Bug 710977 – segfault when opening djvu

After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.

Bug 710977 - segfault when opening djvu


Summary:	segfault when opening djvu


Status:	RESOLVED FIXED

Product:	evince
Classification:	Core
Component:	backends
Version:	3.10.x
Hardware:	Other Linux

Importance:	Normal normal
Target Milestone:	---
Assigned To:	Evince Maintainers
QA Contact:	Evince Maintainers

URL:
Whiteboard:

Depends on:
Blocks:

Reported:	2013-10-27 21:49 UTC by Gustavo Lopes
Modified:	2013-10-29 12:05 UTC

See Also:
GNOME target:	---
GNOME version:	---

Attachments
Century Dictionary, Vol. V, Page 3960, Negligent to Negroism (DjVu) (2.85 KB, image/vnd.djvu) 2013-10-27 21:49 UTC, Gustavo Lopes		Details
[PATCH] djvu: Fix a segfault caused by a double free (844 bytes, patch) 2013-10-29 11:39 UTC, José Aliste	committed	Details \| Review

Description Gustavo Lopes 2013-10-27 21:49:10 UTC

Created attachment 258249 [details]
Century Dictionary, Vol. V, Page 3960, Negligent to Negroism (DjVu)

Evince evince-3.10.0-2 (Arch Linux)

segfault when opening the attached file:

