Bug 1657694

Summary: ghostscript: Regression: Warning: Dropping incorrect smooth shading object (Error: /rangecheck in --run--)
Product: Red Hat Enterprise Linux 7 Reporter: Martin Osvald 🛹 <mosvald>
Component: ghostscriptAssignee: Martin Osvald 🛹 <mosvald>
Status: CLOSED ERRATA QA Contact: Petr Sklenar <psklenar>
Severity: high Docs Contact:
Priority: urgent    
Version: 7.6CC: fkrska, omejzlik, psklenar, thozza
Target Milestone: rcKeywords: Patch, Regression, ZStream
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ghostscript-9.25-2.el7 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
: 1657822 (view as bug list) Environment:
Last Closed: 2019-08-06 13:12:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1657822    
Attachments:
Description Flags
temporary-workaround.patch none

Description Martin Osvald 🛹 2018-12-10 09:58:18 UTC 
Description of problem:

It was found that ghostscript-9.07-31.el7_6.1.x86_64 introduced regression with the below patch:

ghostscript-cve-2018-15909.patch

It is caused by a typo in backported patch:

~~~
My patch:
 
@@ -1131,7 +1131,7 @@ drawopdict begin
             exch
             pop
           } {
-           .buildshading
+           .buildshading_and_shfill
           } ifelse
           .shfill
         } stopped {
 
 
Upstream patch:
 
     { dup /.shading .knownget {
         exch pop
       } {
-       .buildshading
+       .buildshading_and_shfill
       } ifelse
-      .shfill
     } stopped {
~~~

Notice the line removing ".shfill". That was badly overlooked.

If I remove the ".shfill", it fixes this regression.


Version-Release number of selected component (if applicable):

- RHEL 7.6.z
- ghostscript-9.07-31.el7_6.1.x86_64


How reproducible:

Always.


Steps to Reproduce:

1. Unpack the attached file MapSource_CZ.pdf.xz and run the below:

~~~
$ unxz MapSource_CZ.pdf.xz
$ gs -dSAFER -sDEVICE=bitcmyk -sOutputFile=lala.bitcmyk -dBATCH -dNOPAUSE -f ~/MapSource_CZ.pdf
~~~


Actual results:

~~~
$ gs -dSAFER -sDEVICE=bitcmyk -sOutputFile=MapSource_CZ.pdf.bitcmyk -dBATCH -dNOPAUSE -f ~/MapSource_CZ.pdf
GPL Ghostscript 9.07 (2013-02-14)
Copyright (C) 2012 Artifex Software, Inc.  All rights reserved.
This software comes with NO WARRANTY: see the file PUBLIC for details.
Processing pages 1 through 97.
Page 1
Page 2
Page 3
Page 4
Page 5
Page 6
Page 7
Page 8
Page 9
Page 10
Page 11
Page 12
   **** Warning: Dropping incorrect smooth shading object.
   **** Error reading a content stream. The page may be incomplete.
   **** File did not complete the page properly and may be damaged.
Error: /rangecheck in --run--
Operand stack:
   -1   --nostringval--
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1884   1   3   %oparray_pop   1883   1   3   %oparray_pop   1867   1   3   %oparray_pop   --nostringval--   --nostringval--   13   1   97   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--
Dictionary stack:
   --dict:951/1684(ro)(G)--   --dict:1/20(G)--   --dict:82/200(L)--   --dict:82/200(L)--   --dict:109/127(ro)(G)--   --dict:292/300(ro)(G)--   --dict:27/32(L)--   --dict:6/8(L)--   --dict:22/40(L)--   --dict:16/25(L)--   --dict:1/1(ro)(G)--   --dict:1/1(ro)(G)--   --dict:5/5(L)--   --dict:1/1(ro)(G)--   --dict:3/5(L)--
Current allocation mode is local
Last OS error: No such file or directory
GPL Ghostscript 9.07: Unrecoverable error, exit code 1
$
~~~


Expected results:

No error.


