Won't open PDF - doesn't error, doesn't open, just dies silently

Bug #180887 reported by Daniel Dainty
2
Affects Status Importance Assigned to Milestone
Poppler
Fix Released
Critical
poppler (Ubuntu)
Fix Released
Medium
Ubuntu Desktop Bugs

Bug Description

Binary package hint: evince

The Document Viewer won't open this PDF:

http://www.hmrc.gov.uk/forms/ch2-online.pdf

This is the Child Benefit claim form for the UK.

The program doesn't crash, or produce any errror, it just silently dies.

Tested on two machines both running 7.10 with all updates.

Revision history for this message
Daniel Dainty (i-launchpad-danieldainty-com) wrote :

Adding attachment.

Revision history for this message
In , Pedro Villavicencio (pedro) wrote :
Download full text (26.1 KiB)

This report has been filled here:

https://bugs.launchpad.net/ubuntu/+source/poppler/+bug/180887

"The Document Viewer won't open this PDF:

http://launchpadlibrarian.net/11179656/ch2-online.pdf

This is the Child Benefit claim form for the UK."

Stacktrace:

"Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 0xb6999b90 (LWP 9324)]
DecryptStream::getChar (this=0x8372e38) at Decrypt.cc:271
271 c = state.aes.buf[state.aes.bufIdx++];
Current language: auto; currently c++
#0 DecryptStream::getChar (this=0x8372e38) at Decrypt.cc:271
#1 0xb7b10dae in Parser::getObj (this=0x83719a8, obj=0xb6998fb0,
    fileKey=0x836ff34 "\224š÷ë\033\r^s$ÅíÁ$Ä+è", encAlgorithm=cryptAES,
    keyLength=16, objNum=23, objGen=0) at Parser.cc:127
#2 0xb7b111ef in Parser::getObj (this=0x83719a8, obj=0xb6999020,
    fileKey=0x836ff34 "\224š÷ë\033\r^s$ÅíÁ$Ä+è", encAlgorithm=cryptAES,
    keyLength=16, objNum=23, objGen=0) at Parser.cc:86
#3 0xb7b111ef in Parser::getObj (this=0x83719a8, obj=0xb6999090,
    fileKey=0x836ff34 "\224š÷ë\033\r^s$ÅíÁ$Ä+è", encAlgorithm=cryptAES,
    keyLength=16, objNum=23, objGen=0) at Parser.cc:86
#4 0xb7b111ef in Parser::getObj (this=0x83719a8, obj=0xb69991c0,
    fileKey=0x836ff34 "\224š÷ë\033\r^s$ÅíÁ$Ä+è", encAlgorithm=cryptAES,
    keyLength=16, objNum=23, objGen=0) at Parser.cc:86
#5 0xb7b1e3b3 in XRef::fetch (this=0x836fee0, num=23, gen=0, obj=0xb69991c0)
    at XRef.cc:906
#6 0xb7ab4b35 in Catalog (this=0x8370658, xrefA=0x836fee0) at XRef.h:79
#7 0xb7b11b26 in PDFDoc::setup (this=0x836faa0, ownerPassword=0x0,
    userPassword=0x0) at PDFDoc.cc:206
#8 0xb7b11db5 in PDFDoc (this=0x836faa0, fileNameA=0x836fa78,
    ownerPassword=0x0, userPassword=0x0, guiDataA=0x0) at PDFDoc.cc:102
#9 0xb7bf67e2 in poppler_document_new_from_file (
    uri=0x834e738 "file:///home/pvillavi/ch2-online.pdf", password=0x0,
    error=0xb69992bc) at poppler-document.cc:143
#10 0x080a2279 in pdf_document_load (document=0x81990c8,
    uri=0x834e738 "file:///home/pvillavi/ch2-online.pdf", error=0x8313574)
    at ev-poppler.cc:284
#11 0x0809ad11 in ev_document_load (document=0x81990c8,
    uri=0x834e738 "file:///home/pvillavi/ch2-online.pdf", error=0x8313574)
    at ev-document.c:122
#12 0x0809b125 in ev_document_factory_get_document (
    uri=0xc90c8 <Address 0xc90c8 out of bounds>, error=0x8313574)
    at ev-document-factory.c:347
#13 0x08061e90 in ev_job_load_run (job=0x8313550) at ev-jobs.c:570
#14 0x08060750 in handle_job (job=0x8313550) at ev-job-queue.c:132
#15 0x08060d3c in ev_render_thread (data=0x0) at ev-job-queue.c:263
#16 0xb6eb122f in g_thread_create_proxy (data=0x811e128) at gthread.c:635
#17 0xb7c184fb in start_thread () from /lib/tls/i686/cmov/libpthread.so.0
#18 0xb79698ee in clone () from /lib/tls/i686/cmov/libc.so.6"

"Thread 2 (Thread 0xb6999b90 (LWP 9324)):
#0 DecryptStream::getChar (this=0x8372e38) at Decrypt.cc:271
 in = "BDŽ· \0307\bà\216\231¶\001\000\000"
 c = -1
 i = 137834040
#1 0xb7b10dae in Parser::getObj (this=0x83719a8, obj=0xb6998fb0,
    fileKey=0x836ff34 "\224š÷ë\033\r^s$ÅíÁ$Ä+è", encAlgorithm=cryptAES,
    keyLength=16, objNum=23, objGen=0) at Parser.cc:127
 key = <value optimi...

