Bug#320627: crash w/ xpdf
forwarded 320627 https://bugs.freedesktop.org/show_bug.cgi?id=11503 thank you I forwarded this bug upstream at the URL above with a debugging backtrace when crashing latest Xserver 1.3 from unstable. Feel free to add some comments there if you think it could help. Brice -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
Brice Goglin [EMAIL PROTECTED] writes: About 2 years ago, you reported (or replied to) a bug in the Debian BTS regarding a crash of the X server when running xpdf. Did any of you guys reproduce this problem recently? With Xorg/Etch? With latest xserver-xorg-core in unstable? If not, I will close this bug in the next weeks. X server crash (x86 with Intel graphics) when I load the chapter64.pdf Albert supplied and scroll down the index tree by dragging the scrollbar thumb. Looks like I reproduced it last time on my PowerBook. I can try that again too later if you like. (PowerPC, Radeon graphics.) Perhaps an X protocol trace would help find the request that triggers it? I seem to recall there are tools for doing that sort of thing. Maybe I should try with EXA instead of XAA, too. Anyway, some info below, log and conf attached. ii xpdf-reader 3.02-1 Portable Document Format (PDF) suite -- viewer for X11 ii xserver-xorg-core2:1.3.0.0.dfsg-6 X.Org X server -- core server ii xserver-xorg-video-intel 2:2.0.0-1X.Org X server -- Intel i8xx, i9xx display driver Backtrace: 0: /usr/bin/X(xf86SigHandler+0x81) [0x80c8591] 1: [0xb7fbc420] 2: /usr/lib/xorg/modules//libfb.so(fbPolyLine+0x6c) [0xb7afa61c] 3: /usr/lib/xorg/modules//libxaa.so [0xb7a98592] 4: /usr/bin/X [0x817687b] 5: /usr/bin/X(ProcPolyLine+0x100) [0x808bd40] 6: /usr/bin/X [0x8154a21] 7: /usr/bin/X(Dispatch+0x19f) [0x808ed3f] 8: /usr/bin/X(main+0x495) [0x8076e85] 9: /lib/libc.so.6(__libc_start_main+0xdc) [0xb7dd5ebc] 10: /usr/bin/X(FontFileCompleteXLFD+0x1e5) [0x80761a1] Fatal server error: Caught signal 11. Server aborting Section ServerLayout Identifier X.org Configured Screen 0 Screen0 0 0 InputDeviceMouse0 CorePointer InputDeviceKeyboard0 CoreKeyboard EndSection Section Files RgbPath /etc/X11/rgb ModulePath /usr/lib/xorg/modules FontPath /usr/share/fonts/X11/misc FontPath /usr/X11R6/lib/X11/fonts/misc FontPath /usr/share/fonts/X11/cyrillic FontPath /usr/share/fonts/X11/75dpi/:unscaled FontPath /usr/share/fonts/X11/100dpi/:unscaled FontPath /usr/share/fonts/X11/Type1 FontPath /usr/X11R6/lib/ X11/fonts/Type1 FontPath /usr/share/fonts/X11/75dpi FontPath /usr/share/fonts/X11/100dpi FontPath /var/lib/defoma/x-ttcidfont-conf.d/dirs/TrueType EndSection Section Module Load glx # Load vnc Load xtrap Load dbe Load extmod Load record Load dri Load type1 EndSection Section InputDevice Identifier Keyboard0 Driver kbd Option XkbOptions ctrl:nocaps EndSection Section InputDevice Identifier Mouse0 Driver mouse Option Protocol auto Option Device /dev/input/mice Option ZAxisMapping 4 5 6 7 option emulate3buttons true EndSection Section Monitor Identifier