Bug #1030357 “crash with SIGSEGV in cairo, when evince tries to ...” : Bugs : evince package : Ubuntu

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-26:

#14

When trying to print certain PDF documents (an example is [1]) I get completely broken print output. This can already be seen in the print preview [2].

Downgrading to cairo 1.10 fixes the problem.

[1] http://www.comdirect.de/pbl/ePdfTracker.do?ePageId=cori2444
[2] http://people.debian.org/~biebl/evince.png

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-06-26:

#15

I can't reproduce the bug. What version of cairo and poppler are you using? Evince prints in pdf format. Can you print to a pdf file and attach the output. Or alternatively use pdftocairo to generate the pdf output.

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-26:

#16

(In reply to comment #1)
> I can't reproduce the bug. What version of cairo and poppler are you using?

evince: 3.4.0
poppler: 0.18.4
cairo: 1.12.2

> Evince prints in pdf format. Can you print to a pdf file and attach the output.
> Or alternatively use pdftocairo to generate the pdf output.

original pdf document attached and the one generated by evince using print-to-pdf

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-26:

#17

Created attachment 63485
original PDF

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-26:

#18

Created attachment 63486
print-to-file PDF

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-26:

#19

(In reply to comment #4)
> Created attachment 63486 [details]
> print-to-file PDF

(In reply to comment #2)
> (In reply to comment #1)
> > I can't reproduce the bug. What version of cairo and poppler are you using?
>
> evince: 3.4.0
> poppler: 0.18.4
> cairo: 1.12.2

Just tested current head of the 1.12 branch (f228769) but still no luck.

Downgrading to cairo 1.10 though fixes the problem reliably.

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-06-27:

#20

I have tested the pdf file with cairo 1.12.2 and poppler 0.18.4 on both 64-bit Ubuntu 12.04 and Debian Testing and still can not reproduce the bug.

The only other option I can think of is to provide you with a patch containing some printfs that you can use to obtain some debug information that may help me find the cause.

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-27:

#21

(In reply to comment #6)
> I have tested the pdf file with cairo 1.12.2 and poppler 0.18.4 on both 64-bit
> Ubuntu 12.04 and Debian Testing and still can not reproduce the bug.

Might be hardware/driver related, dunno.

I'm using a Sandybridge laptop with
xserver-xorg-video-intel 2.19.0

> The only other option I can think of is to provide you with a patch containing
> some printfs that you can use to obtain some debug information that may help me
> find the cause.

Sure, I'm happy to test such a patch.

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-06-27:

#22

(In reply to comment #7)
> (In reply to comment #6)
> > I have tested the pdf file with cairo 1.12.2 and poppler 0.18.4 on both 64-bit
> > Ubuntu 12.04 and Debian Testing and still can not reproduce the bug.
>
> Might be hardware/driver related, dunno.
>
> I'm using a Sandybridge laptop with
> xserver-xorg-video-intel 2.19.0
>

Hm, I can trivially reproduce the bug in a qemu VM with debian testing.

Revision history for this message

In freedesktop.org Bugzilla #51443, Psychon-d (psychon-d) wrote on 2012-06-27:

#23

Download full text (4.0 KiB)

I can reproduce this (debian testing amd64). Here's what git bisect says:

6ed0c6224b763e9cbcfb0d46f188883d8425bab5 is the first bad commit
commit 6ed0c6224b763e9cbcfb0d46f188883d8425bab5
Author: Chris Wilson <email address hidden>
Date: Fri Jul 29 13:03:59 2011 +0100

pdf: Remove redundant clip regions

If the extents of the operation is wholly contained within the clip
region, then we can safely not invoke any clipping.

Signed-off-by: Chris Wilson <email address hidden>

:040000 040000 42e4cbdf15d9d1a7a92da02d2fa291c68c6ea6b7 8bef42b00d2da3b1a14e895bb51a598335ba3972 M src

I checked twice and it really does work before this commit. However, trying to revert this changes ontop of current master (by hand) didn't make this work again.

