#1025691 atril: Segfault when opening a copy of a PDF document with annotations

Package:
atril
Source:
atril
Description:
MATE document viewer
Submitter:
Andreas Schmidt
Date:
2022-12-26 15:33:07 UTC
Severity:
normal
#1025691#5
Date:
2022-12-07 13:04:07 UTC
From:
To:
Dear Maintainer,

I used "latexmk -pdf" to create a simple PDF file from the following code:

*****
\documentclass{article}
\usepackage{lipsum}

\begin{document}
\lipsum[1]
\end{document}
*****

Then I used atril to add an annotation, saved the file and quit atril. Opening
the file again and selecting "File --> Open a Copy" from the menu caused a
segfault. Here's the output from running this in gdb:

*****
$ gdb atril
GNU gdb (Debian 12.1-4) 12.1
Copyright (C) 2022 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from atril...
Reading symbols from /usr/lib/debug/.build-
id/fc/383bf206707989cc0e0bc3eaceca8c55668ba5.debug...
(gdb) run
Starting program: /usr/bin/atril
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7fffecdff6c0 (LWP 309723)]
[New Thread 0x7fffe7fff6c0 (LWP 309724)]
[New Thread 0x7fffe77fe6c0 (LWP 309725)]
[New Thread 0x7fffe6ffd6c0 (LWP 309726)]
[Thread 0x7fffe6ffd6c0 (LWP 309726) exited]
[New Thread 0x7fffe6ffd6c0 (LWP 309727)]
[New Thread 0x7fffe67fc6c0 (LWP 309728)]
[Thread 0x7fffe6ffd6c0 (LWP 309727) exited]
[New Thread 0x7fffe6ffd6c0 (LWP 309729)]
[New Thread 0x7fffe5ffb6c0 (LWP 309730)]
[Thread 0x7fffe67fc6c0 (LWP 309728) exited]
[Thread 0x7fffe6ffd6c0 (LWP 309729) exited]
[New Thread 0x7fffe6ffd6c0 (LWP 309731)]
[New Thread 0x7fffe67fc6c0 (LWP 309732)]
[Thread 0x7fffe5ffb6c0 (LWP 309730) exited]
[Thread 0x7fffe6ffd6c0 (LWP 309731) exited]
[Thread 0x7fffe67fc6c0 (LWP 309732) exited]
[New Thread 0x7fffe67fc6c0 (LWP 309733)]
[New Thread 0x7fffe6ffd6c0 (LWP 309734)]
[New Thread 0x7fffe5ffb6c0 (LWP 309735)]
[Thread 0x7fffe6ffd6c0 (LWP 309734) exited]
[New Thread 0x7fffe6ffd6c0 (LWP 309736)]
[New Thread 0x7fffe57fa6c0 (LWP 309737)]
[Thread 0x7fffe5ffb6c0 (LWP 309735) exited]
[Thread 0x7fffe6ffd6c0 (LWP 309736) exited]
[Thread 0x7fffe57fa6c0 (LWP 309737) exited]
[New Thread 0x7fffe57fa6c0 (LWP 309739)]
[New Thread 0x7fffe6ffd6c0 (LWP 309740)]
[Thread 0x7fffe57fa6c0 (LWP 309739) exited]
[Thread 0x7fffe6ffd6c0 (LWP 309740) exited]
[New Thread 0x7fffe6ffd6c0 (LWP 309742)]
[New Thread 0x7fffe57fa6c0 (LWP 309743)]
[New Thread 0x7fffe5ffb6c0 (LWP 309744)]
[New Thread 0x7fffcffff6c0 (LWP 309745)]
[New Thread 0x7fffcf7fe6c0 (LWP 309746)]
[New Thread 0x7fffceffd6c0 (LWP 309747)]
[New Thread 0x7fffce7fc6c0 (LWP 309748)]
[New Thread 0x7fffcdffb6c0 (LWP 309749)]
[New Thread 0x7fffcd7fa6c0 (LWP 309750)]
[Thread 0x7fffcdffb6c0 (LWP 309749) exited]
[New Thread 0x7fffcdffb6c0 (LWP 309751)]
[New Thread 0x7fffccff96c0 (LWP 309752)]
[Thread 0x7fffcd7fa6c0 (LWP 309750) exited]
[Thread 0x7fffcdffb6c0 (LWP 309751) exited]
[New Thread 0x7fffcdffb6c0 (LWP 309753)]
[New Thread 0x7fffcd7fa6c0 (LWP 309754)]
[Thread 0x7fffccff96c0 (LWP 309752) exited]
[Thread 0x7fffcdffb6c0 (LWP 309753) exited]
[New Thread 0x7fffcdffb6c0 (LWP 309755)]
[New Thread 0x7fffccff96c0 (LWP 309756)]
[Thread 0x7fffcd7fa6c0 (LWP 309754) exited]
[Thread 0x7fffcdffb6c0 (LWP 309755) exited]
[Thread 0x7fffccff96c0 (LWP 309756) exited]
[Thread 0x7fffe77fe6c0 (LWP 309725) exited]
[Thread 0x7fffe57fa6c0 (LWP 309743) exited]
[Thread 0x7fffe5ffb6c0 (LWP 309744) exited]
[Thread 0x7fffceffd6c0 (LWP 309747) exited]
[Thread 0x7fffce7fc6c0 (LWP 309748) exited]
[Thread 0x7fffcffff6c0 (LWP 309745) exited]
[Thread 0x7fffcf7fe6c0 (LWP 309746) exited]
[New Thread 0x7fffcf7fe6c0 (LWP 309760)]
[New Thread 0x7fffcffff6c0 (LWP 309761)]
[New Thread 0x7fffce7fc6c0 (LWP 309762)]
[New Thread 0x7fffceffd6c0 (LWP 309763)]
[New Thread 0x7fffe5ec96c0 (LWP 309764)]
[Thread 0x7fffceffd6c0 (LWP 309763) exited]
[New Thread 0x7fffceffd6c0 (LWP 309765)]
[New Thread 0x7fffcdffb6c0 (LWP 309766)]
[Thread 0x7fffe5ec96c0 (LWP 309764) exited]
[Thread 0x7fffceffd6c0 (LWP 309765) exited]
[New Thread 0x7fffceffd6c0 (LWP 309767)]
[New Thread 0x7fffe5ec96c0 (LWP 309768)]
[Thread 0x7fffcdffb6c0 (LWP 309766) exited]
[New Thread 0x7fffceffd6c0 (LWP 309769)]
[Thread 0x7fffceffd6c0 (LWP 309767) exited]
[New Thread 0x7fffcdffb6c0 (LWP 309770)]
[Thread 0x7fffe5ec96c0 (LWP 309768) exited]
[Thread 0x7fffceffd6c0 (LWP 309769) exited]
[Thread 0x7fffcdffb6c0 (LWP 309770) exited]

