Bug 32890 - setjmp is missing in DCTStream::init()
Summary: setjmp is missing in DCTStream::init()
Status: RESOLVED FIXED
Alias: None
Product: poppler
Classification: Unclassified
Component: general (show other bugs)
Version: unspecified
Hardware: Other All
: medium normal
Assignee: poppler-bugs
QA Contact:
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2011-01-06 19:10 UTC by Daiki Ueno
Modified: 2011-01-09 10:49 UTC (History)
0 users

See Also:
i915 platform:
i915 features:


Attachments
patch to call setjmp before jpeg_create_decompress() (850 bytes, application/octet-stream)
2011-01-06 19:10 UTC, Daiki Ueno
Details
patch to call setjmp before jpeg_create_decompress() (797 bytes, patch)
2011-01-08 20:03 UTC, Daiki Ueno
Details | Splinter Review
patch to call setjmp before jpeg_create_decompress() (753 bytes, patch)
2011-01-09 05:15 UTC, Daiki Ueno
Details | Splinter Review
patch to call setjmp before jpeg_create_decompress() (918 bytes, patch)
2011-01-09 05:55 UTC, Daiki Ueno
Details | Splinter Review
patch to call setjmp before jpeg_create_decompress() (2.65 KB, patch)
2011-01-09 07:10 UTC, Daiki Ueno
Details | Splinter Review

Description Daiki Ueno 2011-01-06 19:10:01 UTC
Created attachment 41735 [details]
patch to call setjmp before jpeg_create_decompress()

Kouhei Sutou noticed that DCTStream::init() does not setjmp before calling jpeg_create_decompress(), which may call error_exit in exceptional cases and cause longjmp with an uninitialized jmp_buf.

I may be paranoiac here, but anyway I'm attaching a patch.
Comment 1 Albert Astals Cid 2011-01-08 05:07:24 UTC
Your patch is not correct, it will leave row_buffer unitialized if it fails and the program will crash afterwards anyway. Please handle correctly the failure case
Comment 2 Daiki Ueno 2011-01-08 20:03:06 UTC
Created attachment 41782 [details] [review]
patch to call setjmp before jpeg_create_decompress()

Thanks.  The attached patch makes sure to initialize row_buffer even if jpeg_create_decompress() fails.  Though DCTStream still keeps uninitialized cinfo after failure, I think that it is safe since each jpeg_*() checks the state internally.
Comment 3 Albert Astals Cid 2011-01-09 04:58:55 UTC
There's still something that needs improvement, i did

diff --git a/poppler/DCTStream.cc b/poppler/DCTStream.cc
index 212a8bd..34db5bf 100644
--- a/poppler/DCTStream.cc
+++ b/poppler/DCTStream.cc
@@ -91,8 +91,10 @@ void DCTStream::init()
   limit = NULL;
   
   cinfo.err = &jerr;
-  jpeg_create_decompress(&cinfo);
-  cinfo.src = (jpeg_source_mgr *)&src;
+  if (false && !setjmp(src.setjmp_buffer)) {
+    jpeg_create_decompress(&cinfo);
+    cinfo.src = (jpeg_source_mgr *)&src;
+  }
   row_buffer = NULL;
 }
 

To simulate a "failure" of jpeg_create_decompress and then ran pdftoppm over a file that uses that code and still crashes. Could you try to find what is the problem?
Comment 4 Daiki Ueno 2011-01-09 05:15:20 UTC
Created attachment 41798 [details] [review]
patch to call setjmp before jpeg_create_decompress()

Right, sorry for bothering you.

I'm attaching a new patch, which I tested with:
- edit /usr/include/jpeglib.h to change JPEG_LIB_VERSION (80 -> 81 here)
- rebuild poppler
- run cpp/tests/poppler-render -o foo.png ~/pdf-embedding-jpeg.pdf

Actually the previous patches crash poppler-render :-(
Comment 5 Daiki Ueno 2011-01-09 05:55:08 UTC
Created attachment 41799 [details] [review]
patch to call setjmp before jpeg_create_decompress()

Sorry again, the previous patch breaks the normal case...
This patch should work with both cases.
Comment 6 Daiki Ueno 2011-01-09 07:10:42 UTC
Created attachment 41802 [details] [review]
patch to call setjmp before jpeg_create_decompress()

Moved setjmp_buffer from str_src_mgr to a wrapper struct of jpeg_error_mgr so as to catch failures after cinfo->src is cleared in jpeg_create_decompress().
Comment 7 Albert Astals Cid 2011-01-09 10:49:21 UTC
Commited, thanks.


Use of freedesktop.org services, including Bugzilla, is subject to our Code of Conduct. How we collect and use information is described in our Privacy Policy.