Monitor0 VendorName DEL ModelName DELL E771p EndSection Section Device ### Available Driver options are:- ### Values: i: integer, f: float, bool: True/False, ### string: String, freq: f Hz/kHz/MHz ### [arg]: arg optional #Option NoAccel # [bool] #Option SWcursor # [bool] #Option ColorKey # i #Option CacheLines# i #Option Dac6Bit # [bool] #Option DRI # [bool] #Option NoDDC # [bool] #Option ShowCache # [bool] #Option XvMCSurfaces # i #Option PageFlip # [bool] Identifier Card0 Driver i810 VendorName Intel Corporation BoardName 82845G/GL[Brookdale-G]/GE Chipset Integrated Graphics Device BusID PCI:0:2:0 Option legacy3d true # option videoram 65536 # option AperTexSize 65536 EndSection Section Screen Identifier Screen0 Device Card0 MonitorMonitor0 DefaultDepth 24 SubSection Display Modes 1280x1024 Depth 24 EndSubSection EndSection Section DRI Group dri Mode 0660 EndSection X Window System Version 1.3.0 Release Date: 19 April 2007 X Protocol Version 11, Revision 0, Release 1.3 Build Operating System: Linux Debian Current Operating System: Linux bandy 2.6.22-rc2 #32 Tue May 22 13:26:53 NZST 2007 i686 Build Date: 01 June 2007 Before reporting problems, check http://wiki.x.org to make sure that you have the latest version. Module Loader present Markers: (--) probed, (**) from config file, (==) default setting, (++) from command
Bug#320627: crash w/ xpdf
Hi, About 2 years ago, you reported (or replied to) a bug in the Debian BTS regarding a crash of the X server when running xpdf. Did any of you guys reproduce this problem recently? With Xorg/Etch? With latest xserver-xorg-core in unstable? If not, I will close this bug in the next weeks. Thanks, Brice -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
Full backtrace is attached. Seems there is, probably, an integer overflow in xpdf, as it requests polyline with coords like ((4, -32265), (12, -32265), (8, -32261), (4, -32265)). Fixing X server crash seems a non-trivial task. 320627-bt-full Description: Binary data
Bug#320627: crash w/ xpdf
#0 0x0fcf5c40 in kill () from /lib/libc.so.6
No symbol table info available.
#1 0x0fcf5a08 in raise () from /lib/libc.so.6
No symbol table info available.
#2 0x0fcf7140 in abort () from /lib/libc.so.6
No symbol table info available.
#3 0x1045ec7c in ddxGiveUp () at xf86Init.c:1264
i = 1
#4 0x1045edfc in AbortDDX () at xf86Init.c:1319
i = 1
#5 0x105907c0 in AbortServer () at log.c:395
No locals.
#6 0x10590cf8 in FatalError (
f=0x10ccb210 Caught signal %d. Server aborting\n) at log.c:541
args = {{gpr = 2 '\002', fpr = 0 '\0', reserved = 51740,
overflow_arg_area = 0x7f8cc0b8, reg_save_area = 0x7f8cc028}}
beenhere = 1
#7 0x104883b8 in xf86SigHandler (signo=11) at xf86Events.c:1294
No locals.
#8 signal handler called
No symbol table info available.
Cannot access memory at address 0x304
Looks like a stack breakage caused a segfault.
Maybe it would be useful to run same xpdf throurg X protocol monitor (xmon
package), to see which request is causing the crash.