Now someone please tell me how ignoring a clip can cause misplaced glyphs...

In case it turns out that this wasn't the faulty commit:

$ git bisect log
git bisect start
# bad: [9f52261dd7941ec7b338b050479da25c2571f9ac] xcb: Correctly handle a recording surface's extents
git bisect bad 9f52261dd7941ec7b338b050479da25c2571f9ac
# good: [4938e11ffe11781e4e294092807ebc67f362eac6] version: Bump for 1.10.2 release
git bisect good 4938e11ffe11781e4e294092807ebc67f362eac6
# skip: [6b3d53646eb7aa3f13a0a6d133ec2ffcd1df8fdd] image: peek through a snapshot to the recording surface behind
git bisect skip 6b3d53646eb7aa3f13a0a6d133ec2ffcd1df8fdd
# good: [c0dc933efda7672b07e188a1195821340f911a66] xcb: Remove CAIRO_XCB_RENDER_HAS_COMPOSITE_SPANS
git bisect good c0dc933efda7672b07e188a1195821340f911a66
# bad: [2209ec5a15f535b1fae19c84b796f3d11a12de00] test: Make cairo_test_suite depend upon the any2ppm exectuable on all platforms
git bisect bad 2209ec5a15f535b1fae19c84b796f3d11a12de00
# bad: [6155348966b89a216d2e5ee0b4784507a0226a9f] default-context: Do not allow restoring pushed gstates
git bisect bad 6155348966b89a216d2e5ee0b4784507a0226a9f
# good: [e775db35d9306b74867f981a08d253562b15cffd] xcb: Move cairo_xcb_picture_t to cairo-xcb-private.h
git bisect good e775db35d9306b74867f981a08d253562b15cffd
# good: [04ef07ee3bdeab9b2b3d74547214c6735ebb27b3] clip: Embed a single box to avoid a common allocation
git bisect good 04ef07ee3bdeab9b2b3d74547214c6735ebb27b3
# good: [aad2c3dd0f7a512e6d3db087bf94ab53e30e92ed] gl: Use cairo_rectangle_int_t
git bisect good aad2c3dd0f7a512e6d3db087bf94ab53e30e92ed
# skip: [74a86a76a9c32a74d63712b718c90669889820e6] clipper: Detect a incremental change in the general clip-path
git bisect skip 74a86a76a9c32a74d63712b718c90669889820e6
# good: [89cb071d14f02f062d6960b9c49bced8212d032b] script: Initialize recording extents
git bisect good 89cb071d14f02f062d6960b9c49bced8212d032b
# skip: [7c6e1b8db89420fa69ebd8d2ba12dde1aeb47ea8] xcb: Short-circuit multiplying the alpha mask by 1.0
git bisect skip 7c6e1b8db89420fa69ebd8d2ba12dde1aeb47ea8
# bad: [d2ea8bd070f3bff87ec952af490093375cbc1f05] build: Respect CFLAGS and LIBS env settings
git bisect bad d2ea8bd070f3bff87ec952af490093375cbc1f05
# skip: [4032c86127a5f1658c2bddbf1c642fb62e21a208] fallback: Prevent recursion when combining with the clip
git bisect skip 4032c86127a5f1658c2bddbf1c642fb62e21a208
# bad: [0660f62fe5ffdd86...

I can reproduce this (debian testing amd64). Here's what git bisect says:

6ed0c6224b763e9cbcfb0d46f188883d8425bab5 is the first bad commit
commit 6ed0c6224b763e9cbcfb0d46f188883d8425bab5
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Fri Jul 29 13:03:59 2011 +0100

pdf: Remove redundant clip regions
    
    If the extents of the operation is wholly contained within the clip
    region, then we can safely not invoke any clipping.
    
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

:040000 040000 42e4cbdf15d9d1a7a92da02d2fa291c68c6ea6b7 8bef42b00d2da3b1a14e895bb51a598335ba3972 M	src

I checked twice and it really does work before this commit. However, trying to revert this changes ontop of current master (by hand) didn't make this work again.

