Bug#924029: evince: Crashes when opening a PDF

[Bernhard Übelacker]

Control: reassign 924029 libpoppler-glib8 0.71.0-3
Control: affects 924029 evince
Control: tags 924029 + patch upstream fixed-upstream


Dear Maintainer,
I just tried to reproduce the issue and received the crash below.

For some reason poppler_annot_get_modified returns a null pointer,
instead of a string to a date.

That null is feeded into poppler_date_parse which in the end tries to
create a std::string from it, which throws then the error "null not valid".

Poppler upstream has following bug [1] and patch [2].
The first release containing that patch is 0.72.0.

A package built with patch [2] is able to show the given
PDFs without crashing.

Kind regards,
Bernhard



[1] https://gitlab.freedesktop.org/poppler/poppler/issues/670
[2] https://gitlab.freedesktop.org/poppler/poppler/commit/8f158da92c53ae16a368f844965f57ba8ffed77d



(gdb) bt
#0  __GI_raise (sig=sig at entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f0a09aca535 in __GI_abort () at abort.c:79
#2  0x00007f0a042ea983 in __gnu_cxx::__verbose_terminate_handler () at ../../../../src/libstdc++-v3/libsupc++/vterminate.cc:95
#3  0x00007f0a042f08e6 in __cxxabiv1::__terminate (handler=<optimized out>) at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:47
#4  0x00007f0a042f0921 in std::terminate () at ../../../../src/libstdc++-v3/libsupc++/eh_terminate.cc:57
#5  0x00007f0a042f0b54 in __cxxabiv1::__cxa_throw (obj=obj at entry=0x7f09f40bde40, tinfo=0x7f0a043d4958 <typeinfo for std::logic_error>, dest=0x7f0a04305520 <std::logic_error::~logic_error()>) at ../../../../src/libstdc++-v3/libsupc++/eh_throw.cc:95
#6  0x00007f0a042ec7d3 in std::__throw_logic_error (__s=__s at entry=0x7f0a0495f198 "basic_string::_M_construct null not valid") from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#7  0x00007f0a0493b82c in std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*> (__end=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, __beg=0x0, this=0x7f0a0519f9f0) at /usr/include/c++/8/bits/basic_string.tcc:206
#8  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct_aux<char const*> (__end=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, __beg=0x0, this=0x7f0a0519f9f0) at /usr/include/c++/8/bits/basic_string.h:236
#9  std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*> (__end=0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>, __beg=0x0, this=0x7f0a0519f9f0) at /usr/include/c++/8/bits/basic_string.h:255
#10 std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::basic_string (__a=..., __s=0x0, this=0x7f0a0519f9f0) at /usr/include/c++/8/bits/basic_string.h:516
#11 GooString::GooString (sA=0x0, this=0x7f0a0519f9f0) at ./goo/GooString.h:63
#12 poppler_date_parse (date=date at entry=0x0, timet=timet at entry=0x7f0a0519faa0) at ./glib/poppler-date.cc:42
#13 0x00007f0a04995307 in ev_annot_from_poppler_annot (page=0x5652f7cd0330, poppler_annot=0x5652f78b1340) at ev-poppler.cc:3285
#14 pdf_document_annotations_get_annotations (document_annotations=<optimized out>, page=0x5652f7cd0330) at ev-poppler.cc:3395
#15 0x00007f0a0abba4fa in ev_job_annots_run (job=0x5652f7b53de0) at ev-jobs.c:544
#16 0x00007f0a0abbc4c2 in ev_job_thread (job=0x5652f7b53de0) at ev-job-scheduler.c:184
#17 ev_job_thread_proxy (data=<optimized out>) at ev-job-scheduler.c:217
#18 0x00007f0a09e83425 in g_thread_proxy (data=0x7f09f0002320) at ../../../glib/gthread.c:784
#19 0x00007f0a09c70fa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
#20 0x00007f0a09ba182f in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95