Bug 16633

Summary:	The patch for a crash when "IRT" object is present
Product:	poppler	Reporter:	tlknv <tlknv>
Component:	general	Assignee:	poppler-bugs <poppler-bugs>
Status:	RESOLVED FIXED	QA Contact:
Severity:	normal
Priority:	medium	CC:	arun, dang
Version:	unspecified
Hardware:	x86 (IA32)
OS:	All
Whiteboard:
i915 platform:		i915 features:
Attachments:	The patch for a crash when "IRT" object is present

Description tlknv 2008-07-07 11:10:27 UTC

Created attachment 17564 [details] [review]
The patch for a crash when "IRT" object is present

This patch fixes a crash when "IRT" object is present. The patch is based on the latest stable poppler-0.8.4. I have the crash in pdftohtml but is should affect other components too.

Comment 1 Albert Astals Cid 2008-07-20 05:03:55 UTC

Can you please attach a pdf that triggers such a crash?

Comment 2 tlknv 2008-07-20 11:36:42 UTC

Sorry. I can't attach that pdf. It's a private data. If you have any pdf that causes execution of the line
     inReplyTo = obj1.getDict();
then you get a crash with pdftohtml for sure.
Anyway the logic is simple. Without inReplyTo->incRef() the nearest
obj1.free() destroys/frees the object pointed by inReplyTo. So inReplyTo points to freed memory. Just in case, I compiled it under MSVC 2005.

Comment 3 Albert Astals Cid 2008-07-24 13:36:13 UTC

*** Bug 16762 has been marked as a duplicate of this bug. ***

Comment 4 Albert Astals Cid 2008-07-24 13:44:40 UTC

Fixed in a different way.

Comment 5 Arun Raghavan 2008-07-26 13:55:37 UTC

Thanks for fixing this. About when can we expect the next release? I ask because that'll help us decide whether we should ship this fix now in Gentoo or just wait.

Comment 6 Albert Astals Cid 2008-07-27 06:46:11 UTC

My calendar says tomorrow 28/07 for poppler 0.8.5 but i've still some patches on the pipeline to review and apply, but anyway i'll be "soon"

Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.