Now someone please tell me how ignoring a clip can cause misplaced glyphs...

In case it turns out that this wasn't the faulty commit:

$ git bisect log
git bisect start
# bad: [9f52261dd7941ec7b338b050479da25c2571f9ac] xcb: Correctly handle a recording surface's extents
git bisect bad 9f52261dd7941ec7b338b050479da25c2571f9ac
# good: [4938e11ffe11781e4e294092807ebc67f362eac6] version: Bump for 1.10.2 release
git bisect good 4938e11ffe11781e4e294092807ebc67f362eac6
# skip: [6b3d53646eb7aa3f13a0a6d133ec2ffcd1df8fdd] image: peek through a snapshot to the recording surface behind
git bisect skip 6b3d53646eb7aa3f13a0a6d133ec2ffcd1df8fdd
# good: [c0dc933efda7672b07e188a1195821340f911a66] xcb: Remove CAIRO_XCB_RENDER_HAS_COMPOSITE_SPANS
git bisect good c0dc933efda7672b07e188a1195821340f911a66
# bad: [2209ec5a15f535b1fae19c84b796f3d11a12de00] test: Make cairo_test_suite depend upon the any2ppm exectuable on all platforms
git bisect bad 2209ec5a15f535b1fae19c84b796f3d11a12de00
# bad: [6155348966b89a216d2e5ee0b4784507a0226a9f] default-context: Do not allow restoring pushed gstates
git bisect bad 6155348966b89a216d2e5ee0b4784507a0226a9f
# good: [e775db35d9306b74867f981a08d253562b15cffd] xcb: Move cairo_xcb_picture_t to cairo-xcb-private.h
git bisect good e775db35d9306b74867f981a08d253562b15cffd
# good: [04ef07ee3bdeab9b2b3d74547214c6735ebb27b3] clip: Embed a single box to avoid a common allocation
git bisect good 04ef07ee3bdeab9b2b3d74547214c6735ebb27b3
# good: [aad2c3dd0f7a512e6d3db087bf94ab53e30e92ed] gl: Use cairo_rectangle_int_t
git bisect good aad2c3dd0f7a512e6d3db087bf94ab53e30e92ed
# skip: [74a86a76a9c32a74d63712b718c90669889820e6] clipper: Detect a incremental change in the general clip-path
git bisect skip 74a86a76a9c32a74d63712b718c90669889820e6
# good: [89cb071d14f02f062d6960b9c49bced8212d032b] script: Initialize recording extents
git bisect good 89cb071d14f02f062d6960b9c49bced8212d032b
# skip: [7c6e1b8db89420fa69ebd8d2ba12dde1aeb47ea8] xcb: Short-circuit multiplying the alpha mask by 1.0
git bisect skip 7c6e1b8db89420fa69ebd8d2ba12dde1aeb47ea8
# bad: [d2ea8bd070f3bff87ec952af490093375cbc1f05] build: Respect CFLAGS and LIBS env settings
git bisect bad d2ea8bd070f3bff87ec952af490093375cbc1f05
# skip: [4032c86127a5f1658c2bddbf1c642fb62e21a208] fallback: Prevent recursion when combining with the clip
git bisect skip 4032c86127a5f1658c2bddbf1c642fb62e21a208
# bad: [0660f62fe5ffdd86eedf8262f3ac50fb039491c1] gl: Rectilinear fast path
git bisect bad 0660f62fe5ffdd86eedf8262f3ac50fb039491c1
# skip: [2787ef4e73fe668edbb938aa82ab569789a39116] pattern: Complete the list of possible pattern errors
git bisect skip 2787ef4e73fe668edbb938aa82ab569789a39116
# bad: [488c94220d46f10a0fa8fa4dfb1beda88d80988e] ps: Apply the clip reduction techniques from pdf
git bisect bad 488c94220d46f10a0fa8fa4dfb1beda88d80988e
# skip: [6ec24760b32da5ca1f0a67f6ff344b91f8bc020c] device: Flush on a finished device is a no-op
git bisect skip 6ec24760b32da5ca1f0a67f6ff344b91f8bc020c
# good: [29a302cc4bc7734129bca8fe242dc7ecb626895d] clipper: Also need to guard against the incoming clip being NULL
git bisect good 29a302cc4bc7734129bca8fe242dc7ecb626895d
# bad: [6ed0c6224b763e9cbcfb0d46f188883d8425bab5] pdf: Remove redundant clip regions
git bisect bad 6ed0c6224b763e9cbcfb0d46f188883d8425bab5

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-02:

#24

Created attachment 63699
patch1

Here's a patch to print some debug information.