$ gdb --args evince index05.djvu 
GNU gdb (GDB) 7.6.1
Copyright (C) 2013 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-unknown-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /usr/bin/evince...done.
(gdb) r
Starting program: /usr/bin/evince index05.djvu
warning: no loadable sections found in added symbol-file system-supplied DSO at 0x7ffff7ffa000
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffeb99a700 (LWP 11467)]
[New Thread 0x7fffeb199700 (LWP 11468)]
[New Thread 0x7fffe3fff700 (LWP 11472)]
[New Thread 0x7fffe37fe700 (LWP 11473)]
[New Thread 0x7fffe2ffd700 (LWP 11474)]
[New Thread 0x7fffe18e2700 (LWP 11475)]
*** Error in `/usr/bin/evince': double free or corruption (fasttop): 0x00007fffcc023860 ***
[Thread 0x7fffe18e2700 (LWP 11475) exited]
======= Backtrace: =========
/usr/lib/libc.so.6(+0x72ecf)[0x7ffff4e67ecf]
/usr/lib/libc.so.6(+0x7869e)[0x7ffff4e6d69e]
/usr/lib/libc.so.6(+0x79377)[0x7ffff4e6e377]
/usr/lib/evince/4/backends/libdjvudocument.so(+0x4a0d)[0x7fffe802fa0d]
/usr/lib/libevdocument3.so.4(ev_document_load+0x2a)[0x7ffff7796cce]
/usr/lib/libevdocument3.so.4(ev_document_factory_get_document+0x121)[0x7ffff7798959]
/usr/lib/libevview3.so.3(+0x1bda8)[0x7ffff7551da8]
/usr/lib/libevview3.so.3(ev_job_run+0xd)[0x7ffff75513de]
/usr/lib/libevview3.so.3(+0x1d168)[0x7ffff7553168]
/usr/lib/libevview3.so.3(+0x1d1ce)[0x7ffff75531ce]
/usr/lib/libglib-2.0.so.0(+0x6cf75)[0x7ffff572df75]
/usr/lib/libpthread.so.0(+0x80a2)[0x7ffff51a80a2]
/usr/lib/libc.so.6(clone+0x6d)[0x7ffff4eda42d]
======= Memory map: ========
00400000-00464000 r-xp 00000000 08:02 2918275                            /usr/bin/evince
00663000-00664000 r--p 00063000 08:02 2918275                            /usr/bin/evince
00664000-00667000 rw-p 00064000 08:02 2918275                            /usr/bin/evince
00667000-00a57000 rw-p 00000000 00:00 0                                  [heap]
7fffc0000000-7fffc006e000 rw-p 00000000 00:00 0 
7fffc006e000-7fffc4000000 ---p 00000000 00:00 0 
7fffc8000000-7fffc8022000 rw-p 00000000 00:00 0 
7fffc8022000-7fffcc000000 ---p 00000000 00:00 0 
7fffcc000000-7fffcc109000 rw-p 00000000 00:00 0 
7fffcc109000-7fffd0000000 ---p 00000000 00:00 0 
7fffd0000000-7fffd0021000 rw-p 00000000 00:00 0 
7fffd0021000-7fffd4000000 ---p 00000000 00:00 0 
7fffd6ee4000-7fffdc000000 r--p 00000000 08:02 3671478                    /usr/share/icons/gnome/icon-theme.cache
7fffdc000000-7fffdc022000 rw-p 00000000 00:00 0 
7fffdc022000-7fffe0000000 ---p 00000000 00:00 0 
7fffe10e2000-7fffe10e3000 ---p 00000000 00:00 0 
7fffe10e3000-7fffe18e3000 rw-p 00000000 00:00 0 
7fffe1ce3000-7fffe1cf8000 r-xp 00000000 08:02 2889940                    /usr/lib/libgcc_s.so.1
7fffe1cf8000-7fffe1ef8000 ---p 00015000 08:02 2889940                    /usr/lib/libgcc_s.so.1
7fffe1ef8000-7fffe1ef9000 rw-p 00015000 08:02 2889940                    /usr/lib/libgcc_s.so.1
7fffe1ef9000-7fffe1fdf000 r-xp 00000000 08:02 2889933                    /usr/lib/libstdc++.so.6.0.18
7fffe1fdf000-7fffe21de000 ---p 000e6000 08:02 2889933                    /usr/lib/libstdc++.so.6.0.18
7fffe21de000-7fffe21e6000 r--p 000e5000 08:02 2889933                    /usr/lib/libstdc++.so.6.0.18
7fffe21e6000-7fffe21e8000 rw-p 000ed000 08:02 2889933                    /usr/lib/libstdc++.so.6.0.18
7fffe21e8000-7fffe21fd000 rw-p 00000000 00:00 0 
7fffe21fd000-7fffe2241000 r-xp 00000000 08:02 2907154                    /usr/lib/libjpeg.so.8.0.2
7fffe2241000-7fffe2440000 ---p 00044000 08:02 2907154                    /usr/lib/libjpeg.so.8.0.2
7fffe2440000-7fffe2441000 r--p 00043000 08:02 2907154                    /usr/lib/libjpeg.so.8.0.2
7fffe2441000-7fffe2442000 rw-p 00044000 08:02 2907154                    /usr/lib/libjpeg.so.8.0.2
7fffe2442000-7fffe2452000 rw-p 00000000 00:00 0 
