DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 58BAF395CC31
Subject: Re: ImageMagick maybe broken by libgs9 upgrade
To: cygwin@cygwin.com
References: <241354771.1752406.1592876221936.ref@mail.yahoo.com>
 <241354771.1752406.1592876221936@mail.yahoo.com>
 <92b51d45-55b5-33e1-c1c7-883094b6b09b@cornell.edu>
 <134f371b-8989-4ed7-2209-acc486960d65@cornell.edu>
 <0dd00cea6dd675142ca617d2caf5d818@mhoenicka.de>
 <3d65999c-c82c-0b75-925b-d799a7e8f98c@gmail.com>
 <18a9c001-03cc-1538-99aa-7ea87630abe5@cornell.edu>
 <df040576-8ce9-51ac-8c92-97e44ac9dedd@cornell.edu>
Message-ID: <6744da4c-ed95-ca9b-3e07-2adc7ea9f36f@gmail.com>
Date: Tue, 23 Jun 2020 23:02:51 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.9.0
MIME-Version: 1.0
In-Reply-To: <df040576-8ce9-51ac-8c92-97e44ac9dedd@cornell.edu>
Content-Language: it
Precedence: list
From: Marco Atzeri via Cygwin <cygwin@cygwin.com>
Reply-To: Marco Atzeri <marco.atzeri@gmail.com>
Content-Type: text/plain; charset="windows-1252"; Format="flowed"
Errors-To: cygwin-bounces@cygwin.com
Sender: "Cygwin" <cygwin-bounces@cygwin.com>
Content-Transfer-Encoding: 8bit

On 23.06.2020 22:56, Ken Brown via Cygwin wrote:
> On 6/23/2020 2:18 PM, Ken Brown via Cygwin wrote:
>> On 6/23/2020 12:56 PM, Marco Atzeri via Cygwin wrote:
>>> On 23.06.2020 15:03, Markus Hoenicka wrote:
>>>> On 2020-06-23 14:15, Ken Brown via Cygwin was heard to say:
>>>>> On 6/23/2020 7:27 AM, Ken Brown via Cygwin wrote:
>>>>>> On 6/22/2020 9:37 PM, Emily via Cygwin wrote:
>>>
>>>>>>>
>>>>>>> But in case other ImageMagick functionality is also broken, this 
>>>>>>> isn't a permanent solution.  I tried to downgrade libgs9, but 
>>>>>>> 9.27 is no longer an option in setup, even after I added another 
>>>>>>> mirror.
>>>>>>
>>>>>> Please provide a sample label.pdf for which you're seeing this 
>>>>>> behavior.
>>>>>
>>>>> You could also try adding the '-verbose' option to your command line
>>>>> to see if that gives a clue.
>>>>>
>>>>> Ken
>>>>
>>>> Hi,
>>>>
>>>> I don't know whether this helps to track down the problem, but here 
>>>> goes anyway: I see the same crash with .ps and .eps files 
>>>> (unsurprisingly, as these and .pdf are processed by libgs). The same 
>>>> conversions work with "gm convert" from the GraphicsMagick package. 
>>>> gm is not linked against libgs, but seems to invoke the gs 
>>>> executable instead. This does not crash, although it is linked 
>>>> against the very same libgs.
>>>>
>>>> regards,
>>>> Markus
>>>>
>>>
>>>
>>> without a sample case we don't know if we need to rebuild ImageMagick
>>> or GS
>>
>> I found a .eps file with which I could reproduce the crash (attached), 
>> using the OP's command line with her .pdf file replaced by the 
>> attached .eps file.  Here's the gdb backtrace after the crash:
>>
>> Thread 1 "convert" received signal SIGSEGV, Segmentation fault.
>> gs_lib_ctx_init (ctx=ctx@entry=0xfffeed30, mem=mem@entry=0x8000987b0)
>>      at /usr/src/debug/ghostscript-9.52-2/base/gslibctx.c:269
>> 269             gx_monitor_enter((gx_monitor_t *)(pio->core->monitor));
>> (gdb) bt
>> #0  gs_lib_ctx_init (ctx=ctx@entry=0xfffeed30, mem=mem@entry=0x8000987b0)
>>      at /usr/src/debug/ghostscript-9.52-2/base/gslibctx.c:269
>> #1  0x00000003ca37e0a3 in gs_malloc_init_with_context (ctx=0xfffeed30)
>>      at /usr/src/debug/ghostscript-9.52-2/base/gsmalloc.c:595
>> #2  0x00000003ca439da6 in psapi_new_instance (pinstance=0xfffee938,
>>      caller_handle=0xfffee930)
>>      at /usr/src/debug/ghostscript-9.52-2/psi/psapi.c:92
>> #3  0x00000003ca49e995 in gsapi_new_instance (pinstance=<optimized out>,
>>      caller_handle=<optimized out>)
>>      at /usr/src/debug/ghostscript-9.52-2/psi/iapi.c:64
>> #4  0x00000003fd2f53dc in InvokePostscriptDelegate (verbose=MagickFalse,
>>      command=command@entry=0xfffeed30 "'gs' -sstdout=%stderr -dQUIET 
>> -dSAFER -dBAT
>> CH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 
>> -dGridFitTT=2 '-s
>> DEVICE=pngalpha' -dTextAlphaBits=4 -dGraphicsAlphaBits=4 '-r300x300' 
>> -g196x2"...,
>>   message=message@entry=0xffff3d30 "", 
>> exception=exception@entry=0x8000664a0)
>>      at /usr/src/debug/ImageMagick-6.9.10.11-2/coders/ps.c:237
>> #5  0x00000003fd2f6234 in ReadPSImage (image_info=0x800076170,
>>      exception=0x8000664a0)
>>      at /usr/src/debug/ImageMagick-6.9.10.11-2/coders/ps.c:846
>>
>> The crash occurs because of an attempt to access ridiculously high 
>> memory:
>>
>> (gdb) p pio->core
>> $8 = (gs_lib_ctx_core_t *) 0x73253d74756f6474
>>
>> I'm looking into it.
> 
> I think I've found the problem, although it will take patching and 
> rebuilding ImageMagick (which I haven't done) to confirm that I'm right.
> 
> In the ImageMagick source file coders/ps.c:237, there's a call to 
> ghost_info->new_instance, a.k.a. gsapi_new_instance (see line 214).  The 
> documentation of the latter in the ghostscript sources (psi/iapi.c:57) 
> says that the first argument pinstance should satisfy *pinstance == NULL 
> in the first call to that function.
> 
> But *pinstance in this call is the variable 'interpreter', defined 
> without initialization in ps.c:191.  As a result, **pinstance contains 
> garbage, and the program eventually crashes when it tries to dereference 
> a garbage pointer.
> 
> The fix, if I'm right, is to initialize interpreter to NULL in ps.c:191.
> 
> Ken

Noted.

Regards
MArco

--
Problem reports:      https://cygwin.com/problems.html
FAQ:                  https://cygwin.com/faq/
Documentation:        https://cygwin.com/docs.html
Unsubscribe info:     https://cygwin.com/ml/#unsubscribe-simple