bug#81518: okular 25.12.3 crashes when digitally signing a PDF with poppler-qt6 22.09.0

[Maxi Rica]

Hello,




System:

 *

   x86_64 GNU/Linux, Devuan

 *

   Guix branch: master

 *

   Guix commit: 50b196bbd536f71c68b127f918618f5ef1e4600b

 *

   Okular: 25.12.3

 *

   Poppler in the Okular closure: 22.09.0

 *

   Library involved: libpoppler.so.124.0.0

Steps to reproduce:

1.

   Open a local PDF in Okular.

2.

   Select the digital signature tool.

3.

   Select a certificate from the NSS certificate database.

4.

   Place the signature and save the resulting PDF.

5.

   Okular immediately crashes.

The kernel consistently reports a segmentation fault inside Poppler:

|.okular-real: segfault at 0 [...] in libpoppler.so.124.0.0 |

The crash was reproduced several times with different process IDs.

The Poppler version used by the Okular closure was confirmed with:



Result:

|/gnu/store/0k75csv6hg9gq1clsf9iz9nx0w6gs9r7-poppler-22.09.0 |

As a diagnostic test, I rebuilt Okular against the Poppler 26.07.0 source:















Regards,
Maxi

Okular 25.12.3 from Guix crashes reproducibly when digitally signing a PDF and saving the resulting document. |okular_store="$(dirname "$(dirname "$(readlink -f "$(command -v okular)")")")" guix gc --requisites "$okular_store" | grep -E '/[^/]*poppler-[0-9]' | |guix build okular \ --with-source=poppler-qt6=/gnu/store/...-poppler-26.07.0.tar.xz \ --with-configure-flag=poppler-qt6=-DENABLE_GPGME=OFF \ --with-configure-flag=poppler-qt6=-DENABLE_LIBTIFF=OFF \ --with-configure-flag=poppler-qt6=-DENABLE_QT5=OFF \ --with-configure-flag=poppler-qt6=-DENABLE_LIBCURL=OFF | The optional features were disabled only because the old |poppler-qt6| package inputs do not satisfy the dependency versions required by Poppler 26.07.0. With this rebuilt version, the same PDF can be signed with the same NSS certificate and saved successfully. Okular no longer crashes. Poppler 26.07.0 also includes an upstream Qt6 fix described as “Fix crash in some signature operations” (Issue #1737). This suggests that Guix's |poppler-qt6| package is too old for the current Okular package. Guix currently provides |poppler-next|, but it does not include the Qt6 frontend, so it cannot directly replace |poppler-qt6|. A possible fix would be to update |poppler-qt6|, add a current |poppler-next-qt6| variant, and make Okular use it. No PDF is attached because the original document contains private information. I can test a public or minimal PDF if a standalone reproducer is required.

OpenPGP_0xA5F6A98E4A1162B7.asc
Description: OpenPGP public key

OpenPGP_signature.asc
Description: OpenPGP digital signature