Attachment 1485171 Details for Bug 1631450 – File: backtrace

File: backtrace

backtrace (text/plain), 14.06 KB, created by patrick.guio on 2018-09-20 15:30:10 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: patrick.guio

Created: 2018-09-20 15:30:10 UTC

Size: 14.06 KB

patch

obsolete

>[New LWP 11613]
>[Thread debugging using libthread_db enabled]
>Using host libthread_db library "/lib64/libthread_db.so.1".
>Core was generated by `gs -q -P- -dSAFER -dNOPAUSE -dBATCH -sDEVICE=pdfwrite -sstdout=%stderr -sOutput'.
>Program terminated with signal SIGSEGV, Segmentation fault.
>#0  0x00007fc3714ca054 in getc () at getc.c:37
>37	  if (!_IO_need_lock (fp))
>
>Thread 1 (Thread 0x7fc372d79480 (LWP 11613)):
>#0  0x00007fc3714ca054 in getc () at getc.c:37
>        result = <optimized out>
>#1  0x00007fc371bff3c5 in get_codepoint_utf8 (file=0x100000000, astr=0x7ffe0cf39848) at ./base/gsargs.c:74
>        c = <optimized out>
>        rune = <optimized out>
>        len = <optimized out>
>#2  0x00007fc371bff977 in get_codepoint (pal=0x7ffe0cf38fc0, pas=0x7ffe0cf39828) at ./base/gsargs.c:185
>        fn = <optimized out>
>        fn = <optimized out>
>#3  arg_next (pal=pal@entry=0x7ffe0cf38fc0, argstr=argstr@entry=0x7ffe0cf38fa8, errmem=0x55e2c874d790) at ./base/gsargs.c:236
>        pas = 0x7ffe0cf39828
>        cstr = <optimized out>
>        c = <optimized out>
>        i = <optimized out>
>        in_quote = <optimized out>
>        eol = <optimized out>
>#4  0x00007fc371bff026 in gs_main_init_with_args (minst=0x55e2c874ddf0, argc=12, argv=0x7ffe0cf39b18) at ./psi/imainarg.c:219
>        arg = 0x0
>        args = {expand_ats = 1, arg_fopen = 0x7fc371bfcf90 <gs_main_arg_fopen>, fopen_data = 0x55e2c874ddf0, get_codepoint = 0x7fc371bff3a0 <get_codepoint_utf8>, memory = 0x55e2c874d790, argp = 0x7ffe0cf39b20, argn = 11, depth = 1, cstr = "\200\270\330r\303\177\000\000\320\217\363\f\376\177\000\000o\307\272r\303\177\000\000\001\000\000\000\000\000\000\000\200\263\330r\303\177\000\000\360\217\363\f\376\177\000\000o\307\272r\303\177\000\000\001\000\000\000\000\000\000\000\240\256\330r\303\177\000\000\020\220\363\f\376\177\000\000o\307\272r\303\177\000\000\001\000\000\000\000\000\000\000\300\251\330r\303\177\000\000\060\220\363\f\376\177\000\000o\307\272r\303\177\000\000\001\000\000\000\000\000\000\000\340\244\330r\303\177\000\000P\220\363\f\376\177\000\000o\307\272r\303\177\000\000\001\000\000\000\000\000\000\000\000\240\330r\303\177\000\000p\220\363\f\376\177\000\000o\307\272r\303\177\000\000\001\000\000\000\000\000\000\000p\330\330r\303\177\000\000"..., sources = {{is_file = 0, u = {s = {parsed = 0, decoded = 0, chars = 0xffffffffffffffb0 <error: Cannot access memory at address 0xffffffffffffffb0>, memory = 0x0, str = 0x0}, file = 0x0}}, {is_file = 0, u = {s = {parsed = 0, decoded = 1, chars = 0x55e2c874e0b0 "-sPAPERSIZE=a4", memory = 0x55e2c874d790, str = 0x55e2c874e0b0 "-sPAPERSIZE=a4"}, file = 0x100000000}}, {is_file = 217291048, u = {s = {parsed = 32, decoded = 