Bug 20011 - Use of uninitialised memory on GfxICCBasedColorSpace
Summary: Use of uninitialised memory on GfxICCBasedColorSpace
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: general (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2009-02-08 13:31 UTC by Albert Astals Cid
Modified: 2009-06-10 13:56 UTC (History)
1 user (show)

See Also:
i915 platform:
i915 features:


Attachments
said pdf (490.23 KB, application/pdf)
2009-02-08 13:31 UTC, Albert Astals Cid
Details
the patch fix a bug about cms profile cache (508 bytes, patch)
2009-02-11 22:37 UTC, Koji Otani
Details | Splinter Review
patch fixes this problem (1.21 KB, patch)
2009-02-11 23:01 UTC, Koji Otani
Details | Splinter Review
a patch fixes another bug (613 bytes, patch)
2009-02-14 01:15 UTC, Koji Otani
Details | Splinter Review

Description Albert Astals Cid 2009-02-08 13:31:30 UTC
Created attachment 22695 [details]
said pdf

Valgrind says

==30025== Conditional jump or move depends on uninitialised value(s)                                                       
==30025==    at 0x5F6122C: cmsLinearInterpFixed (in /usr/lib/liblcms.so.1.0.16)                                            
==30025==    by 0x5F6BC1F: cmsEvalMatShaper (in /usr/lib/liblcms.so.1.0.16)                                                
==30025==    by 0x5F71BA6: (within /usr/lib/liblcms.so.1.0.16)                                                             
==30025==    by 0x4F12315: GfxICCBasedColorSpace::getRGB(GfxColor*, GfxRGB*) (GfxState.h:167)                              
==30025==    by 0x4F12395: GfxICCBasedColorSpace::getGray(GfxColor*, int*) (GfxState.cc:1546)                              
==30025==    by 0x4F6FA01: SplashOutputDev::updateFillColor(GfxState*) (GfxState.h:1162)                                   
==30025==    by 0x4EF74BF: Gfx::doTilingPatternFill(GfxTilingPattern*, int, int) (Gfx.cc:1837)                             
==30025==    by 0x4EF7F1C: Gfx::opStroke(Object*, int) (Gfx.cc:1573)                                                       
==30025==    by 0x4EF06BC: Gfx::go(int) (Gfx.cc:643)                                                                       
==30025==    by 0x4EF4BE5: Gfx::display(Object*, int) (Gfx.cc:612)                                                         
==30025==    by 0x4F384DF: Page::displaySlice(OutputDev*, double, double, int, int, int, int, int, int, int, int, Catalog*, int (*)(void*), void*, int (*)(Annot*, void*), void*) (Page.cc:442)                                                                                                                                                                         
==30025==    by 0x402327: _ZL13savePageSliceP6PDFDocP15SplashOutputDeviiiiiddPc (pdftoppm.cc:134)

When running over the attached pdf
Comment 1 Albert Astals Cid 2009-02-08 13:32:05 UTC
Koji can you have a look?
Comment 2 Koji Otani 2009-02-08 21:14:15 UTC
I coudn't reproduce this.
I did followings on Fedora 7.

valgrind utils/pdftoppm bug117919.pdf

But, it didn't produce "Conditional jump or move ...".
Please tell me what environment you did it.
Comment 3 Albert Astals Cid 2009-02-09 14:44:47 UTC
I'm using Ubuntu 8.10
 valgrind 3.3.1
 lcms 1.16
 poppler from git trunk

And yeah, doing
  valgrind utils/pdftoppm bug117919.pdf
gets me the conditional jump or move warnings

Just wondering, how did you know it was bug117919.pdf?
Comment 4 Koji Otani 2009-02-09 21:01:28 UTC
> I'm using Ubuntu 8.10
>  valgrind 3.3.1
>  lcms 1.16
>  poppler from git trunk
> 
> And yeah, doing
>   valgrind utils/pdftoppm bug117919.pdf
> gets me the conditional jump or move warnings
>

I did it in the same environment as yours, but it didn't produce
the conditional jump or move warnings too.

Do you have a display profile file (display.icc)
 in ~/.xpdf/ColorProfiles or /usr/share/ColorProfiles ? 
 
> Just wondering, how did you know it was bug117919.pdf?

It's the pdf file attached here.


Comment 5 Albert Astals Cid 2009-02-10 02:42:08 UTC
No i don't have any color profile.

About the name strange, my browser suggests me the name attachment.foo not bug117919.pdf
Comment 6 Koji Otani 2009-02-10 05:29:09 UTC
Sorry, I did it with a wrong LD_LIBRARY_PATH.
I got the conditional jump or move warnings.
I'm investigating this problem.

> 
> About the name strange, my browser suggests me the name attachment.foo not
> bug117919.pdf
> 

Use external viewer or save it instead of viewing it with a plugin  
 and you will see the file name "bug117919.pdf".

Comment 7 Koji Otani 2009-02-11 22:37:31 UTC
Created attachment 22846 [details] [review]
the patch fix a bug about cms profile cache

First, I've found that the cache shifting writes out of the cache array.
This sometimes makes poppler crash.
I attached a patch fix this bug.
Comment 8 Koji Otani 2009-02-11 23:01:13 UTC
Created attachment 22847 [details] [review]
patch fixes this problem

When stroking with a pattern, set strokeColor with a copy of fillColor.
This is wrong and the fillColor may be uninitialized.
This is the cause of "Conditional jump or move depends on uninitialised value".
I attached the patch fixes this.
Comment 9 Koji Otani 2009-02-14 01:15:36 UTC
Created attachment 22936 [details] [review]
a patch fixes another bug

I've found a bug around this codes.
The page 1 of bug117919.pdf has a dashed grid. 
but poppler displayes non dashed grid.
This is because that stroke-width is not reset to 0 before pattern is drawn.
I attached the patch fixes this bug.

# you know that CairoOutputDev doesn't support stroke-with-pattern 
# because of lack of clipToStrokePath.
Comment 10 Albert Astals Cid 2009-02-25 14:44:43 UTC
I've applied patch from comment #7, i'll wait for patches in #8 and #9 until i am able to merge patches in bug 19670 and bug 19994 as they also touch similar parts of Gfx.cc and maybe they also fix it.
Comment 11 Albert Astals Cid 2009-06-10 13:56:47 UTC
I've commited both patches now, great work :-)


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.