(atril:309720): Gdk-CRITICAL **: 13:57:19.180: gdk_window_get_display:
assertion 'GDK_IS_WINDOW (window)' failed

(atril:309720): Gdk-CRITICAL **: 13:57:19.180:
gdk_display_get_monitor_at_window: assertion 'GDK_IS_DISPLAY (display)' failed

(atril:309720): Gdk-CRITICAL **: 13:57:19.180: gdk_monitor_get_geometry:
assertion 'GDK_IS_MONITOR (monitor)' failed

(atril:309720): Gdk-CRITICAL **: 13:57:19.180: gdk_monitor_get_scale_factor:
assertion 'GDK_IS_MONITOR (monitor)' failed

(atril:309720): Gdk-CRITICAL **: 13:57:19.180: gdk_monitor_get_height_mm:
assertion 'GDK_IS_MONITOR (monitor)' failed

(atril:309720): Gdk-CRITICAL **: 13:57:19.180: gdk_monitor_get_width_mm:
assertion 'GDK_IS_MONITOR (monitor)' failed

(atril:309720): Gtk-CRITICAL **: 13:57:19.180: gtk_window_resize: assertion
'width > 0' failed
[Thread 0x7fffce7fc6c0 (LWP 309762) exited]
[Thread 0x7fffe6ffd6c0 (LWP 309742) exited]
[New Thread 0x7fffce7fc6c0 (LWP 309771)]

Thread 1 "atril" received signal SIGSEGV, Segmentation fault.
ev_view_window_child_move_with_parent (view=0x555555b3e520,
window=0x555555f8c330) at ./libview/ev-view.c:2694
2694    ./libview/ev-view.c: No such file or directory.
(gdb)

*****

It would be nice if you could fix this! If you require any further information,
just say so.