7fffe2452000-7fffe25ed000 r-xp 00000000 08:02 2918155                    /usr/lib/libdjvulibre.so.21.4.0
7fffe25ed000-7fffe27ed000 ---p 0019b000 08:02 2918155                    /usr/lib/libdjvulibre.so.21.4.0
7fffe27ed000-7fffe27f2000 r--p 0019b000 08:02 2918155                    /usr/lib/libdjvulibre.so.21.4.0
7fffe27f2000-7fffe27f6000 rw-p 001a0000 08:02 2918155                    /usr/lib/libdjvulibre.so.21.4.0
7fffe27f6000-7fffe27fd000 rw-p 00000000 00:00 0 
7fffe27fd000-7fffe27fe000 ---p 00000000 00:00 0 
7fffe27fe000-7fffe2ffe000 rw-p 00000000 00:00 0                          [stack:11474]
7fffe2ffe000-7fffe2fff000 ---p 00000000 00:00 0 
7fffe2fff000-7fffe37ff000 rw-p 00000000 00:00 0                          [stack:11473]
7fffe37ff000-7fffe3800000 ---p 00000000 00:00 0 
7fffe3800000-7fffe4000000 rw-p 00000000 00:00 0                          [stack:11472]
7fffe4000000-7fffe4021000 rw-p 00000000 00:00 0 
7fffe4021000-7fffe8000000 ---p 00000000 00:00 0 
7fffe802b000-7fffe8033000 r-xp 00000000 08:02 3939769                    /usr/lib/evince/4/backends/libdjvudocument.so
7fffe8033000-7fffe8232000 ---p 00008000 08:02 3939769                    /usr/lib/evince/4/backends/libdjvudocument.so
7fffe8232000-7fffe8233000 r--p 00007000 08:02 3939769                    /usr/lib/evince/4/backends/libdjvudocument.so
7fffe8233000-7fffe8234000 rw-p 00008000 08:02 3939769                    /usr/lib/evince/4/backends/libdjvudocument.so
7fffe8234000-7fffe823c000 r--s 00000000 08:02 5242907                    /home/glopes/.local/share/gvfs-metadata/home-7fa5d69f.log
7fffe823c000-7fffe825a000 r--s 00000000 08:02 3412378                    /usr/share/mime/mime.cache
7fffe825a000-7fffe8265000 r-xp 00000000 08:02 3018799                    /usr/lib/gio/modules/libdconfsettings.so
7fffe8265000-7fffe8464000 ---p 0000b000 08:02 3018799                    /usr/lib/gio/modules/libdconfsettings.so
7fffe8464000-7fffe8465000 r--p 0000a000 08:02 3018799                    /usr/lib/gio/modules/libdconfsettings.so
7fffe8465000-7fffe8466000 rw-p 0000b000 08:02 3018799                    /usr/lib/gio/modules/libdconfsettings.so
7fffe8466000-7fffe851c000 r--p 00000000 08:02 3411003                    /usr/share/fonts/TTF/DejaVuSans.ttf
7fffe851c000-7fffea2a6000 r--p 00000000 08:02 3417190                    /usr/share/icons/hicolor/icon-theme.cache
7fffea2a6000-7fffea326000 rw-s 00000000 00:04 47022114                   /SYSV00000000 (deleted)
7fffea326000-7fffea35d000 r-xp 00000000 08:02 2909970                    /usr/lib/libcroco-0.6.so.3.0.1
7fffea35d000-7fffea55d000 ---p 00037000 08:02 2909970                    /usr/lib/libcroco-0.6.so.3.0.1
7fffea55d000-7fffea560000 r--p 00037000 08:02 2909970                    /usr/lib/libcroco-0.6.so.3.0.1
7fffea560000-7fffea561000 rw-p 0003a000 08:02 2909970                    /usr/lib/libcroco-0.6.so.3.0.1
7fffea561000-7fffea595000 r-xp 00000000 08:02 2909976                    /usr/lib/librsvg-2.so.2.40.0
7fffea595000-7fffea794000 ---p 00034000 08:02 2909976                    /usr/lib/librsvg-2.so.2.40.0
7fffea794000-7fffea795000 r--p 00033000 08:02 2909976                    /usr/lib/librsvg-2.so.2.40.0
7fffea795000-7fffea796000 rw-p 00034000 08:02 2909976                    /usr/lib/librsvg-2.so.2.40.0
7fffea796000-7fffea798000 r-xp 00000000 08:02 3414342                    /usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
7fffea798000-7fffea997000 ---p 00002000 08:02 3414342                    /usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
7fffea997000-7fffea998000 r--p 00001000 08:02 3414342                    /usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
7fffea998000-7fffea999000 rw-p 00002000 08:02 3414342                    /usr/lib/gdk-pixbuf-2.0/2.10.0/loaders/libpixbufloader-svg.so