0, chars = 0x7fc36f343b00 <MutexChunk.7811> "", memory = 0x7fc36f0f880c <_cmsRegisterMemHandlerPlugin+60>, str = 0x7fc372362080 <gs_cms_memhandler> "ppca\320\a"}, file = 0x20}}, {is_file = 1863352059, u = {s = {parsed = 1916149888, decoded = 32707, chars = 0x55e2c874db20 "", memory = 0x50, str = 0x60 <error: Cannot access memory at address 0x60>}, file = 0x7fc372362080 <gs_cms_memhandler>}}, {is_file = 7, u = {s = {parsed = 0, decoded = 0, chars = 0xe8 <error: Cannot access memory at address 0xe8>, memory = 0xf0, str = 0x7 <error: Cannot access memory at address 0x7>}, file = 0x0}}, {is_file = 0, u = {s = {parsed = 15, decoded = 16777215, chars = 0x55e2c8732078 "", memory = 0xdf, str = 0x110 <error: Cannot access memory at address 0x110>}, file = 0xffffff0000000f}}, {is_file = -80, u = {s = {parsed = 3, decoded = 0, chars = 0x330000000f <error: Cannot access memory at address 0x330000000f>, memory = 0x0, str = 0x0}, file = 0x3}}, {is_file = 91, u = {s = {parsed = 0, decoded = 0, chars = 0x770000007c <error: Cannot access memory at address 0x770000007c>, memory = 0xffffffffffffffb0, str = 0xdf <error: Cannot access memory at address 0xdf>}, file = 0x0}}, {is_file = 232, u = {s = {parsed = 13, decoded = 0, chars = 0xffffffffffffffb0 <error: Cannot access memory at address 0xffffffffffffffb0>, memory = 0xb8, str = 0x0}, file = 0xd}}, {is_file = 1900897267, u = {s = {parsed = 1909473784, decoded = 32707, chars = 0x55e2c874d790 "\220\327t\310\342U", memory = 0x7ffe0cf39a10, str = 0x7fc371a0304d <gp_monitor_leave+13> "\205\300u\017H\203\304\b\303f.\017\037\204"}, file = 0x7fc371d041f8}}, {is_file = 1909497862, u = {s = {parsed = 1907705703, decoded = 32707, chars = 0x55e2c874d790 "\220\327t\310\342U", memory = 0x7ffe0cf39a10, str = 0x0}, file = 0x7fc371b54767 <gs_heap_alloc_bytes+231>}}}}
>        code = <optimized out>
>#5  0x000055e2c6ebfb72 in main (argc=12, argv=0x7ffe0cf39b18) at ./psi/dxmainc.c:86
>        exit_status = <optimized out>
>        code = 0
>        code1 = <optimized out>
>        instance = 0x55e2c874d950
>        exit_code = 0
>From                To                  Syms Read   Shared Object Library
>                                        No          /usr/lib64/libz.so
>0x00007fc37191b230  0x00007fc371c6731e  Yes         /lib64/libgs.so.9
>0x00007fc3714733a0  0x00007fc3715ba03f  Yes         /lib64/libc.so.6
>0x00007fc3711e2560  0x00007fc371221835  Yes         /lib64/libtiff.so.5
>0x00007fc370fd13e0  0x00007fc370fd6ec8  No          /lib64/libcupsimage.so.2
>0x00007fc370d5aab0  0x00007fc370da95eb  No          /lib64/libcups.so.2
>0x00007fc370af7860  0x00007fc370b2aacf  No          /lib64/libgssapi_krb5.so.2
>0x00007fc3708243e0  0x00007fc37088fed1  Yes         /lib64/libkrb5.so.3
>0x00007fc3705e7590  0x00007fc3705f5ee4  No          /lib64/libk5crypto.so.3
>0x00007fc3703df4c0  0x00007fc3703e0069  No          /lib64/libcom_err.so.2
>0x00007fc3701c4be0  0x00007fc3701d27f1  Yes         /lib64/libpthread.so.0
>0x00007fc36fe369f0  0x00007fc36fee8e6a  Yes         /lib64/libm.so.6