Additional info:

The same problem was hit by somebody on Stack Overflow:

https://stackoverflow.com/questions/53625560/imagemagick-convert-pptx-to-jpg-failing-in-ghostscript-call

~~~
$ convert test.pptx[0] -thumbnail 650x650 -gravity center -extent 1500x1000 s1.jpg

\convert /tmp/magick-17292VzAbA_mfaxJX -> /tmp/magick-17292VzAbA_mfaxJX.pdf using filter : impress_pdf_Export
convert: PDFDelegateFailed `[ghostscript library 9.07] -sstdout=%stderr -dQUIET -dSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=2 '-sDEVICE=pngalpha' -dTextAlphaBits=4 -dGraphicsAlphaBits=4 '-r72x72' -dFirstPage=1 -dLastPage=1 '-sOutputFile=/tmp/magick-17292RtJq2Z8iF5iK%d' '-f/tmp/magick-17292wskX7eyNic7t' '-f/tmp/magick-17292jHMWYZOpLjVd'':    **** Warning: Dropping incorrect smooth shading object.
   **** File did not complete the page properly and may be damaged.
Error: /rangecheck in --run--
Operand stack:
   -1   --nostringval--
Execution stack:
   %interp_exit   .runexec2   --nostringval--   --nostringval--   --nostringval--   2   %stopped_push   --nostringval--   --nostringval--   --nostringval--   false   1   %stopped_push   1884   1   3   %oparray_pop   1883   1   3   %oparray_pop   1867   1   3   %oparray_pop   --nostringval--   --nostringval--   2   1   1   --nostringval--   %for_pos_int_continue   --nostringval--   --nostringval--   false   1   %stopped_push   --nostringval--   --nostringval--
Dictionary stack:
   --dict:946/1684(ro)(G)--   --dict:1/20(G)--   --dict:82/200(L)--   --dict:82/200(L)--   --dict:109/127(ro)(G)--   --dict:292/300(ro)(G)--   --dict:27/32(L)--   --dict:6/8(L)--   --dict:21/40(L)--
Current allocation mode is local
GPL Ghostscript 9.07: Unrecoverable error, exit code 1
 @ error/pdf.c/InvokePDFDelegate/276.
convert: no images defined `s1.jpg' @ error/convert.c/ConvertImageCommand/3288.
~~~
Comment 5 Martin Osvald 🛹 2018-12-10 12:09:54 UTC 
Created attachment 1513032 [details]
temporary-workaround.patch


TEMPORARY WORKAROUND:

- either downgrade to ghostscript-9.07-31.el7:

~~~
# yum downgrade ghostscript-9.07-31.el7
~~~

- or apply the below temporary patch (attached):

~~~
# patch -d /usr/share/ghostscript/9.07/Resource/Init/ < temporary-workaround.patch
patching file pdf_draw.ps
#
~~~

Note: you can revert the changes introduced by this patch anytime by running the same patch command again:

~~~
# patch -d /usr/share/ghostscript/9.07/Resource/Init/ < temporary-workaround.patch
patching file pdf_draw.ps
Reversed (or previously applied) patch detected!  Assume -R? [n] y
#
~~~


Contents of the temporary workaround patch:

~~~
# cat temporary-workaround.patch
diff -up /usr/share/ghostscript/9.07/Resource/Init/pdf_draw.ps.bz1657694 /usr/share/ghostscript/9.07/Resource/Init/pdf_draw.ps
--- /usr/share/ghostscript/9.07/Resource/Init/pdf_draw.ps.bz1657694     2018-12-10 13:02:27.750638675 +0100
+++ /usr/share/ghostscript/9.07/Resource/Init/pdf_draw.ps       2018-12-10 13:02:44.206987524 +0100
@@ -1133,7 +1133,6 @@ drawopdict begin
           } {
            .buildshading_and_shfill
           } ifelse
-          .shfill 
         } stopped { 
           pop 
           (   **** Warning: Dropping incorrect smooth shading object.\n)
#
~~~
Comment 13 errata-xmlrpc 2019-08-06 13:12:44 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:2281