Revision history for this message

In freedesktop.org Bugzilla #51443, Psychon-d (psychon-d) wrote on 2012-07-02:

#25

Created attachment 63710
Output for Adrian's patch

I applied the patch to current git master (64d65f72e), compiled cairo, downloaded girokonto_einzelantrag.pdf, opened the file in evince and did a print preview (Result: Broken output in the preview).

The output from evince is attached.

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-03:

#26

Created attachment 63756
debug patch 2

The glyph widths are correctly extracted from the font. But for some reason the widths written to the broken pdf file are all zero as shown below. This patch prints some more debug info.

5 0 obj
<< /Type /Font
   /Subtype /Type1
   /BaseFont /GQIBIR+Dax-Medium
   /FirstChar 32
   /LastChar 252
   /FontDescriptor 56 0 R
   /Encoding /WinAnsiEncoding
   /Widths [ 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 ]
    /ToUnicode 54 0 R
>>
endobj

Revision history for this message

In freedesktop.org Bugzilla #51443, Psychon-d (psychon-d) wrote on 2012-07-03:

#27

Created attachment 63780
Output of debug patch v2 (lots of 0 here and some (uint64_t)INT32_MAX)

Revision history for this message

In freedesktop.org Bugzilla #51443, Psychon-d (psychon-d) wrote on 2012-07-03:

#28

Created attachment 63781
Debug 3 patch

Now that I had something to look for, I could do some debugging myself. fonts->units_per_em is set to this "evil value" in cairo-cff-subset.c:1142. See next attachment.

@Adrian: What can we do to figure out what happened to the operand?

Revision history for this message

In freedesktop.org Bugzilla #51443, Psychon-d (psychon-d) wrote on 2012-07-03:

#29

Created attachment 63782
Output from debug 3 patch (wow, what a bad name...)

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-03:

#30

Created attachment 63787
patch4

The operand is in binary. I suspect the problem is in decode_real. This patch prints some info from decode_real.

Revision history for this message

In freedesktop.org Bugzilla #51443, Psychon-d (psychon-d) wrote on 2012-07-03:

#31

Created attachment 63788
Output from patch 4

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-03:

#32

The problem is in decode_real it converts a BCD string to ASCII than uses sscanf to convert to a double. The value it is trying to decode is "0.001". In locales where the decimal separator is not '.' this fails.

I'll work on a patch to fix this.

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-03:

#33

Created attachment 63789
fix

This patch should fix the bug.

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-03:

#34

Hi Adrian,

(In reply to comment #19)
> Created attachment 63789 [details] [review]
> fix
>
> This patch should fix the bug.

I can confirm that this patch fixes the print output for this particular PDF.

I do have other PDFs thought which still do not produce proper print output.
Attached as original PDF 2 / print-to-file PDF 2.

Note the broken DKB header (missing letters) in print-to-file PDF 2.
Basically the same issue. Works perfectly with cairo 1.10 and regresses with 1.12.

I'm not sure if you want to track this as a se

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-03:

#35

Sorry, hit send too early.

(In reply to comment #20)
>
> I'm not sure if you want to track this as a se

I'm not sure if you want to track this as a separate bug report or not.

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-03:

#36

Created attachment 63790
original PDF 2

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-03:

#37

Created attachment 63791
print-to-file PDF 2

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-03:

#38

The file at http://people.debian.org/~biebl/cairo/orig3.pdf crashes evince when trying to use the print preview or print-to-file. Again, works fine with cairo 1.10.

