Bug#922398: libevdocument3-4: Evince passes NULL pointer to poppler_date_parse

Fri Feb 15 13:18:37 GMT 2019

Package: libevdocument3-4
Version: 3.30.2-3
Severity: normal

Dear Maintainer,

While processing my Dissertation material (over 400 pages LaTeX) Evince
fails to display the generated PDF file. Consequently, it crashes with
an unhandled
exception as you can see in the following gdb session excerpt:

$> gdb --args evince Dissertation.pdf
GNU gdb (Debian 8.2.1-1) 8.2.1
Copyright (C) 2018 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from evince...(no debugging symbols found)...done.
(gdb) r
Starting program: /usr/bin/evince Dissertation.pdf
[Thread debugging using libthread_db enabled]
Using host libthread_db library
"/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7f31a5ecc700 (LWP 11843)]
[New Thread 0x7f31a56cb700 (LWP 11844)]
[New Thread 0x7f31a4e47700 (LWP 11845)]
[New Thread 0x7f3197fff700 (LWP 11846)]
[New Thread 0x7f31977fe700 (LWP 11847)]
! SyncTeX Error : No file?
[New Thread 0x7f318f9f1700 (LWP 11848)]
[New Thread 0x7f318f1f0700 (LWP 11849)]
terminate called after throwing an instance of 'std::logic_error'
what(): basic_string::_M_construct null not valid

Thread 6 "EvJobScheduler" received signal SIGABRT, Aborted.
[Switching to Thread 0x7f31977fe700 (LWP 11847)]
__GI_raise (sig=sig at entry=6) at
../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: Datei oder Verzeichnis
nicht gefunden.
(gdb) bt full
#0 0x00007f31a8d0a8bb in __GI_raise (sig=sig at entry=6)
at ../sysdeps/unix/sysv/linux/raise.c:50
set = {__val = {0, 128849018883, 139850971861872, 64424509441,
139850971862000, 3, 0, 0, 7453294905665025139, 8245935278391255913,
139850971864064, 139850971863872, 139850971864184, 0, 139850971864200, 0}}
pid = <optimized out>
tid = <optimized out>
#1 0x00007f31a8cf5535 in __GI_abort () at abort.c:79
save_stage = 1
act = {__sigaction_handler = {sa_handler = 0xb, sa_sigaction = 0xb},
sa_mask = {__val = {0, 3432, 139851263947424, 139851263964931,
139851262646735, 41, 139850958663496, 139850971863328, 139850715569184,
94214282107424, 0, 139851182392764, 139851280872092, 139850717343800,
139851280892296, 139851263965248}}, sa_flags = -1767392304, sa_restorer
= 0x7f3188391c20} sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007f3196a76943 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3 0x00007f3196a7c8a6 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#4 0x00007f3196a7c8e1 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#5 0x00007f3196a7cb14 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#6 0x00007f3196a78793 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#7 0x00007f31a402a81c in poppler_date_parse () at
/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
#8 0x00007f31a40c0307 in () at
/usr/lib/x86_64-linux-gnu/evince/4/backends/libpdfdocument.so
#9 0x00007f31a9de64fa in () at /usr/lib/x86_64-linux-gnu/libevview3.so.3
#10 0x00007f31a9de84c2 in () at /usr/lib/x86_64-linux-gnu/libevview3.so.3
#11 0x00007f31a90ae425 in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007f31a8e9bfa3 in start_thread (arg=<optimized out>) at
pthread_create.c:486
ret = <optimized out>
pd = <optimized out>
now = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {139850971866880,
7246701942669474992, 140736960326574, 140736960326575, 139850971866880,
0, -7281656517761008464, -7281717142416753488},
mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev =
0x0, cleanup = 0x0, canceltype = 0}}}
not_first_call = <optimized out>
#13 0x00007f31a8dcc80f in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb) up
#1 0x00007f31a8cf5535 in __GI_abort () at abort.c:79
79 abort.c: Datei oder Verzeichnis nicht gefunden.
(gdb) up
#2 0x00007f3196a76943 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
(gdb)
#3 0x00007f3196a7c8a6 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
(gdb)
#4 0x00007f3196a7c8e1 in std::terminate() () from
/usr/lib/x86_64-linux-gnu/libstdc++.so.6
(gdb)
#5 0x00007f3196a7cb14 in __cxa_throw () from
/usr/lib/x86_64-linux-gnu/libstdc++.so.6
(gdb)
#6 0x00007f3196a78793 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
(gdb)
#7 0x00007f31a402a81c in poppler_date_parse () from
/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
(gdb) info frame
Stack level 7, frame at 0x7f31977fda50:
rip = 0x7f31a402a81c in poppler_date_parse;
saved rip = 0x7f31a40c0307
called by frame at 0x7f31977fdb50,
caller of frame at 0x7f31977fd9e0
Arglist at 0x7f31977fd9d8,
args: Locals at 0x7f31977fd9d8,
Previous frame's sp is 0x7f31977fda50
Saved registers: rbx at 0x7f31977fda20, rbp at 0x7f31977fda28, r12 at
0x7f31977fda30, r13 at 0x7f31977fda38, r14 at 0x7f31977fda40, rip at
0x7f31977fda48
(gdb) break poppler_date_parse
Breakpoint 1 at 0x7f31a402a710
(gdb) r
The program being debugged has been started already. Start it from the
beginning? (y or n) y
Starting program: /usr/bin/evince Dissertation.pdf [Thread debugging
using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7f9c531cd700 (LWP 13494)]
[New Thread 0x7f9c529cc700 (LWP 13495)]
[New Thread 0x7f9c52148700 (LWP 13496)]
[New Thread 0x7f9c5149b700 (LWP 13497)]
[New Thread 0x7f9c50bca700 (LWP 13498)]
[Switching to Thread 0x7f9c50bca700 (LWP 13498)]