7fffea999000-7fffea99a000 ---p 00000000 00:00 0 
7fffea99a000-7fffeb19a000 rw-p 00000000 00:00 0                          [stack:11468]
7fffeb19a000-7fffeb19b000 ---p 00000000 00:00 0 
7fffeb19b000-7fffeb99b000 rw-p 00000000 00:00 0                          [stack:11467]
7fffeb99b000-7fffeb9bc000 r-xp 00000000 08:02 2892339                    /usr/lib/liblzma.so.5.0.5
7fffeb9bc000-7fffebbbc000 ---p 00021000 08:02 2892339                    /usr/lib/liblzma.so.5.0.5
7fffebbbc000-7fffebbbd000 r--p 00021000 08:02 2892339                    /usr/lib/liblzma.so.5.0.5
7fffebbbd000-7fffebbbe000 rw-p 00022000 08:02 2892339                    /usr/lib/liblzma.so.5.0.5
7fffebbbe000-7fffebd1b000 r-xp 00000000 08:02 2906106                    /usr/lib/libxml2.so.2.9.1
7fffebd1b000-7fffebf1a000 ---p 0015d000 08:02 2906106                    /usr/lib/libxml2.so.2.9.1
7fffebf1a000-7fffebf22000 r--p 0015c000 08:02 2906106                    /usr/lib/libxml2.so.2.9.1
7fffebf22000-7fffebf24000 rw-p 00164000 08:02 2906106                    /usr/lib/libxml2.so.2.9.1
7fffebf24000-7fffebf26000 rw-p 00000000 00:00 0 
7fffebf26000-7fffebf28000 r-xp 00000000 08:02 2886979                    /usr/lib/libutil-2.18.so
7fffebf28000-7fffec127000 ---p 00002000 08:02 2886979                    /usr/lib/libutil-2.18.so
7fffec127000-7fffec128000 r--p 00001000 08:02 2886979                    /usr/lib/libutil-2.18.so
7fffec128000-7fffec129000 rw-p 00002000 08:02 2886979                    /usr/lib/libutil-2.18.so
7fffec129000-7fffec150000 r-xp 00000000 08:02 2912914                    /usr/lib/libbluray.so.1.3.0
7fffec150000-7fffec350000 ---p 00027000 08:02 2912914                    /usr/lib/libbluray.so.1.3.0
7fffec350000-7fffec351000 r--p 00027000 08:02 2912914                    /usr/lib/libbluray.so.1.3.0
7fffec351000-7fffec352000 rw-p 00028000 08:02 2912914                    /usr/lib/libbluray.so.1.3.0
7fffec352000-7fffec387000 r-xp 00000000 08:02 2914270                    /usr/lib/libgvfscommon.so.0.0.0
7fffec387000-7fffec587000 ---p 00035000 08:02 2914270                    /usr/lib/libgvfscommon.so.0.0.0
7fffec587000-7fffec58c000 r--p 00035000 08:02 2914270                    /usr/lib/libgvfscommon.so.0.0.0
7fffec58c000-7fffec58d000 rw-p 0003a000 08:02 2914270                    /usr/lib/libgvfscommon.so.0.0.0
7fffec58d000-7fffec5bc000 r-xp 00000000 08:02 3025223                    /usr/lib/gio/modules/libgvfsdbus.so
7fffec5bc000-7fffec7bc000 ---p 0002f000 08:02 3025223                    /usr/lib/gio/modules/libgvfsdbus.so
7fffec7bc000-7fffec7bd000 r--p 0002f000 08:02 3025223                    /usr/lib/gio/modules/libgvfsdbus.so
7fffec7bd000-7fffec7bf000 rw-p 00030000 08:02 3025223                    /usr/lib/gio/modules/libgvfsdbus.so
7fffec7bf000-7fffec7c5000 r-xp 00000000 08:02 2901597                    /usr/lib/libogg.so.0.8.1
7fffec7c5000-7fffec9c4000 ---p 00006000 08:02 2901597                    /usr/lib/libogg.so.0.8.1
7fffec9c4000-7fffec9c5000 r--p 00005000 08:02 2901597                    /usr/lib/libogg.so.0.8.1
7fffec9c5000-7fffec9c6000 rw-p 00006000 08:02 2901597                    /usr/lib/libogg.so.0.8.1
7fffec9c6000-7fffec9f2000 r-xp 00000000 08:02 2901618                    /usr/lib/libvorbis.so.0.4.6
7fffec9f2000-7fffecbf1000 ---p 0002c000 08:02 2901618                    /usr/lib/libvorbis.so.0.4.6
7fffecbf1000-7fffecbf2000 r--p 0002b000 08:02 2901618                    /usr/lib/libvorbis.so.0.4.6
7fffecbf2000-7fffecbf3000 rw-p 0002c000 08:02 2901618                    /usr/lib/libvorbis.so.0.4.6
7fffecbf3000-7fffecbfc000 r-xp 00000000 08:02 2910915                    /usr/lib/libltdl.so.7.3.0
7fffecbfc000-7fffecdfb000 ---p 00009000 08:02 2910915                    /usr/lib/libltdl.so.7.3.0