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
Subject: crash w/ Florida law Package: xserver-common Version: multiple At least two people have managed to crash X by trying to read the Florida law using xpdf. -- instructions for trying it -- Here is the Florida Administrative Code: http://fac.dos.state.fl.us/faconline/chapter64.pdf The index doesn't work too well. Try following the instructions I was given for finding Chapter 64V-1, the Vital Statistics code: In the menu on the left side, scroll all the way to the bottom to 64V-1. You will need Adobe Acrobat Reader 4.05+ to view these file. --- On the debian-powerpc mailing list, Sean Neakums and Ken Moffat report: I just had a go at chapter64.pdf with xpdf and my X server crashed, which is impressive. I can't remember the last time I've had X crash. Damn, I wish I'd read further down the thread before I tried. Yeah, mine crashed too (on x86). A vulnerability triggered by malicious official documents. That's at least two bugs by my count (xpdf and X), and fixing one might hide the other. I have filed an xpdf bug as well. -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
reassign 320627 xserver-xorg thanks On Sat, Jul 30, 2005 at 02:10:55PM -0400, Albert Cahalan wrote: At least two people have managed to crash X by trying to read the Florida law using xpdf. Hi Albert, Could you do two things? Report this bug using reportbug, as it will attach a number of useful documents that will help us figure out what this bug is. Also, install xserver-xorg-dbg and follow the instructions on using it to report problems in /usr/share/doc/x11-common/FAQ.gz (or FAQ.html). I'll merge this bug with the one you report then. Thank you! - David Nusinow -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
On Sat, Jul 30, 2005 at 05:14:18PM -0400, Albert Cahalan wrote: On Sat, 2005-07-30 at 16:31 -0400, David Nusinow wrote: reassign 320627 xserver-xorg thanks On Sat, Jul 30, 2005 at 02:10:55PM -0400, Albert Cahalan wrote: At least two people have managed to crash X by trying to read the Florida law using xpdf. Hi Albert, Could you do two things? Report this bug using reportbug, as it will attach a number of useful documents that will help us figure out what this bug is. No, but I have filed a bug against reportbug. :-( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=279168 That's unfortunate. Hopefully the two people with the bug can do so, or if not, at least send us the critical files (mainly the log in /var/log/Xorg.0.log and /etc/X11/xorg.conf). Also, install xserver-xorg-dbg and follow the instructions on using it to report problems in /usr/share/doc/x11-common/FAQ.gz (or FAQ.html). I'll merge this bug with the one you report then. Thank you! That's not going to help I think, since X doesn't crash for me. It crashes for two other people. In my case, xpdf spews error messages about overflowing an interpreter stack. The document comes up mostly OK, except that the index (left panel) is truncated. I'll Cc: both others. Hopefully they can provide the required debug info. They are: Ken Moffat [EMAIL PROTECTED] Sean Neakums [EMAIL PROTECTED] Given that two other people managed to crash X, I figure that chances are pretty good that X will crash for you too. I guess I'm just lucky. :-/ It didn't crash for me with that file, I tried it with xpdf. Without more info, I can't do anything. - David Nusinow -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
On Sat, 30 Jul 2005, Albert Cahalan wrote: Unfortunately, mine wasn't a debian build (sorry if I misled you by commenting on a debian thread). Ken -- das eine Mal als Tragödie, das andere Mal als Farce
Bug#320627: crash w/ xpdf
On Sat, 2005-07-30 at 16:31 -0400, David Nusinow wrote: reassign 320627 xserver-xorg thanks On Sat, Jul 30, 2005 at 02:10:55PM -0400, Albert Cahalan wrote: At least two people have managed to crash X by trying to read the Florida law using xpdf. Hi Albert, Could you do two things? Report this bug using reportbug, as it will attach a number of useful documents that will help us figure out what this bug is. No, but I have filed a bug against reportbug. :-( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=279168 Also, install xserver-xorg-dbg and follow the instructions on using it to report problems in /usr/share/doc/x11-common/FAQ.gz (or FAQ.html). I'll merge this bug with the one you report then. Thank you! That's not going to help I think, since X doesn't crash for me. It crashes for two other people. In my case, xpdf spews error messages about overflowing an interpreter stack. The document comes up mostly OK, except that the index (left panel) is truncated. I'll Cc: both others. Hopefully they can provide the required debug info. They are: Ken Moffat [EMAIL PROTECTED] Sean Neakums [EMAIL PROTECTED] Given that two other people managed to crash X, I figure that chances are pretty good that X will crash for you too. I guess I'm just lucky. :-/ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of unsubscribe. Trouble? Contact [EMAIL PROTECTED]