This file exceeds the 3MB limit, so I didn't directly attach it to this bug report.

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-03:

#39

Created attachment 63792
backtrace for evince crash when trying to pring orig3.pdf

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-05:

#40

(In reply to comment #25)
> Created attachment 63792 [details]
> backtrace for evince crash when trying to pring orig3.pdf

This bug has already been fixed in master.

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-05:

#41

Fixes for orig.pdf and orig2.pdf have been committed.

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-05:

#42

*** Bug 51747 has been marked as a duplicate of this bug. ***

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-05:

#43

(In reply to comment #26)
> (In reply to comment #25)
> > Created attachment 63792 [details]
> > backtrace for evince crash when trying to pring orig3.pdf
>
> This bug has already been fixed in master.

Great. Can you point me to the relevant commit?

Revision history for this message

In freedesktop.org Bugzilla #51443, Michael Biebl (mbiebl) wrote on 2012-07-05:

#44

(In reply to comment #29)
> (In reply to comment #26)
> > (In reply to comment #25)
> > > Created attachment 63792 [details]
> > > backtrace for evince crash when trying to pring orig3.pdf
> >
> > This bug has already been fixed in master.
>
> Great. Can you point me to the relevant commit?

btw, would it be possible to cherry-pick those fixes for the 1.12 branch and release a 1.12.4?

Revision history for this message

In freedesktop.org Bugzilla #51443, Adrian Johnson (ajohnson-redneon) wrote on 2012-07-05:

#45

(In reply to comment #29)
> (In reply to comment #26)
> > (In reply to comment #25)
> > > Created attachment 63792 [details]
> > > backtrace for evince crash when trying to pring orig3.pdf
> >
> > This bug has already been fixed in master.
>
> Great. Can you point me to the relevant commit?

http://cgit.freedesktop.org/cairo/commit/?id=2f1d6b27e8b78c77346a5b603114b54400e57d83

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-07-28:

#1

PDF that Evince can't print without crashing Edit (628.6 KiB, application/pdf)
Dependencies.txt Edit (3.6 KiB, text/plain; charset="utf-8")
Disassembly.txt Edit (615 bytes, text/plain; charset="utf-8")
ProcMaps.txt Edit (64.7 KiB, text/plain; charset="utf-8")
ProcStatus.txt Edit (813 bytes, text/plain; charset="utf-8")
Registers.txt Edit (779 bytes, text/plain; charset="utf-8")
RelatedPackageVersions.txt Edit (136 bytes, text/plain; charset="utf-8")
Stacktrace.txt Edit (2.3 KiB, text/plain; charset="utf-8")
ThreadStacktrace.txt Edit (6.7 KiB, text/plain; charset="utf-8")

description:	updated
visibility:	private → public

Revision history for this message

Apport retracing service (apport) wrote on 2012-07-28:

#2

StacktraceTop:
decode_integer (p=0x0, integer=integer@entry=0x7fff13456140) at /build/buildd/cairo-1.12.2/src/cairo-cff-subset.c:241
cairo_cff_font_read_top_dict (font=0x7fed31dea8a0) at /build/buildd/cairo-1.12.2/src/cairo-cff-subset.c:1185
cairo_cff_font_read_font (font=0x7fed31dea8a0) at /build/buildd/cairo-1.12.2/src/cairo-cff-subset.c:1321
cairo_cff_font_generate (length=<synthetic pointer>, data=<synthetic pointer>, font=0x7fed31dea8a0) at /build/buildd/cairo-1.12.2/src/cairo-cff-subset.c:2545
_cairo_cff_subset_init (cff_subset=cff_subset@entry=0x7fff134563f0, subset_name=subset_name@entry=0x7fff13456460 "CairoFont-2-0", font_subset=font_subset@entry=0x7fff13456560) at /build/buildd/cairo-1.12.2/src/cairo-cff-subset.c:2928

Revision history for this message

Apport retracing service (apport) wrote on 2012-07-28: Stacktrace.txt

#3

Stacktrace.txt Edit (7.9 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2012-07-28: StacktraceSource.txt

