Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Description of problem:
I just started evince and it crashed

Version-Release number of selected component:
evince-3.14.2-5.el7

Additional info:
reporter:       libreport-2.1.11
backtrace_rating: 4
cmdline:        evince
crash_function: gs_lcms2_malloc
executable:     /usr/bin/evince
global_pid:     25606
kernel:         3.10.0-326.el7.x86_64
runlevel:       N 5
type:           CCpp
uid:            12257

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 gs_lcms2_malloc at base/gsicc_lcms2.c:48
 #1 _cmsMallocZeroDefaultFn at cmserr.c:97
 #2 cmsCreateProfilePlaceholder at cmsio0.c:460
 #3 cmsOpenProfileFromMemTHR at cmsio0.c:1092
 #4 GfxICCBasedColorSpace::parse at GfxState.cc:1919
 #5 GfxColorSpace::parse at GfxState.cc:322
 #6 Gfx::doImage at Gfx.cc:4404
 #7 Gfx::opXObject at Gfx.cc:4180
 #8 Gfx::go at Gfx.cc:763
 #9 Gfx::display at Gfx.cc:729

Created attachment 1092839 [details]
File: backtrace

Created attachment 1092840 [details]
File: cgroup

Created attachment 1092841 [details]
File: core_backtrace

Created attachment 1092842 [details]
File: dso_list

Created attachment 1092843 [details]
File: environ

Created attachment 1092844 [details]
File: exploitable

Created attachment 1092845 [details]
File: limits

Created attachment 1092846 [details]
File: machineid

Created attachment 1092847 [details]
File: maps

Created attachment 1092848 [details]
File: open_fds

Created attachment 1092849 [details]
File: proc_pid_status

Created attachment 1092850 [details]
File: var_log_messages

This is a bug in ghostscript.
I can not reproduce this but looking at the backtrace and related packages reveals:

poppler calls cmsOpenProfileFromMem(profBuf,length) which calls cmsOpenProfileFromMemTHR(NULL, MemPtr, dwSize)

this way we get in situation when we call ghostscript's "gs_lcms2_malloc (id=0x0, size=3752)"

Current ghostscript handles this a better because it doesn't use the given pointer directly but calls cmsGetContextUserData() on it which handles the NULL there.

Looking at the backtrace and Marek's comment #14, this is a duplicate of BZ #959351.

*** This bug has been marked as a duplicate of bug 959351 ***