7fffecdfb000-7fffecdfc000 r--p 00008000 08:02 2910915                    /usr/lib/libltdl.so.7.3.0
7fffecdfc000-7fffecdfd000 rw-p 00009000 08:02 2910915                    /usr/lib/libltdl.so.7.3.0
7fffecdfd000-7fffece0e000 r-xp 00000000 08:02 2912403                    /usr/lib/libtdb.so.1.2.12
7fffece0e000-7fffed00d000 ---p 00011000 08:02 2912403                    /usr/lib/libtdb.so.1.2.12
7fffed00d000-7fffed00e000 r--p 00010000 08:02 2912403                    /usr/lib/libtdb.so.1.2.12
7fffed00e000-7fffed00f000 rw-p 00011000 08:02 2912403                    /usr/lib/libtdb.so.1.2.12
7fffed00f000-7fffed016000 r-xp 00000000 08:02 2901620                    /usr/lib/libvorbisfile.so.3.3.5
7fffed016000-7fffed216000 ---p 00007000 08:02 2901620                    /usr/lib/libvorbisfile.so.3.3.5
7fffed216000-7fffed217000 r--p 00007000 08:02 2901620                    /usr/lib/libvorbisfile.so.3.3.5
7fffed217000-7fffed218000 rw-p 00008000 08:02 2901620                    /usr/lib/libvorbisfile.so.3.3.5
7fffed218000-7fffed228000 r-xp 00000000 08:02 2912419                    /usr/lib/libcanberra.so.0.2.5
7fffed228000-7fffed427000 ---p 00010000 08:02 2912419                    /usr/lib/libcanberra.so.0.2.5
7fffed427000-7fffed428000 r--p 0000f000 08:02 2912419                    /usr/lib/libcanberra.so.0.2.5
7fffed428000-7fffed429000 rw-p 00010000 08:02 2912419                    /usr/lib/libcanberra.so.0.2.5
7fffed429000-7fffed42d000 r-xp 00000000 08:02 2912420                    /usr/lib/libcanberra-gtk3.so.0.1.9
7fffed42d000-7fffed62c000 ---p 00004000 08:02 2912420                    /usr/lib/libcanberra-gtk3.so.0.1.9
7fffed62c000-7fffed62d000 r--p 00003000 08:02 2912420                    /usr/lib/libcanberra-gtk3.so.0.1.9
7fffed62d000-7fffed62e000 rw-p 00004000 08:02 2912420                    /usr/lib/libcanberra-gtk3.so.0.1.9
7fffed632000-7fffed63c000 r--p 00000000 08:02 3026929                    /usr/share/glib-2.0/schemas/gschemas.compiled
7fffed63c000-7fffed655000 r--s 00000000 08:02 14418969                   /var/cache/fontconfig/8d4af663993b81a124ee82e610bb31f9-le64.cache-4
7fffed655000-7fffed65a000 r-xp 00000000 08:02 3803043                    /usr/lib/gtk-3.0/modules/libcanberra-gtk3-module.so
7fffed65a000-7fffed859000 ---p 00005000 08:02 3803043                    /usr/lib/gtk-3.0/modules/libcanberra-gtk3-module.so
7fffed859000-7fffed85a000 r--p 00004000 08:02 3803043                    /usr/lib/gtk-3.0/modules/libcanberra-gtk3-module.so
7fffed85a000-7fffed85b000 rw-p 00005000 08:02 3803043                    /usr/lib/gtk-3.0/modules/libcanberra-gtk3-module.so
7fffed85b000-7fffed875000 r-xp 00000000 08:02 2905927                    /usr/lib/libgraphite2.so.3.0.1
7fffed875000-7fffeda74000 ---p 0001a000 08:02 2905927                    /usr/lib/libgraphite2.so.3.0.1
7fffeda74000-7fffeda76000 r--p 00019000 08:02 2905927                    /usr/lib/libgraphite2.so.3.0.1
7fffeda76000-7fffeda77000 rw-p 0001b000 08:02 2905927                    /usr/lib/libgraphite2.so.3.0.1
7fffeda77000-7fffeda7c000 r-xp 00000000 08:02 2904902                    /usr/lib/libXxf86vm.so.1.0.0
7fffeda7c000-7fffedc7b000 ---p 00005000 08:02 2904902                    /usr/lib/libXxf86vm.so.1.0.0
7fffedc7b000-7fffedc7c000 r--p 00004000 08:02 2904902                    /usr/lib/libXxf86vm.so.1.0.0
7fffedc7c000-7fffedc7d000 rw-p 00005000 08:02 2904902                    /usr/lib/libXxf86vm.so.1.0.0
7fffedc7d000-7fffedc92000 r-xp 00000000 08:02 2903947                    /usr/lib/libxcb-glx.so.0.0.0
7fffedc92000-7fffede92000 ---p 00015000 08:02 2903947                    /usr/lib/libxcb-glx.so.0.0.0
7fffede92000-7fffede94000 r--p 00015000 08:02 2903947                    /usr/lib/libxcb-glx.so.0.0.0
Program received signal SIGABRT, Aborted.