#4

StacktraceSource.txt Edit (6.7 KiB, text/plain)

Revision history for this message

Apport retracing service (apport) wrote on 2012-07-28: ThreadStacktrace.txt

#5

ThreadStacktrace.txt Edit (18.0 KiB, text/plain)

Changed in evince (Ubuntu):
importance:	Undecided → Medium
tags:	removed: need-amd64-retrace

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-07-28: Re: evince crashed with SIGSEGV when trying to print this PDF file

#6

I'm not not too practiced at reading stacktraces, but maybe this bug is in cairo, and not actually in the evince code. I'll look into that more if I get a chance.

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2012-07-29:

#7

Seems trivially repeatable given the instructions; I'm on Quantal; looking in the source of cairo I see (cairo-cff-subset.c:1181):

    operand = cff_dict_get_operands (font->top_dict, CHARSET_OP, &size);
    if (font->is_cid && !operand)
        return CAIRO_INT_STATUS_UNSUPPORTED;

decode_integer (operand, &offset);

It's segging the decode_integer and it looks like operand is null; so (without knowing anything about the datastructure!) I wonder if that's supposed to be an || !operand ?

Dave

Changed in cairo (Ubuntu):
importance:	Undecided → Medium
status:	New → Triaged

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-07-29:

#8

I think you nailed it right away! I patched and built cairo, and evince doesn't crash. :)

Changed in evince (Ubuntu):
status:	New → Invalid
description:	updated

Edward Donovan (edward.donovan) on 2012-07-29

summary:

- evince crashed with SIGSEGV when trying to print this PDF file
+ crash with SIGSEGV in cairo, when evince tries to print this PDF file

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-07-29:

#9

Found it reported in Debian, too. Don't see it yet in Gnome bugzilla.

Revision history for this message

Ubuntu Foundations Team Bug Bot (crichton) wrote on 2012-07-29:

#10

The attachment "one-line patch for cairo-cff-subset.c, as suggested by Dave Gilbert" of this bug report has been identified as being a patch. The ubuntu-reviewers team has been subscribed to the bug report so that they can review the patch. In the event that this is in fact not a patch you can resolve this situation by removing the tag 'patch' from the bug report and editing the attachment so that it is not flagged as a patch. Additionally, if you are member of the ubuntu-reviewers team please also unsubscribe the team from this bug report.

[This is an automated message performed by a Launchpad user owned by Brian Murray. Please contact him regarding any issues with the action taken in this bug report.]

tags:

added: patch

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2012-07-29:

#11

Edward: Might be worth checking with a Cairo dev; I mean there might be an underlying cause as to why that end cff_dict_get_operands returned null.

Dave

Jamie Strandboge (jdstrand) on 2012-07-30

tags:

removed: apparmor

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-07-31:

#13

Oh! It's an f.d.o. project, not gnome as I mis-guessed.

I eventually found a report there, and it looks like it's been fixed in the trunk this month. I can't tell if a release may be upcoming, or if Ubuntu may want to incorporate this, sooner.

The patch does indeed rewrite this code, rather than just changing the operator:

http://cgit.freedesktop.org/cairo/commit/?id=2f1d6b27e8b78c77346a5b603114b54400e57d83

Haven't tested the new version against this PDF yet; I'll try to.

Dave - thanks again.

Bug Watch Updater (bug-watch-updater) on 2012-07-31

Changed in cairo:
importance:	Unknown → Medium
status:	Unknown → Fix Released

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-07-31:

#46

Launchpad translates the upstream bugzilla's Fixed status as Fix Released, but Fix Committed would be more accurate here.

Bug Watch Updater (bug-watch-updater) on 2012-08-17

Changed in cairo (Debian):
status:	Unknown → New

Revision history for this message

Felix Möller (felix-derklecks) wrote on 2012-08-26:

#47

Any chance to have this in the Ubuntu package? Already four duplicates ...

Revision history for this message

Thomas Ward (teward) wrote on 2012-08-26:

#48

This is marked as Triaged, so its waiting for dev fixing.