>0x00007fc36fc031d0  0x00007fc36fc0cef0  Yes         /lib64/libcrypt.so.1
>0x00007fc36f9fd7a0  0x00007fc36f9ff79f  Yes         /lib64/libijs-0.35.so
>0x00007fc36f7cd5a0  0x00007fc36f7efa75  Yes         /lib64/libpng16.so.16
>0x00007fc36f5b2b30  0x00007fc36f5c02e8  Yes         /lib64/libjbig2dec.so.0
>0x00007fc36f34ace0  0x00007fc36f384520  Yes         /lib64/libjpeg.so.62
>0x00007fc36f0f66b0  0x00007fc36f12caa5  Yes         /lib64/liblcms2.so.2
>0x00007fc36eee7ee0  0x00007fc36eee8bbe  Yes         /lib64/libdl.so.2
>0x00007fc36ecb5f90  0x00007fc36ecbaa4c  Yes         /lib64/libidn.so.11
>0x00007fc36eab0460  0x00007fc36eab0ce7  Yes         /lib64/libpaper.so.1
>0x00007fc36e872200  0x00007fc36e8947de  Yes         /lib64/libfontconfig.so.1
>                                        No          /usr/lib64/freetype-freeworld/libfreetype.so.6
>0x00007fc36e369f20  0x00007fc36e3a4973  Yes         /lib64/libopenjp2.so.7
>0x00007fc372b9ff60  0x00007fc372bbe060  Yes         /lib64/ld-linux-x86-64.so.2
>0x00007fc36e157010  0x00007fc36e15d951  No          /lib64/libjbig.so.2.1
>0x00007fc36df4c490  0x00007fc36df51629  No          /lib64/libavahi-common.so.3
>0x00007fc36dd3aa30  0x00007fc36dd42e7d  No          /lib64/libavahi-client.so.3
>0x00007fc36d9c1f80  0x00007fc36dac2910  Yes         /lib64/libgnutls.so.30
>0x00007fc36d784bb0  0x00007fc36d78c1fb  No          /lib64/libkrb5support.so.0
>0x00007fc36d360000  0x00007fc36d4da6be  Yes         /lib64/libcrypto.so.1.1
>0x00007fc36d0f25f0  0x00007fc36d0f3378  No          /lib64/libkeyutils.so.1
>0x00007fc36cedd840  0x00007fc36cee960e  Yes         /lib64/libresolv.so.2
>0x00007fc36cca2b50  0x00007fc36ccc2e87  Yes         /lib64/libexpat.so.1
>0x00007fc36ca99740  0x00007fc36ca9d171  No          /lib64/libuuid.so.1
>0x00007fc36c888700  0x00007fc36c8953e6  No          /lib64/libbz2.so.1
>0x00007fc36c643a90  0x00007fc36c6702b5  No          /lib64/libdbus-1.so.3
>0x00007fc36c32d2b0  0x00007fc36c3c54fc  Yes         /lib64/libp11-kit.so.0
>0x00007fc36c0e6750  0x00007fc36c0ea2b7  Yes         /lib64/libidn2.so.0
>0x00007fc36bd75a70  0x00007fc36bda9e9e  Yes         /lib64/libunistring.so.2
>0x00007fc36bb53cd0  0x00007fc36bb5ea23  Yes         /lib64/libtasn1.so.6
>0x00007fc36b921c60  0x00007fc36b93eeec  Yes         /lib64/libnettle.so.6
>0x00007fc36b6f1840  0x00007fc36b6fffdf  Yes         /lib64/libhogweed.so.4
>0x00007fc36b47a5c0  0x00007fc36b4d0524  Yes         /lib64/libgmp.so.10
>0x00007fc36b24bdf0  0x00007fc36b26393f  Yes         /lib64/libselinux.so.1
>0x00007fc36afb7150  0x00007fc36b01b9d9  No          /lib64/libsystemd.so.0
>0x00007fc36ada0810  0x00007fc36ada529a  Yes         /lib64/libffi.so.6
>0x00007fc36ab21160  0x00007fc36ab7bf73  Yes         /lib64/libpcre2-8.so.0
>0x00007fc36a919210  0x00007fc36a91c46c  Yes         /lib64/librt.so.1
>0x00007fc36a6f30b0  0x00007fc36a709f66  Yes         /lib64/liblzma.so.5
>0x00007fc36a4dafd0  0x00007fc36a4ec3db  No          /lib64/liblz4.so.1
