<html>
<head>
<base href="https://bugs.freedesktop.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - [PATCH] Fix leak in SplashOutputDev::type3D1()"
href="https://bugs.freedesktop.org/show_bug.cgi?id=101366">101366</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>[PATCH] Fix leak in SplashOutputDev::type3D1()
</td>
</tr>
<tr>
<th>Product</th>
<td>poppler
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>Other
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>medium
</td>
</tr>
<tr>
<th>Component</th>
<td>splash backend
</td>
</tr>
<tr>
<th>Assignee</th>
<td>poppler-bugs@lists.freedesktop.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>dudul04@yahoo.fr
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=131834" name="attach_131834" title="Crasher PDF file">attachment 131834</a> <a href="attachment.cgi?id=131834&action=edit" title="Crasher PDF file">[details]</a></span>
Crasher PDF file
Rendering of attached PDF file crashes with :
{{{
$ LD_LIBRARY_PATH=poppler/.libs/ valgrind --leak-check=full --num-callers=40
utils/.libs/pdftoppm
/home/even/oss-fuzz/build/out/gdal/./crash-cb4ddf1ecdfa9bac053d787a512499147f6a62bf
> out.ppm
==10141== Memcheck, a memory error detector
==10141== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==10141== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info
==10141== Command: utils/.libs/pdftoppm
/home/even/oss-fuzz/build/out/gdal/./crash-cb4ddf1ecdfa9bac053d787a512499147f6a62bf
==10141==
Syntax Error (88311): Dictionary key must be a name object
Syntax Error (88317): Dictionary key must be a name object
Syntax Error (88319): Dictionary key must be a name object
Syntax Error (88331): Dictionary key must be a name object
Syntax Error (88337): Dictionary key must be a name object
Syntax Error (88339): Dictionary key must be a name object
Syntax Error (88351): Dictionary key must be a name object
Syntax Error (88353): Dictionary key must be a name object
Syntax Error (88355): Dictionary key must be a name object
Syntax Error (88358): Dictionary key must be a name object
Syntax Error (3938): Unknown operator 'm5'
Syntax Error (4027): Unknown operator 'm2'
Syntax Error (4076): No current point in lineto
Syntax Error (4131): No current point in lineto
Syntax Error (4131): No current point in lineto
Syntax Error (4168): Unknown operator 'T'
Syntax Error (4168): Unknown operator 'm2'
Syntax Error (4197): Illegal character ')'
Syntax Error (4212): Unknown operator 'D2'
Syntax Error (4212): Unknown operator 'D2'
Syntax Error (4212): Unknown operator 'D2'
Syntax Error (4225): Unknown operator 'D2'
Syntax Error (4240): Unknown operator 'TQ23m'
Syntax Error (4333): Unknown operator 'C'
Syntax Error (4340): Illegal character ')'
Syntax Error (4342): Unknown operator 'D2'
Syntax Error (4345): Unknown operator 'D2'
Syntax Error (4353): Unknown operator 'D2'
Syntax Error (4356): Unknown operator 'D2'
Syntax Error (4361): Unknown operator 'D2'
Syntax Error (4363): Unknown operator 'D'
Syntax Error (4364): Unknown operator 'D2'
Syntax Error (4367): Unknown operator 'D'
Syntax Error (4369): Unknown operator 'D2'
Syntax Error (4385): Unknown operator 'i.D2'
Syntax Error (4391): Unknown operator 'i.D2'
Syntax Error (4393): Unknown operator 'TQ23m'
==10141== Invalid read of size 1
==10141== at 0x4EFB9C3: SplashOutputDev::type3D1(GfxState*, double, double,
double, double, double, double) (SplashOutputDev.cc:2728)
==10141== by 0x4F4CCF8: Gfx::go(bool) (Gfx.cc:767)
==10141== by 0x4F4D1FF: Gfx::display(Object*, bool) (Gfx.cc:729)
==10141== by 0x4F967D4: Page::displaySlice(OutputDev*, double, double, int,
bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*,
void*), void*, bool) (Page.cc:601)
==10141== by 0x401B25: savePageSlice (pdftoppm.cc:225)
==10141== by 0x401B25: main (pdftoppm.cc:532)
==10141== Address 0x2 is not stack'd, malloc'd or (recently) free'd
==10141==
==10141==
==10141== Process terminating with default action of signal 11 (SIGSEGV)
==10141== Access not within mapped region at address 0x2
==10141== at 0x4EFB9C3: SplashOutputDev::type3D1(GfxState*, double, double,
double, double, double, double) (SplashOutputDev.cc:2728)
==10141== by 0x4F4CCF8: Gfx::go(bool) (Gfx.cc:767)
==10141== by 0x4F4D1FF: Gfx::display(Object*, bool) (Gfx.cc:729)
==10141== by 0x4F967D4: Page::displaySlice(OutputDev*, double, double, int,
bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*,
void*), void*, bool) (Page.cc:601)
==10141== by 0x401B25: savePageSlice (pdftoppm.cc:225)
==10141== by 0x401B25: main (pdftoppm.cc:532)
}}}
Credit to OSS Fuzz</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>