Bug#320627: crash w/ xpdf
David Nusinow [EMAIL PROTECTED] writes: On Sat, Jul 30, 2005 at 05:14:18PM -0400, Albert Cahalan wrote: On Sat, 2005-07-30 at 16:31 -0400, David Nusinow wrote: reassign 320627 xserver-xorg thanks On Sat, Jul 30, 2005 at 02:10:55PM -0400, Albert Cahalan wrote: At least two people have managed to crash X by trying to read the Florida law using xpdf. Hi Albert, Could you do two things? Report this bug using reportbug, as it will attach a number of useful documents that will help us figure out what this bug is. No, but I have filed a bug against reportbug. :-( http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=279168 That's unfortunate. Hopefully the two people with the bug can do so, or if not, at least send us the critical files (mainly the log in /var/log/Xorg.0.log and /etc/X11/xorg.conf). Also, install xserver-xorg-dbg and follow the instructions on using it to report problems in /usr/share/doc/x11-common/FAQ.gz (or FAQ.html). I'll merge this bug with the one you report then. Thank you! That's not going to help I think, since X doesn't crash for me. It crashes for two other people. In my case, xpdf spews error messages about overflowing an interpreter stack. The document comes up mostly OK, except that the index (left panel) is truncated. I'll Cc: both others. Hopefully they can provide the required debug info. They are: Ken Moffat [EMAIL PROTECTED] Sean Neakums [EMAIL PROTECTED] Given that two other people managed to crash X, I figure that chances are pretty good that X will crash for you too. I guess I'm just lucky. :-/ It didn't crash for me with that file, I tried it with xpdf. Without more info, I can't do anything. I was still running 4.3 at the time. However I finally upgraded this afternoon and get a superficially identical crash with 6.8.2.dfsg.1-4. No xpdf spew though (unstable's version 3.00-14). I triggered the crash in the second case by dragging the contents/index's scroll thumb down. Requested files from a non-debug server crash attached. Also attached is a 'bt full' from an xserver-xorg-dbg crash; doesn't look very promising though. # XF86Config-4 (XFree86 X Window System server configuration file) # # This file was generated by dexconf, the Debian X Configuration tool, using # values from the debconf database. # # Edit this file with caution, and see the XF86Config-4 manual page. # (Type man XF86Config-4 at the shell prompt.) # # This file is automatically updated on xserver-xfree86 package upgrades *only* # if it has not been modified since the last upgrade of the xserver-xfree86 # package. # # If you have edited this file but would like it to be automatically updated # again, run the following commands as root: # # cp /etc/X11/XF86Config-4 /etc/X11/XF86Config-4.custom # md5sum /etc/X11/XF86Config-4 /var/lib/xfree86/XF86Config-4.md5sum # dpkg-reconfigure xserver-xfree86 Section Files # FontPathunix/:7100# local font server # if the local font server has problems, we can fall back on these FontPath/usr/lib/X11/fonts/misc FontPath/usr/lib/X11/fonts/cyrillic FontPath/usr/lib/X11/fonts/75dpi/:unscaled FontPath/usr/lib/X11/fonts/100dpi/:unscaled FontPath/usr/lib/X11/fonts/Type1 FontPath/usr/lib/X11/fonts/CID FontPath/usr/lib/X11/fonts/Speedo FontPath/usr/lib/X11/fonts/75dpi FontPath/usr/lib/X11/fonts/100dpi FontPath/var/lib/defoma/x-ttcidfont-conf.d/dirs/TrueType EndSection Section Module LoadGLcore Loadbitmap Loaddbe Loadddc Loaddri Loadextmod Loadfreetype Loadglx Loadint10 Loadrecord Loadspeedo Loadtype1 Loadvbe EndSection Section InputDevice Identifier Generic Keyboard Driver keyboard Option CoreKeyboard Option XkbRules xfree86 Option XkbModel macintosh Option XkbLayout us Option XkbOptionsctrl:nocaps EndSection Section InputDevice Identifier Configured Mouse Driver mouse Option CorePointer Option Device/dev/input/mice Option Protocol ImPS/2 Option Emulate3Buttons true Option ZAxisMapping 4 5 Option Buttons 5 EndSection Section Device Identifier ATI Technologies, Inc. RV350 [Mobility Radeon 9600 M10] Driver ati Option UseFBDev true # Option NoAccel true EndSection Section Monitor Identifier Generic Monitor HorizSync