Felix, is this already fixed in Quantal? If it is, then if you can find the patch and attach it to here, we might be able to SRU it. If it is *not* yet in Quantal, it needs fixed there first, then it can be SRU'd to Precise. Note that for QUantal, it should be fixed in Debian as well, if the fix is not yet there (according to the Debian bug, it is not yet fixed there)

------
Thomas Ward
LPID: trekcaptainusa-tw

Revision history for this message

Felix Möller (felix-derklecks) wrote on 2012-08-26:

#49

Hi Thomas, I am already on Quantal and it is not fixed there. I was hoping that it could be cherry picked from upstream git into quantal.

Revision history for this message

Dave Gilbert (ubuntu-treblig) wrote on 2012-08-26:

#50

Thomas: see comment #45 - imported from upstream's bug tracker, & Edwards #13 - there is a query on the upstream tracker about backporting it to current cairo versions, but no one has responded.

http://cgit.freedesktop.org/cairo/commit/?id=2f1d6b27e8b78c77346a5b603114b54400e57d83

still looks like the bug is in Debian's 1.12.2 package.

Dave

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-08-27:

#51

upstream's fixes, combined into one patch Edit (5.6 KiB, text/plain)

So, in June and July, upstream developer Adrian Johnson made 5 commits to cairo-cff-subset.c, to fix this bug. Here they are in one patch. I've built and tested it.

Would it be more helpful to upload this to LP as a branch? I haven't done that before, but if I get time I can learn the steps. Thanks.

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-08-27:

#52

Here's the upstream git log for cairo-cff-subset.c :

http://cgit.freedesktop.org/cairo/log/src/cairo-cff-subset.c

The attached patch collects the five changes between 2012-06-07 and 2012-07-31.

The valgrind warning may not be needed, but it seemed safer to me to take all his updates to this point, together, given that the result looks quite stable. More testing would be great, of course. Thanks!

Revision history for this message

Sebastien Bacher (seb128) wrote on 2012-08-27:

#53

Thanks Edward, subscribing ubuntu-sponsors for review and setting to "fix commited" since it's fixed upstream, it would still be good to backport the fix to Ubuntu

Changed in cairo (Ubuntu):
status:	Triaged → Fix Committed

Revision history for this message

Edward Donovan (edward.donovan) wrote on 2012-08-28:

#54

That's great, Sebastien. :)

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-09-29:

#55

This bug was fixed in the package cairo - 1.12.2-1ubuntu2

---------------
cairo (1.12.2-1ubuntu2) quantal; urgency=low

  * Cherry-pick fixes from upstream (LP: #1030357)
    Thanks to Edward Donovan for the patch.
    - cff subsetting: widths can be floating point
    - cff: initialise variable to prevent valgrind warning
    - cff: use correct size for buffer
    - cff: convert '.' to locale specific decimal point before using sscanf
    - cff-subsetting: Ignore charset for non cid fonts
-- Stephane Graber <email address hidden> Fri, 28 Sep 2012 15:20:19 -0400

Changed in cairo (Ubuntu):
status:	Fix Committed → Fix Released

Bug Watch Updater (bug-watch-updater) on 2012-10-30

Changed in cairo (Debian):
status:	New → Confirmed

Bug Watch Updater (bug-watch-updater) on 2013-01-31

Changed in cairo (Debian):
status:	Confirmed → Fix Released

Ubuntu
evince package

crash with SIGSEGV in cairo, when evince tries to print this PDF file

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Patches

Bug attachments

Remote bug watches

	Status	Importance	Assigned to
cairo	Fix Released	Medium	freedesktop-bugs #51443
cairo (Debian)	Fix Released	Unknown	debbugs #682673
cairo (Ubuntu)	Fix Released	Medium	Unassigned
evince (Ubuntu)	Invalid	Medium	Unassigned

Ubuntuevince package

crash with SIGSEGV in cairo, when evince tries to print this PDF file

Bug Description

Related branches

Duplicates of this bug

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Ubuntu
evince package