[gs-bugs] [Bug 696845] - Ghostscript - Seg fault reading transparency_example.ps with --saved-pages-test

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

Bug ID: 696845
Summary: Seg fault reading transparency_example.ps with
--saved-pages-test
Product: Ghostscript
Version: master
Hardware: PC
OS: Linux
Status: UNCONFIRMED
Severity: normal
Priority: P4
Component: General
Assignee: ***@artifex.com
Reporter: ***@artifex.com
QA Contact: gs-***@ghostscript.com
Word Size: ---

The following command segafaults:

bin/gs -o test.ppm -sDEVICE=ppmraw --saved-pages-test -dJOBSERVER \
./tests_private/comparefiles/transparency_example.ps

gdb suggests it's a clist issue:

(gdb) where
#0 0x0000000000000000 in ?? ()
#1 0x0000000000667b19 in clist_init_data (dev=0x20a1dd8, init_data=0x0,
data_size=0) at ./base/gxclist.c:412
#2 0x0000000000667f7d in clist_reset (dev=0x20a1dd8) at ./base/gxclist.c:497
#3 0x00000000006686b9 in clist_init (dev=0x20a1dd8) at ./base/gxclist.c:573
#4 0x0000000000668c11 in clist_open (dev=0x20a1dd8) at ./base/gxclist.c:724
#5 0x000000000066dddb in do_page_save (pdev=0x20a1dd8, page=0x7fffffffb5e0,
save_files=0x7fffffffb5d0) at ./base/gxclpage.c:84
#6 0x000000000066ef40 in gx_saved_pages_list_print (pdev=0x20a1dd8,
list=0x2097098, param=0xfd5fcf " normal flush", param_size=13,
printed_count=0x7fffffffd960) at ./base/gxclpage.c:571
#7 0x000000000066fcd4 in gx_saved_pages_param_process (pdev=0x20a1dd8,
param=0xfd5fca "print normal flush", param_size=18) at ./base/gxclpage.c:870
#8 0x0000000000a839b2 in gs_main_init_with_args (minst=0x1f6ea40, argc=7,
argv=0x7fffffffe528) at ./psi/imainarg.c:247
#9 0x0000000000463d75 in main (argc=7, argv=0x7fffffffe528) at ./psi/gs.c:96
(gdb)

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

--- Comment #1 from Marcos H. Woehrmann <***@artifex.com> ---
Bisect points to commit b8a9352dac5e388de3c596371143040722fa2285 but I'm not
sure if this is reasonable:

commit b8a9352dac5e388de3c596371143040722fa2285
Author: Chris Liddell <***@artifex.com>
AuthorDate: Tue May 27 14:50:25 2014 +0100
Commit: Chris Liddell <***@artifex.com>
CommitDate: Thu Jun 12 15:07:01 2014 +0100

Bug 695258: optimize AGL name mapping.

Add a "reverse AGL" dictionary which allows us to create the extra name
mappings
with one pass over the CharStrings dictionary, rather than two passes over
the
entire AGL dictionary.

No cluster differences.

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

Chris Liddell (chrisl) <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Component|General |Security
Severity|normal |blocker
Product|Ghostscript |Security
Priority|P4 |P1
Version|master |unspecified
Group| |Security

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

Ray Johnston <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Ever confirmed|0 |1
Status|UNCONFIRMED |IN_PROGRESS

--- Comment #2 from Ray Johnston <***@artifex.com> ---
PCL/XPS remain as questions, but so far...
When a file pushes a pdf14devicefilter (or other compositor) it will
still be the currentdevice after the filter is popped when the saved
pages printing occurs. We need to check if the device is a forwarding
device (as compositors will be when deactivated) and use the target
device to print the saved pages.

Also, if a device uses the gx_default_dev_spec_op, it will return 0
from the supports_saved_pages call even when it is a printer device.
In gdev_prn_forwarding_dev_spec_op, check for a zero return and return
true (1). A device that is a printer device that doesn't support saved
page printing needs to return < 0 to prevent this.

Add a finalize method for gx_device_printer so we can free up the saved-
pages-list when the device is freed, but not when the device is closed
which can happen if it needs to close due to put_params. Also the
return code from the output_page in gx_saved_page_params_process was
ignored. Both seen with the file Bug687111.ps and the psdcmyk device.

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

Ray Johnston <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
CC| |***@artifex.com

--- Comment #3 from Ray Johnston <***@artifex.com> ---
*** Bug 698736 has been marked as a duplicate of this bug. ***

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

Ray Johnston <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Status|IN_PROGRESS |AWAITING_REVIEW

[b***@artifex.com]

http://bugs.ghostscript.com/show_bug.cgi?id=696845

Ray Johnston <***@artifex.com> changed:

What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|AWAITING_REVIEW |RESOLVED

--- Comment #4 from Ray Johnston <***@artifex.com> ---
Commit 1d7893955cf4231c092045affc32e26ad2b6de32 pushed to fix the SEGV

Also tested the duplicate bug 698736

Note that saved-pages is disabled by this commit for PCL & XPS