crash in openjpeg (two actually, see my comment in launchpad bug), but that should be a different crash to what was reported in Ubuntu bug, as Ubuntu poppler does not seem to be using openjpeg. Poppler built without openjpeg crashes on the file too, though I don't know whether it's poppler or libjpeg to blame for that crash.

Revision history for this message

In freedesktop.org Bugzilla #29615, Albert Astals Cid (aacid) wrote on 2010-08-18:

Ah yes, Ubuntu refuses to use the better, faster and less memory intensive option. Basically i refuse to work on JPXStream given we have OpenJPEG that is much better.

Patches accepted as always.

Revision history for this message

Pedro Villavicencio (pedro) wrote on 2010-08-18:

upstream says this is a openjpeg crash, reassigning.

affects:

poppler (Ubuntu) → openjpeg (Ubuntu)

Revision history for this message

Tomas Hoger (thoger) wrote on 2010-08-18:

Guessing from:
http://packages.ubuntu.com/lucid/libpoppler5

Ubuntu poppler packages don't seem to use openjpeg (yet?, as it's in universe). Attached file triggers different crash in non-openjpeg poppler too.

openjpeg issues triggered by the file are detailed in:
https://bugzilla.redhat.com/show_bug.cgi?id=579548#c5
https://bugzilla.redhat.com/show_bug.cgi?id=609385

Tomas Hoger (thoger) on 2010-08-19

affects:

openjpeg (Ubuntu) → poppler (Ubuntu)

Bug Watch Updater (bug-watch-updater) on 2010-09-14

Changed in poppler:
importance:	Unknown → Medium
status:	Unknown → Confirmed

Revision history for this message

Apport retracing service (apport) wrote on 2010-11-26: No launchpad retracing

#10

Unsetting the need retracing tag, there is no retracer left running on that version of Ubuntu, the crash will need to be manually retraced

tags:

removed: need-i386-retrace

Bug Watch Updater (bug-watch-updater) on 2011-01-25

Changed in poppler:
importance:	Medium → Unknown

Bug Watch Updater (bug-watch-updater) on 2011-02-03

Changed in poppler:
importance:	Unknown → Medium

Revision history for this message

madbiologist (me-again) wrote on 2015-09-21:

#11

Still crashes evince on Ubuntu 14.04 "Trusty Tahr".

evince 3.10.3-0ubuntu10.2
poppler 0.24.5-2ubuntu4.2

tags:	added: jaunty maverick
tags:	added: trusty

Revision history for this message

madbiologist (me-again) wrote on 2017-10-31:

#12

On Ubuntu 17.04 "Zesty Zapus", the attached file doesn't crash evince, but most of the page is not displayed. Firefox 56.0 doesn't display any of it. Possibly a broken document?

evince 3.24.0-0ubuntu1.1
poppler 0.48.0-2ubuntu2.4

Revision history for this message

In freedesktop.org Bugzilla #29615, Gitlab-migration (gitlab-migration) wrote on 2018-08-21:

#13

-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been closed from further activity.

You can subscribe and participate further through the new bug through this link to our GitLab instance: https://gitlab.freedesktop.org/poppler/poppler/issues/336.

Bug Watch Updater (bug-watch-updater) on 2018-08-22

Changed in poppler:
status:	Confirmed → Unknown

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

freedesktop-bugs #29615
[RESOLVED MOVED] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntupoppler package

evince crashed with SIGSEGV in JPXStream::readTilePartData()

Bug Description

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
poppler package