Bug#651736: ghostscript: segfault when using cups device for rastering w/ SAFER and Seiko PPD

On Sun, Dec 11, 2011 at 5:01 PM, Jonathan Nieder <jrnieder@gmail.com> wrote:

Hi Ralph,

Ralph A. Smith wrote:

> ghostscript 8.71 segfaults when invoked by CUPS (via the pdftoraster filter)
> to print to a Seiko Smart Label Printer (SLP) using the PPD provided
> by Seiko (at www.siibusinessproducts.com). The offending ghostscript command
> (with standard input from pstopdf|pdftopdf) is
>
> /usr/bin/gs -dQUIET -dPARANOIDSAFER -dNOPAUSE -dBATCH -sDEVICE=cups
> -sstdout=%stderr -sOutputFile=%stdout -I/usr/share/cups/fonts
> -r203x203 -dDEVICEWIDTHPOINTS=236 -dDEVICEHEIGHTPOINTS=68
> -dcupsBitsPerColor=1 -dcupsColorOrder=0 -dcupsColorSpace=3
> -scupsPageSizeName=AddressSmall -c -f -
>
> If the PARANOIDSAFER option is removed, the command succeeds, but it still
> fails with SAFER instead.

I can't reproduce this (I tried on an amd64 mostly-sid system with
ghostscript and libgs8 8.71~dfsg2-9 and cups and libs
1.4.4-7+squeeze1). Any ideas?

If no other obvious ways to make progress come up, here are some
hints:

- Please provide a PDF file and exact command line to reproduce it on
a machine without the SLP driver installed. (The instructions
would have to include installing the SLP driver if that's the only
way to reproduce it.)

- If you look at "dmesg" output, does it say which DSO segfaulted?

- Rebuilding ghostscript with DEB_BUILD_OPTIONS='debug nostrip' and
getting a backtrace by running gs with "gdb --args" as described
at [1] would also be helpful.

- Anyone who can reproduce this can take over what I was going to
try, which is finding the patch that fixed the problem at
git://git.ghostscript.com/ghostpdl.git using "git bisect".

Hope that helps,
Jonathan

[1] http://wiki.debian.org/HowToGetABacktrace

Here is an archive with a sample input PDF, the PPD file (the license in the Seiko package
is apparently GPL2, so I think it is ok to include that), and the offending command. My syslog
shows the following:

gs[7086]: segfault at 0 ip 00007fc52aa80e80 sp 00007fff73163c60 error 6 in libgs.so.8.71[7fc52a73f000+467000]

and when run under gdb I observe this (with the regular /usr/bin/gs; I haven't had time to build in extra symbols):

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff760de80 in bits_fill_rectangle () from /usr/lib/libgs.so.8
(gdb) bt
#0 0x00007ffff760de80 in bits_fill_rectangle () from /usr/lib/libgs.so.8
#1 0x00007ffff767ef2b in ?? () from /usr/lib/libgs.so.8
#2 0x00007ffff76417f5 in ?? () from /usr/lib/libgs.so.8
#3 0x00007ffff766fc28 in gx_default_fillpage () from /usr/lib/libgs.so.8
#4 0x00007ffff7629a62 in gs_fillpage () from /usr/lib/libgs.so.8
#5 0x00007ffff740e673 in ?? () from /usr/lib/libgs.so.8
#6 0x00007ffff740f32b in gs_interpret () from /usr/lib/libgs.so.8
#7 0x00007ffff7404415 in gs_main_run_string_end () from /usr/lib/libgs.so.8
#8 0x00007ffff740555e in ?? () from /usr/lib/libgs.so.8
#9 0x00007ffff7405d4a in ?? () from /usr/lib/libgs.so.8
#10 0x00007ffff74072c0 in gs_main_init_with_args () from /usr/lib/libgs.so.8
#11 0x0000000000400aec in main ()

- regards,
Ralph