Thread 6 "EvJobScheduler"
hit Breakpoint 1, 0x00007f9c50329710 in poppler_date_parse () from
/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
(gdb) info frame
Stack level 0, frame at 0x7f9c50bc96c0:
rip = 0x7f9c50329710 in poppler_date_parse;
saved rip = 0x7f9c5032ca61
called by frame at 0x7f9c50bc96e0
Arglist at 0x7f9c50bc96b0,
args: Locals at 0x7f9c50bc96b0,
Previous frame's sp is 0x7f9c50bc96c0
Saved registers: rip at 0x7f9c50bc96b8
(gdb) print *(char*)$rax at 20
$5 = "D:20190214140150+01'"
(gdb) c Continuing.

Thread 6 "EvJobScheduler"
hit Breakpoint 1, 0x00007f9c50329710 in poppler_date_parse () from
/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
(gdb) print *(char*)($rax)@24
$30 = "D:20190214140150+01'00'"
(gdb) print *(char*)($rax)@25
$31 = "D:20190214140150+01'00'\000%"
(gdb) c Continuing.
[Thread 0x7f9c52148700 (LWP 13496) exited]
! SyncTeX Error : No file?
[New Thread 0x7f9c52148700 (LWP 14147)]
[New Thread 0x7f9c38e3b700 (LWP 14148)]

Thread 6 "EvJobScheduler"
hit Breakpoint 1, 0x00007f9c50329710 in poppler_date_parse () from
/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
(gdb) print *(char*)($rax)@24
Cannot access memory at address 0x0
(gdb) c
Continuing.
[Thread 0x7f9c38e3b700 (LWP 14148) exited]
terminate called after throwing an instance of 'std::logic_error'
what(): basic_string::_M_construct null not valid
[New Thread 0x7f9c38e3b700 (LWP 14150)]