+ Trace 232672

Thread 140737001805568 (LWP 11474)

#0 raise
from /usr/lib/libc.so.6
#1 abort
from /usr/lib/libc.so.6
#2 __libc_message
from /usr/lib/libc.so.6
#3 malloc_printerr
from /usr/lib/libc.so.6
#4 _int_free
from /usr/lib/libc.so.6
#5 djvu_document_load
at djvu-document.c line 253
#6 ev_document_load
at ev-document.c line 315
#7 ev_document_factory_get_document
at ev-document-factory.c line 313
#8 ev_job_load_run
at ev-jobs.c line 1045
#9 ev_job_run
at ev-jobs.c line 215
#10 ev_job_thread
at ev-job-scheduler.c line 184
#11 ev_job_thread_proxy
at ev-job-scheduler.c line 217
#12 ??
from /usr/lib/libglib-2.0.so.0
#13 start_thread
from /usr/lib/libpthread.so.0
#14 clone
from /usr/lib/libc.so.6

Comment 1 Christian Persch 2013-10-27 22:23:45 UTC

Memory corruption that's happened earlier. Please run evince under valgrind's memcheck; see https://wiki.gnome.org/Valgrind for which options to use.

Comment 2 Gustavo Lopes 2013-10-28 22:20:01 UTC

Here it goes:


==31551== Memcheck, a memory error detector
==31551== Copyright (C) 2002-2012, and GNU GPL'd, by Julian Seward et al.
==31551== Using Valgrind-3.8.1 and LibVEX; rerun with -h for copyright info
==31551== Command: evince index05.djvu
==31551== Parent PID: 1012
==31551== 
==31551== Thread 6:
==31551== Invalid free() / delete / delete[] / realloc()
==31551==    at 0x4C288AC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31551==    by 0x1D577C10: djvu_document_load (djvu-document.c:253)
==31551==    by 0x526E7E6: ev_document_load (ev-document.c:315)
==31551==    by 0x52716EE: ev_document_factory_get_document (ev-document-factory.c:313)
==31551==    by 0x54B5DE7: ev_job_load_run (ev-jobs.c:1045)
==31551==    by 0x54B3FFB: ev_job_run (ev-jobs.c:215)
==31551==    by 0x54B7FF6: ev_job_thread (ev-job-scheduler.c:184)
==31551==    by 0x54B80A9: ev_job_thread_proxy (ev-job-scheduler.c:217)
==31551==    by 0x72D4F74: ??? (in /usr/lib/libglib-2.0.so.0.3800.1)
==31551==    by 0x78730A1: start_thread (in /usr/lib/libpthread-2.18.so)
==31551==    by 0x7B6E42C: clone (in /usr/lib/libc-2.18.so)
==31551==  Address 0x1e91faa0 is 0 bytes inside a block of size 64 free'd
==31551==    at 0x4C288AC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31551==    by 0x1D577C04: djvu_document_load (djvu-document.c:251)
==31551==    by 0x526E7E6: ev_document_load (ev-document.c:315)
==31551==    by 0x52716EE: ev_document_factory_get_document (ev-document-factory.c:313)
==31551==    by 0x54B5DE7: ev_job_load_run (ev-jobs.c:1045)
==31551==    by 0x54B3FFB: ev_job_run (ev-jobs.c:215)
==31551==    by 0x54B7FF6: ev_job_thread (ev-job-scheduler.c:184)
==31551==    by 0x54B80A9: ev_job_thread_proxy (ev-job-scheduler.c:217)
==31551==    by 0x72D4F74: ??? (in /usr/lib/libglib-2.0.so.0.3800.1)
==31551==    by 0x78730A1: start_thread (in /usr/lib/libpthread-2.18.so)
==31551==    by 0x7B6E42C: clone (in /usr/lib/libc-2.18.so)
==31551== 
==31551== Invalid free() / delete / delete[] / realloc()
==31551==    at 0x4C288AC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31551==    by 0x1D577C10: djvu_document_load (djvu-document.c:253)
==31551==    by 0x526E7E6: ev_document_load (ev-document.c:315)
==31551==    by 0x527188A: ev_document_factory_get_document (ev-document-factory.c:355)
==31551==    by 0x54B5DE7: ev_job_load_run (ev-jobs.c:1045)
==31551==    by 0x54B3FFB: ev_job_run (ev-jobs.c:215)
==31551==    by 0x54B7FF6: ev_job_thread (ev-job-scheduler.c:184)
==31551==    by 0x54B80A9: ev_job_thread_proxy (ev-job-scheduler.c:217)
==31551==    by 0x72D4F74: ??? (in /usr/lib/libglib-2.0.so.0.3800.1)
==31551==    by 0x78730A1: start_thread (in /usr/lib/libpthread-2.18.so)
==31551==    by 0x7B6E42C: clone (in /usr/lib/libc-2.18.so)
==31551==  Address 0x1ea25a30 is 0 bytes inside a block of size 64 free'd
==31551==    at 0x4C288AC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==31551==    by 0x1D577C04: djvu_document_load (djvu-document.c:251)
==31551==    by 0x526E7E6: ev_document_load (ev-document.c:315)
==31551==    by 0x527188A: ev_document_factory_get_document (ev-document-factory.c:355)
==31551==    by 0x54B5DE7: ev_job_load_run (ev-jobs.c:1045)
==31551==    by 0x54B3FFB: ev_job_run (ev-jobs.c:215)
==31551==    by 0x54B7FF6: ev_job_thread (ev-job-scheduler.c:184)
==31551==    by 0x54B80A9: ev_job_thread_proxy (ev-job-scheduler.c:217)
==31551==    by 0x72D4F74: ??? (in /usr/lib/libglib-2.0.so.0.3800.1)
==31551==    by 0x78730A1: start_thread (in /usr/lib/libpthread-2.18.so)
==31551==    by 0x7B6E42C: clone (in /usr/lib/libc-2.18.so)
==31551==

Comment 3 José Aliste 2013-10-28 23:20:44 UTC

Thanks! Indeed there is a double free that is triggered on djvu files that reference other files that are missing. Deleting the g_free inside the test should fix it, will test asap and post the patch.

Comment 4 José Aliste 2013-10-29 11:39:49 UTC

Created attachment 258435 [details] [review]
[PATCH] djvu: Fix a segfault caused by a double free


In the case there were missing files in the djvu,
there was a double free of the GFile.

Fixes bug #710977
---
 backend/djvu/djvu-document.c | 1 -
 1 file changed, 1 deletion(-)

Comment 5 Carlos Garcia Campos 2013-10-29 11:44:21 UTC

Review of attachment 258435 [details] [review]:

Thanks! Please push it to both branches, but use the full bug url in the commit message like in other commits.

Comment 6 José Aliste 2013-10-29 12:04:17 UTC

Review of attachment 258435 [details] [review]:

great

Comment 7 José Aliste 2013-10-29 12:05:24 UTC

This problem has been fixed in our software repository. The fix will go into the next software release. Thank you for your bug report.