[Poppler-bugs] [Bug 84555] reproducible crash with some PDF files
bugzilla-daemon at freedesktop.org
bugzilla-daemon at freedesktop.org
Wed Oct 1 07:33:15 PDT 2014
https://bugs.freedesktop.org/show_bug.cgi?id=84555
--- Comment #4 from Albert Astals Cid <aacid at kde.org> ---
Valgrind trace when getting text of page 64 using poppler-glib-demo
==17036== Invalid write of size 8
==17036== at 0x70C3EDB: TextSelectionDumper::finishLine()
(TextOutputDev.cc:4076)
==17036== by 0x70C4119: TextSelectionDumper::endPage()
(TextOutputDev.cc:4132)
==17036== by 0x70C6A42: TextPage::getSelectionText(PDFRectangle*,
SelectionStyle) (TextOutputDev.cc:4760)
==17036== by 0x4E6AB6B: poppler_page_get_selected_text (poppler-page.cc:824)
==17036== by 0x4E6ADAA: poppler_page_get_text_for_area (poppler-page.cc:871)
==17036== by 0x417224: pgd_text_get_text (text.c:107)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== Address 0x10aeec60 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6A1F: TextPage::getSelectionText(PDFRectangle*,
SelectionStyle) (TextOutputDev.cc:4757)
==17036== by 0x4E6AB6B: poppler_page_get_selected_text (poppler-page.cc:824)
==17036== by 0x4E6ADAA: poppler_page_get_text_for_area (poppler-page.cc:871)
==17036== by 0x417224: pgd_text_get_text (text.c:107)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036==
==17036== Invalid read of size 8
==17036== at 0x70C41D7: TextSelectionDumper::getText()
(TextOutputDev.cc:4152)
==17036== by 0x70C6A4E: TextPage::getSelectionText(PDFRectangle*,
SelectionStyle) (TextOutputDev.cc:4762)
==17036== by 0x4E6AB6B: poppler_page_get_selected_text (poppler-page.cc:824)
==17036== by 0x4E6ADAA: poppler_page_get_text_for_area (poppler-page.cc:871)
==17036== by 0x417224: pgd_text_get_text (text.c:107)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== Address 0x10aeec60 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6A1F: TextPage::getSelectionText(PDFRectangle*,
SelectionStyle) (TextOutputDev.cc:4757)
==17036== by 0x4E6AB6B: poppler_page_get_selected_text (poppler-page.cc:824)
==17036== by 0x4E6ADAA: poppler_page_get_text_for_area (poppler-page.cc:871)
==17036== by 0x417224: pgd_text_get_text (text.c:107)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036==
==17036== Invalid read of size 8
==17036== at 0x70C3D65: TextSelectionDumper::~TextSelectionDumper()
(TextOutputDev.cc:4063)
==17036== by 0x70C6A5D: TextPage::getSelectionText(PDFRectangle*,
SelectionStyle) (TextOutputDev.cc:4762)
==17036== by 0x4E6AB6B: poppler_page_get_selected_text (poppler-page.cc:824)
==17036== by 0x4E6ADAA: poppler_page_get_text_for_area (poppler-page.cc:871)
==17036== by 0x417224: pgd_text_get_text (text.c:107)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== Address 0x10aeec60 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6A1F: TextPage::getSelectionText(PDFRectangle*,
SelectionStyle) (TextOutputDev.cc:4757)
==17036== by 0x4E6AB6B: poppler_page_get_selected_text (poppler-page.cc:824)
==17036== by 0x4E6ADAA: poppler_page_get_text_for_area (poppler-page.cc:871)
==17036== by 0x417224: pgd_text_get_text (text.c:107)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036==
==17036== Invalid write of size 8
==17036== at 0x70C3EDB: TextSelectionDumper::finishLine()
(TextOutputDev.cc:4076)
==17036== by 0x70C4119: TextSelectionDumper::endPage()
(TextOutputDev.cc:4132)
==17036== by 0x70C6AD8: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4772)
==17036== by 0x4E6D81F: poppler_page_get_text_layout_for_area
(poppler-page.cc:2187)
==17036== by 0x41729C: pgd_text_get_text (text.c:117)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== Address 0x142d2290 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6AB5: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4769)
==17036== by 0x4E6D81F: poppler_page_get_text_layout_for_area
(poppler-page.cc:2187)
==17036== by 0x41729C: pgd_text_get_text (text.c:117)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036==
