Bug#560097: segfault in libkpathsea (from TL2007)

[Norbert Preining]

Hi Karl, hi all,
(please keep all the Cc)

I know that is old stuff and libkpathsea before this year shold not
be shared and and and, still I dare to ask:

on Debian we got a bug report that evince (GNOME viewer for pdf, ps, dvi)
crashed after installing the new texlive 2009 packages.

Since the new (2009) packages ship libkpathsea5 and evince is linked
against libkpathsea4 I would not expect any breakage, but there is 
a core dump.

The backtrace looks quite interesting:
#0  0x00007ffff3702f55 in raise () from /lib/libc.so.6
#1  0x00007ffff3705d90 in abort () from /lib/libc.so.6
#2  0x00007ffff373858d in ?? () from /lib/libc.so.6
#3  0x00007ffff3741d56 in ?? () from /lib/libc.so.6
#4  0x00007ffff37469bc in free () from /lib/libc.so.6
#5  0x00007fffeac0c2aa in ?? () from /usr/lib/libkpathsea.so.4
#6  0x00007fffeac0c509 in kpse_fontmap_lookup () from /usr/lib/libkpathsea.so.4
#7  0x00007fffeac08e49 in kpse_find_file () from /usr/lib/libkpathsea.so.4
#8  0x00007fffeae30acf in lookup_font_metrics (name=0x47ef <Address 0x47ef out of bounds>, type=0x7fffeb83fbfc)
(followed by loads of other references into the evince code)

Does that ring a bell somewhere in one of your brains (I don't imply
that you Karl have more brains - which might well be possible, but more
the other brains on the list here, too)?

More info there:
(gdb) run tmp/test.dvi 
Starting program: /usr/bin/evince tmp/test.dvi
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffeb840910 (LWP 18418)]
[New Thread 0x7fffe721d910 (LWP 18419)]
*** glibc detected *** /usr/bin/evince: free(): invalid pointer: 0x0000000000aab421 ***
======= Backtrace: =========
/lib/libc.so.6[0x7ffff3741d56]
/lib/libc.so.6(cfree+0x6c)[0x7ffff37469bc]
/usr/lib/libkpathsea.so.4[0x7fffeac0c2aa]
/usr/lib/libkpathsea.so.4(kpse_fontmap_lookup+0xd9)[0x7fffeac0c509]
/usr/lib/libkpathsea.so.4(kpse_find_file+0x2f9)[0x7fffeac08e49]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae30acf]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae31804]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae2a95d]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae2faed]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae2841a]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae24f7a]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae26835]
/usr/lib/evince/1/backends/libdvidocument.so[0x7fffeae20146]
/usr/lib/libevview.so.1[0x7ffff779eb21]
/usr/lib/libevview.so.1[0x7ffff779f820]
/lib/libglib-2.0.so.0[0x7ffff3de3f64]
/lib/libpthread.so.0[0x7ffff600373a]
/lib/libc.so.6(clone+0x6d)[0x7ffff379c69d]
======= Memory map: ========
(deleted for now)

The thing that made me wonder is that it showed up only when the
submitter installed the telxive 2009 Debian packages. I am thinking
about the much increased fontmap (due to hugely increased list of fonts
maybe?).

Well, thanks for any suggestion or hints and all the best

Norbert

------------------------------------------------------------------------
Norbert Preining            preining@{jaist.ac.jp, logic.at, debian.org}
JAIST, Japan            TU Wien, Austria           Debian TeX Task Force
DSA: 0x09C5B094   fp: 14DF 2E6C 0307 BE6D AD76  A9C0 D2BF 4AA3 09C5 B094
------------------------------------------------------------------------
HUBY (n.)
A half-erection large enough to be a publicly embarrassing bulge in
the trousers, not large enough to be of any use to anybody.
			--- Douglas Adams, The Meaning of Liff