After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 482654 - PDF signature causes crash
PDF signature causes crash
Status: VERIFIED FIXED
Product: evince
Classification: Core
Component: PDF
2.20.x
Other All
: Normal critical
: ---
Assigned To: Evince Maintainers
Evince Maintainers
: 478809 481850 485062 485654 (view as bug list)
Depends on:
Blocks:
 
 
Reported: 2007-10-02 16:30 UTC by Matthias Drochner
Modified: 2007-10-11 09:27 UTC
See Also:
GNOME target: ---
GNOME version: 2.19/2.20


Attachments
possible fix (1.11 KB, patch)
2007-10-02 16:32 UTC, Matthias Drochner
committed Details | Review
signed PDF file which triggers the bug (18.56 KB, application/pdf)
2007-10-02 16:33 UTC, Matthias Drochner
  Details

Description Matthias Drochner 2007-10-02 16:30:55 UTC
Steps to reproduce:
1. view DigitalSignature.pdf (sample from xmlmill.com, I'll attach a copy)


Stack trace:
sorry, didn't get one

Other information:
unknown form fields lead to NULL dereferences in
ev_form_field_from_poppler_field() and
pdf_document_forms_get_form_fields().
The attached patch fixes this for me.
Comment 1 Matthias Drochner 2007-10-02 16:32:43 UTC
Created attachment 96525 [details] [review]
possible fix
Comment 2 Matthias Drochner 2007-10-02 16:33:46 UTC
Created attachment 96526 [details]
signed PDF file which triggers the bug
Comment 3 Carlos Garcia Campos 2007-10-04 17:16:35 UTC
It's actually a poppler bug, since it's returning unknown field type instead of signature field type. I've just fixed it in poppler (master and poppler-0.6 branches). 

Thank you very much for reporting and for the patch. 
Comment 4 Matthias Drochner 2007-10-04 18:58:28 UTC
Sorry, your poppler patch doesn't help.
I did notice the POPPLER_FORM_FIELD_SIGNATURE constant and that it
is never returned by poppler_form_field_get_field_type(), but a test
against the sample PDF file shows that even with your patch the
"UNKNOWN" field type is returned, so there must be reasons within the
guts of poppler which cause that the signature is not recognized.
Besides that: I'd still prefer to protect evince in the case of unknown
form fields -- it might always be possible to craft pdf files with form fields
which are unknown to poppler (or illegal at all). Having evince just crashing
on those is an annoyance at least.
Comment 5 Carlos Garcia Campos 2007-10-04 21:29:42 UTC
(In reply to comment #4)
> Sorry, your poppler patch doesn't help.
> I did notice the POPPLER_FORM_FIELD_SIGNATURE constant and that it
> is never returned by poppler_form_field_get_field_type(), but a test
> against the sample PDF file shows that even with your patch the
> "UNKNOWN" field type is returned, so there must be reasons within the
> guts of poppler which cause that the signature is not recognized.

Are you sure you tried with current poppler from git master? It works for me. 

> Besides that: I'd still prefer to protect evince in the case of unknown
> form fields -- it might always be possible to craft pdf files with form fields
> which are unknown to poppler (or illegal at all). Having evince just crashing
> on those is an annoyance at least.
> 

I agree. I've just applied a slightly modified version of your patch. Thanks again ;-)
Comment 6 Matthias Drochner 2007-10-04 22:10:08 UTC
> Are you sure you tried with current poppler from git master?

I did just apply your patch from the 0.6 branch -- but that was not the
problem: For the test, I did only replace libpoppler.so, not the -glib
one. Since the patch affects the glib part only, it went without effect
at first. I can confirm that the signature is reported now by poppler,
sorry about the wrong report.
And thanks for fixing this so quickly.
Comment 7 Carlos Garcia Campos 2007-10-09 14:32:12 UTC
*** Bug 485062 has been marked as a duplicate of this bug. ***
Comment 8 Carlos Garcia Campos 2007-10-11 09:25:01 UTC
*** Bug 481850 has been marked as a duplicate of this bug. ***
Comment 9 Carlos Garcia Campos 2007-10-11 09:26:35 UTC
*** Bug 478809 has been marked as a duplicate of this bug. ***
Comment 10 Carlos Garcia Campos 2007-10-11 09:27:17 UTC
*** Bug 485654 has been marked as a duplicate of this bug. ***