[Poppler-bugs] [Bug 67295] New: SIGTRAP - Trace/Breakpoint - evince crashes opening pdf

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=67295

          Priority: medium
            Bug ID: 67295
          Assignee: poppler-bugs at lists.freedesktop.org
           Summary: SIGTRAP - Trace/Breakpoint - evince crashes opening
                    pdf
          Severity: normal
    Classification: Unclassified
                OS: Linux (All)
          Reporter: hoffmeister.pierre at web.de
          Hardware: x86 (IA32)
            Status: NEW
           Version: unspecified
         Component: general
           Product: poppler

Created attachment 82988
  --> https://bugs.freedesktop.org/attachment.cgi?id=82988&action=edit
this pdf document crashes evince.

evince crashes on attached pdf. 

the backtrace tells it is in evince. but ther is a function in poppler that
does not read the page number properly.

poppler/poppler/Catalog.cc
int Catalog::getNumPages()

if the page number exeeds int range the type cast from double produces this
error

#0  g_logv (log_domain=0x7ffff578728e "GLib", log_level=G_LOG_LEVEL_ERROR,
format=<optimized out>, args=args at entry=0x7fffffffd3d8) at gmessages.c:981
#1  0x00007ffff57255d2 in g_log (log_domain=log_domain at entry=0x7ffff578728e
"GLib", log_level=log_level at entry=G_LOG_LEVEL_ERROR,
format=format at entry=0x7ffff5790618 "%s: overflow allocating %lu*%lu bytes") at
gmessages.c:1010
#2  0x00007ffff57240a1 in g_malloc0_n
(n_blocks=n_blocks at entry=18446744071562067969,
n_block_bytes=n_block_bytes at entry=8) at gmem.c:365
#3  0x00007ffff755fa8e in ev_view_build_height_to_page_cache
(view=view at entry=0x9e6160, cache=cache at entry=0xa72950) at ev-view.c:321
#4  0x00007ffff75688c0 in ev_view_get_height_to_page_cache (view=0x9e6160) at
ev-view.c:417
#5  setup_caches (view=0x9e6160) at ev-view.c:5170
#6  ev_view_document_changed_cb (model=0x76d460, pspec=<optimized out>,
view=0x9e6160) at ev-view.c:5340
#7  0x00007ffff5a0c2a0 in g_closure_invoke (closure=0x9e5420, return_value=0x0,
n_param_values=2, param_values=0x7fffffffd760, invocation_hint=0x7fffffffd700)
at gclosure.c:777
#8  0x00007ffff5a1f120 in signal_emit_unlocked_R (node=node at entry=0x67b0b0,
detail=detail at entry=1029, instance=instance at entry=0x76d460,
emission_return=emission_return at entry=0x0,
instance_and_params=instance_and_params at entry=0x7fffffffd760) at gsignal.c:3584
#9  0x00007ffff5a2730d in g_signal_emit_valist (instance=0x76d460,
signal_id=<optimized out>, detail=1029, var_args=var_args at entry=0x7fffffffd9b8)
at gsignal.c:3328
#10 0x00007ffff5a27592 in g_signal_emit (instance=<optimized out>,
signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3384
#11 0x00007ffff5a10d85 in g_object_dispatch_properties_changed
(object=0x76d460, n_pspecs=1, pspecs=0x0) at gobject.c:1042
#12 0x00007ffff5a1344b in g_object_notify_by_spec_internal (pspec=0x758ed0,
object=0x76d460) at gobject.c:1136
#13 g_object_notify (object=0x76d460,
property_name=property_name at entry=0x7ffff756fc1c "document") at gobject.c:1178
#14 0x00007ffff754f9a5 in ev_document_model_set_document (model=<optimized
out>, document=document at entry=0x756f00) at ev-document-model.c:381
#15 0x0000000000433a80 in ev_window_load_job_cb (job=0xa03320, data=<optimized
out>) at ev-window.c:1607
#16 0x00007ffff5a0c567 in _g_closure_invoke_va (closure=0xa0b2f0,
return_value=0x0, instance=0xa03320, args=0x7fffffffddf8, n_params=0,
param_types=0x0) at gclosure.c:840
#17 0x00007ffff5a26d1b in g_signal_emit_valist (instance=0xa03320,
signal_id=<optimized out>, detail=0, var_args=var_args at entry=0x7fffffffddf8) at
gsignal.c:3234
#18 0x00007ffff5a27592 in g_signal_emit (instance=<optimized out>,
signal_id=<optimized out>, detail=detail at entry=0) at gsignal.c:3384
#19 0x00007ffff7550da3 in emit_finished (job=<optimized out>) at ev-jobs.c:180
#20 emit_finished (job=<optimized out>) at ev-jobs.c:170
#21 0x00007ffff571e015 in g_main_dispatch (context=0x6ad190) at gmain.c:3058
#22 g_main_context_dispatch (context=context at entry=0x6ad190) at gmain.c:3634
#23 0x00007ffff571e358 in g_main_context_iterate
(context=context at entry=0x6ad190, block=block at entry=1,
dispatch=dispatch at entry=1, self=<optimized out>) at gmain.c:3705
#24 0x00007ffff571e414 in g_main_context_iteration (context=0x6ad190,
context at entry=0x0, may_block=may_block at entry=1) at gmain.c:3766
#25 0x00007ffff5cf34bc in g_application_run (application=0x6d14b0,
argc=argc at entry=0, argv=argv at entry=0x0) at gapplication.c:1624
#26 0x000000000041c46b in main (argc=1, argv=0x7fffffffe198) at main.c:332

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/poppler-bugs/attachments/20130725/8643aa34/attachment.html>