Revision history for this message
Pedro Villavicencio (pedro) wrote :

Thanks for your report, confirming got the crash in Hardy, thanks.

Changed in poppler:
importance: Undecided → Medium
status: New → Triaged
Revision history for this message
Pedro Villavicencio (pedro) wrote :

Thanks for your bug report. This bug has been reported to the developers of the software. You can track it and make comments here: https://bugs.freedesktop.org/show_bug.cgi?id=13972

Changed in poppler:
assignee: nobody → desktop-bugs
Revision history for this message
In , Brad Hards (bradh) wrote :

Can reproduce with current poppler (master branch) using Qt4 test tools.

Revision history for this message
In , Brad Hards (bradh) wrote :
Download full text (4.4 KiB)

It is very ugly in valgrind (just spins after this):
[bradh@conferta tests]$ valgrind ./test-poppler-qt4 ~/samples/pdf/bug13972.pdf
==7719== Memcheck, a memory error detector.
==7719== Copyright (C) 2002-2007, and GNU GPL'd, by Julian Seward et al.
==7719== Using LibVEX rev 1730, a library for dynamic binary translation.
==7719== Copyright (C) 2004-2007, and GNU GPL'd, by OpenWorks LLP.
==7719== Using valgrind-3.4.0.SVN, a dynamic binary instrumentation framework.
==7719== Copyright (C) 2000-2007, and GNU GPL'd, by Julian Seward et al.
==7719== For more details, rerun with: -v
==7719==
==7719== Conditional jump or move depends on uninitialised value(s)
==7719== at 0x4F5FD9D: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:127)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F6BD07: XRef::fetch(int, int, Object*) (XRef.cc:906)
==7719== by 0x4F05963: Catalog::Catalog(XRef*) (XRef.h:79)
==7719== by 0x4F60978: PDFDoc::setup(GooString*, GooString*) (PDFDoc.cc:206)
==7719== by 0x4F60B6E: PDFDoc::PDFDoc(GooString*, GooString*, GooString*, void*) (PDFDoc.cc:102)
==7719== by 0x4C459DA: Poppler::Document::load(QString const&, QByteArray const&, QByteArray const&) (poppler-private.h:106)
==7719== by 0x404E54: main (test-poppler-qt4.cpp:108)
==7719==
==7719== Invalid read of size 1
==7719== at 0x4F0C11E: DecryptStream::getChar() (Decrypt.cc:271)
==7719== by 0x4F5FD97: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:127)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F6BD07: XRef::fetch(int, int, Object*) (XRef.cc:906)
==7719== by 0x4F05963: Catalog::Catalog(XRef*) (XRef.h:79)
==7719== by 0x4F60978: PDFDoc::setup(GooString*, GooString*) (PDFDoc.cc:206)
==7719== by 0x4F60B6E: PDFDoc::PDFDoc(GooString*, GooString*, GooString*, void*) (PDFDoc.cc:102)
==7719== by 0x4C459DA: Poppler::Document::load(QString const&, QByteArray const&, QByteArray const&) (poppler-private.h:106)
==7719== by 0x404E54: main (test-poppler-qt4.cpp:108)
==7719== Address 0x97a7e08 is 0 bytes after a block of size 328 alloc'd
==7719== at 0x4A06579: operator new(unsigned long) (vg_replace_malloc.c:230)
==7719== by 0x4F5FD4B: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:125)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F600B4: Parser::getObj(Object*, unsigned char*, CryptAlgorithm, int, int, int) (Parser.cc:86)
==7719== by 0x4F600B4: Parser::getObj(Objec...

Read more...

Revision history for this message
In , Albert Astals Cid (aacid) wrote :

i tracked it a bit yesterday and seems like the aesDecryptBlock was not filling all the values of state.aes.buf but could not have much more in depth look, it have passed 5 years since i implemented an aes function so i really don't remember much of it :D

Changed in poppler:
status: Unknown → Confirmed
Revision history for this message
In , Albert Astals Cid (aacid) wrote :

*** Bug 16092 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Albert Astals Cid (aacid) wrote :

*** Bug 17523 has been marked as a duplicate of this bug. ***

Revision history for this message
In , Albert Astals Cid (aacid) wrote :

Will not crash anymore with poppler 0.9.1

Revision history for this message
Pedro Villavicencio (pedro) wrote :

according to upstream this will work fine with poppler 0.9.1

Changed in poppler:
status: Triaged → Fix Committed
Changed in poppler:
status: Confirmed → Fix Released
Revision history for this message
Sebastien Bacher (seb128) wrote :

the new version has been uploaded to jaunty now

Changed in poppler:
status: Fix Committed → Fix Released
Changed in poppler:
importance: Unknown → Critical
Changed in poppler:
importance: Critical → Unknown
Changed in poppler:
importance: Unknown → Critical
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.