==17036== Invalid read of size 8
==17036== at 0x4E6D874: poppler_page_get_text_layout_for_area
(poppler-page.cc:2194)
==17036== by 0x41729C: pgd_text_get_text (text.c:117)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D747: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x5188410: gtk_button_button_release (gtkbutton.c:1940)
==17036== Address 0x142d2290 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6AB5: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4769)
==17036== by 0x4E6D81F: poppler_page_get_text_layout_for_area
(poppler-page.cc:2187)
==17036== by 0x41729C: pgd_text_get_text (text.c:117)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036==
==17036== Invalid read of size 8
==17036== at 0x4E6D966: poppler_page_get_text_layout_for_area
(poppler-page.cc:2208)
==17036== by 0x41729C: pgd_text_get_text (text.c:117)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D747: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x5188410: gtk_button_button_release (gtkbutton.c:1940)
==17036== Address 0x142d2290 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6AB5: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4769)
==17036== by 0x4E6D81F: poppler_page_get_text_layout_for_area
(poppler-page.cc:2187)
==17036== by 0x41729C: pgd_text_get_text (text.c:117)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036==
==17036== Invalid write of size 8
==17036== at 0x70C3EDB: TextSelectionDumper::finishLine()
(TextOutputDev.cc:4076)
==17036== by 0x70C4119: TextSelectionDumper::endPage()
(TextOutputDev.cc:4132)
==17036== by 0x70C6AD8: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4772)
==17036== by 0x4E6E098: poppler_page_get_text_attributes_for_area
(poppler-page.cc:2372)
==17036== by 0x4172F4: pgd_text_get_text (text.c:123)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== Address 0x14027570 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6AB5: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4769)
==17036== by 0x4E6E098: poppler_page_get_text_attributes_for_area
(poppler-page.cc:2372)
==17036== by 0x4172F4: pgd_text_get_text (text.c:123)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036==
==17036== Invalid read of size 8
==17036== at 0x4E6E0D4: poppler_page_get_text_attributes_for_area
(poppler-page.cc:2378)
==17036== by 0x4172F4: pgd_text_get_text (text.c:123)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036== by 0x5189A54: gtk_real_button_released (gtkbutton.c:2103)
==17036== by 0x6363244: g_closure_invoke (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637480A: signal_emit_unlocked_R (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D747: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x5188410: gtk_button_button_release (gtkbutton.c:1940)
==17036== Address 0x14027570 is 0 bytes after a block of size 2,048 alloc'd
==17036== at 0x4C2ABA0: malloc (vg_replace_malloc.c:296)
==17036== by 0x6F9A756: gmalloc(unsigned long, bool) (gmem.cc:110)
==17036== by 0x6F9A976: gmallocn(int, int, bool) (gmem.cc:192)
==17036== by 0x6F9A99A: gmallocn (gmem.cc:196)
==17036== by 0x70C3CEC: TextSelectionDumper::TextSelectionDumper(TextPage*)
(TextOutputDev.cc:4052)
==17036== by 0x70C6AB5: TextPage::getSelectionWords(PDFRectangle*,
SelectionStyle, int*) (TextOutputDev.cc:4769)
==17036== by 0x4E6E098: poppler_page_get_text_attributes_for_area
(poppler-page.cc:2372)
==17036== by 0x4172F4: pgd_text_get_text (text.c:123)
==17036== by 0x6363473: _g_closure_invoke_va (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D056: g_signal_emit_valist (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x637D9AE: g_signal_emit (in
/usr/lib/x86_64-linux-gnu/libgobject-2.0.so.0.4105.0)
==17036== by 0x51899FC: gtk_button_do_release (gtkbutton.c:1985)
==17036==
--
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freedesktop.org/archives/poppler-bugs/attachments/20141001/e22bc06d/attachment-0001.html>
More information about the Poppler-bugs
mailing list