Bug 52487

Created attachment 64676 [details]
Example page

While trying to render some pages in http://www.stanford.edu/class/ee398a/handouts/papers/Meyr%20-%20Run-Length%20Codes%20-%20TC74.pdf, splash fails with a "Out of memory" or "Bogus allocation size" error and quits.

This is the backtrace up to the failing gmalloc call, while trying to render the last page from the qt4 demo application. It seems that it's trying to allocate 531499*3368 = ~1.7 GB of memory.

I'm attaching the last page of that document, extracted with pdfseparate.

#0  0xb7ddf80a in gmalloc (checkoverflow=false, size=<optimized out>)
    at /home/fabio/ok/poppler/goo/gmem.cc:121
#1  gmalloc (checkoverflow=false, size=<optimized out>) at /home/fabio/ok/poppler/goo/gmem.cc:215
#2  gmallocn (checkoverflow=false, objSize=531499, nObjs=3368) at /home/fabio/ok/poppler/goo/gmem.cc:212
#3  gmallocn (nObjs=3368, objSize=531499) at /home/fabio/ok/poppler/goo/gmem.cc:216
#4  0xb7ed4f96 in SplashBitmap::SplashBitmap (this=0x837ea08, widthA=842, heightA=531499, rowPadA=1, 
    modeA=splashModeXBGR8, alphaA=false, topDown=true)
    at /home/fabio/ok/poppler/splash/SplashBitmap.cc:104
#5  0xb7ecad5a in Splash::scaleImage (this=0x837c650, src=
    0xb7eb8b40 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, srcData=0xbfffd7ec, 
    srcMode=splashModeXBGR8, nComps=4, srcAlpha=false, srcWidth=2626, srcHeight=3320, scaledWidth=842, 
    scaledHeight=531499) at /home/fabio/ok/poppler/splash/Splash.cc:3805
#6  0xb7ecbb5c in Splash::arbitraryTransformImage (this=0x837c650, 
    src=0xb7eb8b40 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, 
    srcData=0xbfffd7ec, srcMode=splashModeXBGR8, nComps=4, srcAlpha=false, srcWidth=2626, 
    srcHeight=3320, mat=0xbfffd7b8) at /home/fabio/ok/poppler/splash/Splash.cc:3627
#7  0xb7eceef1 in Splash::drawImage (this=0x837c650, 
    src=0xb7eb8b40 <SplashOutputDev::imageSrc(void*, unsigned char*, unsigned char*)>, 
    srcData=0xbfffd7ec, srcMode=splashModeXBGR8, srcAlpha=false, w=2626, h=3320, mat=0xbfffd7b8)
    at /home/fabio/ok/poppler/splash/Splash.cc:3502
#8  0xb7ebc45f in SplashOutputDev::drawImage (this=0x8411590, state=0x83634a0, ref=0xbfffdaa8, str=
    0x83a9ae0, width=2626, height=3320, colorMap=0x83a27d8, interpolate=false, maskColors=0x0, 
    inlineImg=false) at /home/fabio/ok/poppler/poppler/SplashOutputDev.cc:3086
#9  0xb7e37839 in Gfx::doImage (this=0x83b99b0, ref=0xbfffdaa8, str=0x83a9ae0, inlineImg=false)
    at /home/fabio/ok/poppler/poppler/Gfx.cc:4562
#10 0xb7e38819 in Gfx::opXObject (this=0x83b99b0, args=0xbfffdb84, numArgs=1)
    at /home/fabio/ok/poppler/poppler/Gfx.cc:4119
#11 0xb7e2cb47 in Gfx::execOp (this=0x83b99b0, cmd=0xbfffdd24, args=0xbfffdb84, numArgs=1)
    at /home/fabio/ok/poppler/poppler/Gfx.cc:857
#12 0xb7e3414f in Gfx::go (this=0x83b99b0, topLevel=true) at /home/fabio/ok/poppler/poppler/Gfx.cc:716
#13 0xb7e34630 in Gfx::display (this=0x83b99b0, obj=0xbfffde24, topLevel=true)
    at /home/fabio/ok/poppler/poppler/Gfx.cc:682
#14 0xb7e7616b in Page::displaySlice (this=0x83c1e60, out=0x8411590, hDPI=96, vDPI=96, rotate=0, 
    useMediaBox=false, crop=true, sliceX=-1, sliceY=-1, sliceW=-1, sliceH=-1, printing=false, 
    abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, annotDisplayDecideCbkData=0x0)
    at /home/fabio/ok/poppler/poppler/Page.cc:520
#15 0xb7e7c740 in PDFDoc::displayPageSlice (this=0x837c870, out=0x8411590, page=10, hDPI=96, vDPI=96, 
    rotate=0, useMediaBox=false, crop=true, printing=false, sliceX=-1, sliceY=-1, sliceW=-1, sliceH=-1, 
    abortCheckCbk=0, abortCheckCbkData=0x0, annotDisplayDecideCbk=0, annotDisplayDecideCbkData=0x0)
    at /home/fabio/ok/poppler/poppler/PDFDoc.cc:501
#16 0xb7fea036 in Poppler::Page::renderToImage (this=0x8368d78, xres=96, yres=96, x=-1, y=-1, w=-1, 
    h=-1, rotate=Poppler::Page::Rotate0) at /home/fabio/ok/poppler/qt4/src/poppler-page.cc:237
#17 0x080571d3 in PageView::pageChanged (this=0x80e4fc0, page=9)
    at /home/fabio/ok/poppler/qt4/demos/pageview.cpp:59


(from https://bugs.kde.org/show_bug.cgi?id=304051)