Thread 6 "EvJobScheduler" received signal SIGABRT,
Aborted.
__GI_raise (sig=sig at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
50 ../sysdeps/unix/sysv/linux/raise.c: Datei oder Verzeichnis nicht
gefunden.
(gdb) bt full
#0 0x00007f9c5600b8bb in __GI_raise (sig=sig at entry=6) at
../sysdeps/unix/sysv/linux/raise.c:50
set = {__val = {0, 128849018883, 140309346161520, 64424509441,
140309346161648, 3, 0, 0, 7453294905665025139, 8245935278391255913,
140309346163712, 140309346163520, 140309346163832, 0, 140309346163848,
0}}
pid = <optimized out>
tid = <optimized out>
#1 0x00007f9c55ff6535 in __GI_abort () at abort.c:79
save_stage = 1
act = {__sigaction_handler = {sa_handler = 0xb, sa_sigaction = 0xb},
sa_mask = {__val = {0, 3432, 140309436088992, 140309436106499,
140309434788303, 41, 140308995186504, 140309346162976, 140309068082848,
140309068367616, 0, 140309337748924, 140309453013660, 140309069416648,
140309453033864, 140309436106816}}, sa_flags = 1002597328, sa_restorer =
0x7f9c40296ea0}
sigs = {__val = {32, 0 <repeats 15 times>}}
#2 0x00007f9c3bc21943 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#3 0x00007f9c3bc278a6 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#4 0x00007f9c3bc278e1 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#5 0x00007f9c3bc27b14 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#6 0x00007f9c3bc23793 in () at /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#7 0x00007f9c5032981c in poppler_date_parse () at
/usr/lib/x86_64-linux-gnu/libpoppler-glib.so.8
#8 0x00007f9c503bf307 in () at
/usr/lib/x86_64-linux-gnu/evince/4/backends/libpdfdocument.so
#9 0x00007f9c570e74fa in () at /usr/lib/x86_64-linux-gnu/libevview3.so.3
#10 0x00007f9c570e94c2 in () at /usr/lib/x86_64-linux-gnu/libevview3.so.3
#11 0x00007f9c563af425 in () at /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0
#12 0x00007f9c5619cfa3 in start_thread (arg=<optimized out>) at
pthread_create.c:486
ret = <optimized out>
pd = <optimized out>
now = <optimized out>
unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140309346166528,
-4498468056355603717, 140720924560638, 140720924560639, 140309346166528,
0, 4515591295464078075, 4515587677372381947}, mask_was_saved = 0}}, priv
= {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0,
canceltype = 0}}}
not_first_call = <optimized out>
#13 0x00007f9c560cd80f in clone () at
../sysdeps/unix/sysv/linux/x86_64/clone.S:95
(gdb)

As you can see it parses two dates and failes a third time passing a
null pointer.

$ pdfinfo Dissertation.pdf
Title: Title of the document
Subject: Subject
Keywords:
Author: The author
Creator: LaTeX with hyperref
Producer: LuaTeX-1.07.0
CreationDate: Thu Feb 14 14:01:50 2019 CET
ModDate: Thu Feb 14 14:01:50 2019 CET
Tagged: no
UserProperties: no
Suspects: no
Form: none
JavaScript: no
Pages: 474
Encrypted: no
Page size: 595.276 x 841.89 pts (A4)
Page rot: 0
File size: 8918798 bytes
Optimized: no
PDF version: 1.5

-- System Information:
Debian Release: buster/sid
APT prefers stable-updates
APT policy: (500, 'stable-updates'), (500, 'jessie'), (500, 'unstable'),
(500, 'testing'), (500, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=de_DE.utf8, LC_CTYPE=de_DE.utf8 (charmap=UTF-8),
LANGUAGE=de_DE.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libevdocument3-4 depends on:
ii libarchive13 3.3.3-4
ii libc6 2.28-7
ii libcairo2 1.16.0-2
ii libdjvulibre21 3.5.27.1-10
ii libgdk-pixbuf2.0-0 2.38.0+dfsg-7
ii libglib2.0-0 2.58.3-1
ii libgtk-3-0 3.24.5-1
ii libgxps2 0.3.1-1
ii libkpathsea6 2018.20181218.49446-1
ii libpango-1.0-0 1.42.4-6
ii libpoppler-glib8 0.71.0-2
ii libspectre1 0.2.8-1
ii libsynctex2 2018.20181218.49446-1
ii libtiff5 4.0.10-4
ii libxml2 2.9.4+dfsg1-7+b3
ii zlib1g 1:1.2.11.dfsg-1

libevdocument3-4 recommends no packages.

libevdocument3-4 suggests no packages.

-- no debconf information