Bug 499676 - Evince doesn't check allocation of drawing area for "Loading..." text
Evince doesn't check allocation of drawing area for "Loading..." text
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: evince (Show other bugs)
5.3
All Linux
low Severity medium
: rc
: 5.4
Assigned To: Marek Kašík
desktop-bugs@redhat.com
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2009-05-07 11:54 EDT by Marek Kašík
Modified: 2010-03-30 04:03 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
When rendering a page of a PDF document, evince displays a blank page, with just the text "Loading..." visible until the page is ready to be viewed. Previously, evince was not checking if the drawing area for the loading page could be allocated. Consequently, if a PDF document with large page dimensions was opened evince may have crashed, returning a segmentation fault. With this update, the drawing area for the loading page is now correctly allocated, resolving this issue. (BZ#499676)
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-03-30 04:03:08 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2010:0195 normal SHIPPED_LIVE evince bug fix update 2010-03-29 08:24:19 EDT

  None (edit)
Comment 2 RHEL Product and Program Management 2009-05-08 03:08:08 EDT
This request was evaluated by Red Hat Product Management for
inclusion, but this component is not scheduled to be updated in
the current Red Hat Enterprise Linux release. If you would like
this request to be reviewed for the next minor release, ask your
support representative to set the next rhel-x.y flag to "?".
Comment 5 Yewei Shao 2009-12-22 05:19:48 EST
I try to verify this bug by following steps:
(1) downgrade poppler to poppler-0.5.4-4.4.el5_1 
(2) run evince in gdb 
(3) run evince with file "reproducer.pdf" (comment #3)
(4) View -> Fit Page Width 
(5) When the file fails, check the backtrace


In old package, I will get the following in the terminal:
.live.[root@x86-64-5c-m1 Desktop]# gdb evince
GNU gdb Fedora (6.8-37.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) run /root/Desktop/reproducer.pdf 2 > /dev/null
Starting program: /usr/bin/evince /root/Desktop/reproducer.pdf 2 > /dev/null
[Thread debugging using libthread_db enabled]
[New Thread 0x2adf0b782490 (LWP 17801)]
[New Thread 0x42137940 (LWP 17804)]
Error (459): 21 extraneous bytes after segment
Error (470): Unknown segment type in JBIG2 stream
Error (652): Unexpected EOF in JBIG2 stream
evince: Fatal IO error 104 (Connection reset by peer) on X server :5.0.
[Thread 0x42137940 (LWP 17804) exited]

Program exited with code 01.
(gdb) bt
No stack.
(gdb) quit


In new package of evince-0.6.0-13.el5, then I will get the following in the terminal like: 
.qa.[root@ppcp-5s-m1 Desktop]# gdb evince
GNU gdb Fedora (6.8-37.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "ppc64-redhat-linux-gnu"...
(gdb) r /root/Desktop/reproducer.pdf 2 > /dev/null
Starting program: /usr/bin/evince /root/Desktop/reproducer.pdf 2 > /dev/null
[Thread debugging using libthread_db enabled]
[New Thread 0xf7de2a10 (LWP 6066)]
[New Thread 0xf7acf4a0 (LWP 6371)]
Error (459): 21 extraneous bytes after segment
Error (470): Unknown segment type in JBIG2 stream
Error (652): Unexpected EOF in JBIG2 stream
Error (459): 21 extraneous bytes after segment

Program received signal SIGINT, Interrupt.
0x0ff17074 in poll () from /lib/libc.so.6
(gdb) bt
#0  0x0ff17074 in poll () from /lib/libc.so.6
#1  0x0f7cb648 in ?? () from /lib/libglib-2.0.so.0
#2  0x0f7cbc14 in g_main_loop_run () from /lib/libglib-2.0.so.0
#3  0x0f197824 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#4  0x10037b7c in main (argc=269495560, argv=0xff8df774) at main.c:345
(gdb) quit


Is this result the expect result for new package?
Comment 7 Yewei Shao 2009-12-22 21:10:12 EST
I verify this bug by following result in terminal. Check the backtraces, the fails does not show up with new poppler and also no "draw_loading_text()" in backtraces, so this bug is verified in evince-0.6.0-13.el5.

.live.[root@x86-64-5c-m1 ~]# gdb evince
GNU gdb Fedora (6.8-37.el5)
Copyright (C) 2008 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu"...
(gdb) r /root/Desktop/reproducer.pdf 2> /dev/null
Starting program: /usr/bin/evince /root/Desktop/reproducer.pdf 2> /dev/null
[Thread debugging using libthread_db enabled]
[New Thread 0x2b4a4a773490 (LWP 32498)]
[New Thread 0x4153e940 (LWP 32529)]

Program received signal SIGINT, Interrupt.
0x00000036a0ccae46 in poll () from /lib64/libc.so.6
(gdb) thread apply all bt

Thread 2 (Thread 0x4153e940 (LWP 32529)):
#0  0x00000036a180ad09 in pthread_cond_wait@@GLIBC_2.3.2 ()
   from /lib64/libpthread.so.0
#1  0x00000000004182a0 in ev_render_thread (data=<value optimized out>)
    at ev-job-queue.c:179
#2  0x00000036a6848e04 in ?? () from /lib64/libglib-2.0.so.0
#3  0x00000036a1806617 in start_thread () from /lib64/libpthread.so.0
#4  0x00000036a0cd3c2d in clone () from /lib64/libc.so.6

Thread 1 (Thread 0x2b4a4a773490 (LWP 32498)):
#0  0x00000036a0ccae46 in poll () from /lib64/libc.so.6
#1  0x00000036a682fa3d in ?? () from /lib64/libglib-2.0.so.0
#2  0x00000036a682ff1a in g_main_loop_run () from /lib64/libglib-2.0.so.0
#3  0x00000036a912aa53 in gtk_main () from /usr/lib64/libgtk-x11-2.0.so.0
#4  0x000000000043687d in main (argc=198054008, argv=0xbd11b50) at main.c:345
(gdb) quit
Comment 9 Ryan Lerch 2010-03-10 20:00:42 EST
Technical note added. If any revisions are required, please edit the "Technical Notes" field
accordingly. All revisions will be proofread by the Engineering Content Services team.

New Contents:
When rendering a page of a PDF document, evince displays a blank page, with just the text "Loading..." visible until the page is ready to be viewed. Previously, evince was not checking if the drawing area for the loading page could be allocated. Consequently, if a PDF document with large page dimensions was opened evince may have crashed, returning a segmentation fault. With this update, the drawing area for the loading page is now correctly allocated, resolving this issue. (BZ#499676)
Comment 10 errata-xmlrpc 2010-03-30 04:03:08 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2010-0195.html

Note You need to log in before you can comment on or make changes to this bug.