>0x00007fc36a2d55b0  0x00007fc36a2d6e8f  Yes         /lib64/libcap.so.2
>0x00007fc36a086f30  0x00007fc36a0be53e  No          /lib64/libmount.so.1
>0x00007fc369d6a5c0  0x00007fc369e3853c  Yes         /lib64/libgcrypt.so.20
>0x00007fc369b49ad0  0x00007fc369b5a715  No          /lib64/libgcc_s.so.1
>0x00007fc369900740  0x00007fc36993159e  No          /lib64/libblkid.so.1
>0x00007fc3696da1e0  0x00007fc3696eb7ee  Yes         /lib64/libgpg-error.so.0
>0x00007fc3694c3880  0x00007fc3694cbad2  Yes         /usr/lib64/ghostscript/X11.so
>0x00007fc369267130  0x00007fc3692a42c1  Yes         /lib64/libXt.so.6
>0x00007fc36904cbc0  0x00007fc369050e07  Yes         /lib64/libSM.so.6
>0x00007fc368e33f30  0x00007fc368e41ada  Yes         /lib64/libICE.so.6
>0x00007fc368c20710  0x00007fc368c2a853  Yes         /lib64/libXext.so.6
>0x00007fc3688f9f50  0x00007fc3689829a6  Yes         /lib64/libX11.so.6
>0x00007fc3686bea40  0x00007fc3686d1699  Yes         /lib64/libxcb.so.1
>0x00007fc3684afe70  0x00007fc3684b0b5e  Yes         /lib64/libXau.so.6
>$1 = 0x0
>rax            0x7fc371bff3a0	140477403755424
>rbx            0x100000000	4294967296
>rcx            0x1	1
>rdx            0x0	0
>rsi            0x7ffe0cf39848	140729115711560
>rdi            0x100000000	4294967296
>rbp            0x7ffe0cf39848	0x7ffe0cf39848
>rsp            0x7ffe0cf38ee0	0x7ffe0cf38ee0
>r8             0x55e2c874d790	94432514070416
>r9             0x0	0
>r10            0x1	1
>r11            0x0	0
>r12            0x7ffe0cf39848	140729115711560
>r13            0x100000000	4294967296
>r14            0x7ffe0cf39b78	140729115712376
>r15            0x0	0
>rip            0x7fc3714ca054	0x7fc3714ca054 <getc+4>
>eflags         0x10206	[ PF IF RF ]
>cs             0x33	51
>ss             0x2b	43
>ds             0x0	0
>es             0x0	0
>fs             0x0	0
>gs             0x0	0
>Dump of assembler code for function getc:
>   0x00007fc3714ca050 <+0>:	push   %rbx
>   0x00007fc3714ca051 <+1>:	mov    %rdi,%rbx
>=> 0x00007fc3714ca054 <+4>:	testb  $0x80,0x74(%rdi)
>   0x00007fc3714ca058 <+8>:	je     0x7fc3714ca120 <getc+208>
>   0x00007fc3714ca05e <+14>:	mov    (%rdi),%eax
>   0x00007fc3714ca060 <+16>:	and    $0x8000,%eax
>   0x00007fc3714ca065 <+21>:	jne    0x7fc3714ca0c0 <getc+112>
>   0x00007fc3714ca067 <+23>:	mov    0x88(%rdi),%r8
>   0x00007fc3714ca06e <+30>:	mov    %fs:0x10,%r9
>   0x00007fc3714ca077 <+39>:	cmp    %r9,0x8(%r8)
>   0x00007fc3714ca07b <+43>:	je     0x7fc3714ca0bb <getc+107>
>   0x00007fc3714ca07d <+45>:	mov    $0x1,%esi
>   0x00007fc3714ca082 <+50>:	cmpl   $0x0,0x34694f(%rip)        # 0x7fc3718109d8 <__libc_multiple_threads>
>   0x00007fc3714ca089 <+57>:	je     0x7fc3714ca094 <getc+68>
>   0x00007fc3714ca08b <+59>:	lock cmpxchg %esi,(%r8)
>   0x00007fc3714ca090 <+64>:	jne    0x7fc3714ca09a <getc+74>
>   0x00007fc3714ca092 <+66>:	jmp    0x7fc3714ca0b0 <getc+96>
>   0x00007fc3714ca094 <+68>:	cmpxchg %esi,(%r8)
>   0x00007fc3714ca098 <+72>:	je     0x7fc3714ca0b0 <getc+96>
>   0x00007fc3714ca09a <+74>:	lea    (%r8),%rdi
>   0x00007fc3714ca09d <+77>:	sub    $0x80,%rsp
>   0x00007fc3714ca0a4 <+84>:	callq  0x7fc371559250 <__lll_lock_wait_private>
>   0x00007fc3714ca0a9 <+89>:	add    $0x80,%rsp
>   0x00007fc3714ca0b0 <+96>:	mov    0x88(%rbx),%r8
>   0x00007fc3714ca0b7 <+103>:	mov    %r9,0x8(%r8)
>   0x00007fc3714ca0bb <+107>:	addl   $0x1,0x4(%r8)
>   0x00007fc3714ca0c0 <+112>:	mov    0x8(%rbx),%rax
>   0x00007fc3714ca0c4 <+116>:	cmp    0x10(%rbx),%rax
>   0x00007fc3714ca0c8 <+120>:	jae    0x7fc3714ca140 <getc+240>
>   0x00007fc3714ca0ca <+122>:	lea    0x1(%rax),%rdx
>   0x00007fc3714ca0ce <+126>:	mov    %rdx,0x8(%rbx)
>   0x00007fc3714ca0d2 <+130>:	movzbl (%rax),%edx
>   0x00007fc3714ca0d5 <+133>:	testl  $0x8000,(%rbx)
>   0x00007fc3714ca0db <+139>:	jne    0x7fc3714ca11c <getc+204>
>   0x00007fc3714ca0dd <+141>:	mov    0x88(%rbx),%rsi
>   0x00007fc3714ca0e4 <+148>:	subl   $0x1,0x4(%rsi)
>   0x00007fc3714ca0e8 <+152>:	jne    0x7fc3714ca11c <getc+204>
>   0x00007fc3714ca0ea <+154>:	movq   $0x0,0x8(%rsi)
>   0x00007fc3714ca0f2 <+162>:	cmpl   $0x0,0x3468df(%rip)        # 0x7fc3718109d8 <__libc_multiple_threads>
>   0x00007fc3714ca0f9 <+169>:	je     0x7fc3714ca102 <getc+178>
>   0x00007fc3714ca0fb <+171>:	lock decl (%rsi)
>   0x00007fc3714ca0fe <+174>:	jne    0x7fc3714ca106 <getc+182>
>   0x00007fc3714ca100 <+176>:	jmp    0x7fc3714ca11c <getc+204>
>   0x00007fc3714ca102 <+178>:	decl   (%rsi)
>   0x00007fc3714ca104 <+180>:	je     0x7fc3714ca11c <getc+204>
>   0x00007fc3714ca106 <+182>:	lea    (%rsi),%rdi
>   0x00007fc3714ca109 <+185>:	sub    $0x80,%rsp
>   0x00007fc3714ca110 <+192>:	callq  0x7fc371559280 <__lll_unlock_wake_private>
>   0x00007fc3714ca115 <+197>:	add    $0x80,%rsp
>   0x00007fc3714ca11c <+204>:	mov    %edx,%eax
>   0x00007fc3714ca11e <+206>:	pop    %rbx
>   0x00007fc3714ca11f <+207>:	retq   
>   0x00007fc3714ca120 <+208>:	mov    0x8(%rdi),%rax
>   0x00007fc3714ca124 <+212>:	cmp    0x10(%rdi),%rax
>   0x00007fc3714ca128 <+216>:	jae    0x7fc3714ca150 <getc+256>
>   0x00007fc3714ca12a <+218>:	lea    0x1(%rax),%rcx
>   0x00007fc3714ca12e <+222>:	mov    %rcx,0x8(%rdi)
>   0x00007fc3714ca132 <+226>:	movzbl (%rax),%edx
>   0x00007fc3714ca135 <+229>:	pop    %rbx
>   0x00007fc3714ca136 <+230>:	mov    %edx,%eax
>   0x00007fc3714ca138 <+232>:	retq   
>   0x00007fc3714ca139 <+233>:	nopl   0x0(%rax)
>   0x00007fc3714ca140 <+240>:	mov    %rbx,%rdi
>   0x00007fc3714ca143 <+243>:	callq  0x7fc3714cf560 <__GI___uflow>
>   0x00007fc3714ca148 <+248>:	mov    %eax,%edx
>   0x00007fc3714ca14a <+250>:	jmp    0x7fc3714ca0d5 <getc+133>
>   0x00007fc3714ca14c <+252>:	nopl   0x0(%rax)
>   0x00007fc3714ca150 <+256>:	pop    %rbx
>   0x00007fc3714ca151 <+257>:	jmpq   0x7fc3714cf560 <__GI___uflow>
>   0x00007fc3714ca156 <+262>:	mov    %rax,%rsi
>   0x00007fc3714ca159 <+265>:	jmpq   0x7fc3714740d7 <_IO_getc>
>End of assembler dump.
>== EXPLOITABLE ==

Actions: View

Attachments on bug 1631450: 1485171 | 1485172 | 1485173 | 1485174 | 1485175 | 1485176 | 1485177 | 1485178 | 1485179 | 1485180 | 1485181 | 1485182