With best regards

Andreas

#1025691#10
Date:
2022-12-26 15:31:10 UTC
From:
To:
Dear Maintainer,
I could reproduce this issue by these steps:


- installed a minimal test VM with `apt install systemd-coredump mc xdm xserver-xorg jwm xterm atril latexmk texlive-latex-extra gdb libatrilview3-dbgsym libgtk-3-0-dbgsym libglib2.0-0-dbgsym atril-dbgsym`
- created the PDF by `latexmk -pdf test.latex`
- open atril
- open PDF
- switch the sidebar from "Thumbnail" to "Annotations"
- create a annotation
- save the PDF
- closed atril
- opened atril
- opened the saved PDF
- then "Open a Copy" crashed it


This crashed here:

https://sources.debian.org/src/atril/1.26.0-2/libview/ev-view.c/#L2694

2691 	child = ev_view_get_window_child (view, window);
2692 	gdk_window_get_origin (gtk_widget_get_window (GTK_WIDGET (view)),
2693 			       &root_x, &root_y);
2694 	if (root_x != child->parent_x || root_y != child->parent_y) {
2695 		gint dest_x, dest_y;

(gdb) bt full 4
#0  ev_view_window_child_move_with_parent (view=0x5637f6058560, window=0x5637f61ac330) at ./libview/ev-view.c:2694
         child = 0x0
         root_x = 613
         root_y = 107
#1  0x00007f5e6bdfbd9b in show_annotation_windows (page=0, view=0x5637f6058560) at ./libview/ev-view.c:2920
...
(rr) print view->window_children
$2 = 0x0


The variable child still contains a null here, looks like because
view->window_children is also a null.

Unfortunately found no matching upstream entry in [1].

Kind regards,
Bernhard



[1] https://github.com/mate-desktop/atril/issues

(gdb) bt
#0  ev_view_window_child_move_with_parent (view=0x5637f6058560, window=0x5637f61ac330) at ./libview/ev-view.c:2694
#1  0x00007f5e6bdfbd9b in show_annotation_windows (page=0, view=0x5637f6058560) at ./libview/ev-view.c:2920
#2  ev_view_draw (widget=0x5637f6058560, cr=0x5637f6066c00) at ./libview/ev-view.c:4078
#3  0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x5637f6058560, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#4  0x00007f5e6b32119a in gtk_container_propagate_draw (container=<optimized out>, child=0x5637f6058560, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3854
#5  0x00007f5e6b3212fd in gtk_container_draw (widget=<optimized out>, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3674
#6  0x00007f5e6b497c5a in gtk_scrolled_window_render (gadget=<optimized out>, cr=0x5637f6066c00, x=<optimized out>, y=<optimized out>, width=<optimized out>, height=<optimized out>, data=0x0) at ../../../gtk/gtkscrolledwindow.c:2119
#7  0x00007f5e6b326c8f in gtk_css_custom_gadget_draw (gadget=0x5637f6309600, cr=0x5637f6066c00, x=1, y=1, width=598, height=519) at ../../../gtk/gtkcsscustomgadget.c:159
#8  0x00007f5e6b32c627 in gtk_css_gadget_draw (gadget=0x5637f6309600, cr=cr@entry=0x5637f6066c00) at ../../../gtk/gtkcssgadget.c:885
#9  0x00007f5e6b49a60c in gtk_scrolled_window_draw (widget=0x5637f62bb460, cr=0x5637f6066c00) at ../../../gtk/gtkscrolledwindow.c:3050
#10 0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x5637f62bb460, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#11 0x00007f5e6b32119a in gtk_container_propagate_draw (container=<optimized out>, child=0x5637f62bb460, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3854
#12 0x00007f5e6b3212fd in gtk_container_draw (widget=<optimized out>, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3674
#13 0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x5637f63072a0, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#14 0x00007f5e6b32119a in gtk_container_propagate_draw (container=<optimized out>, child=0x5637f63072a0, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3854
#15 0x00007f5e6b3212fd in gtk_container_draw (widget=<optimized out>, cr=cr@entry=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3674
#16 0x00007f5e6b2cae96 in gtk_box_draw_contents (gadget=0x5637f6309400, cr=0x5637f6066c00, x=<optimized out>, y=<optimized out>, width=<optimized out>, height=<optimized out>, unused=0x0) at ../../../gtk/gtkbox.c:453
#17 0x00007f5e6b326c8f in gtk_css_custom_gadget_draw (gadget=0x5637f6309400, cr=0x5637f6066c00, x=0, y=0, width=600, height=521) at ../../../gtk/gtkcsscustomgadget.c:159
#18 0x00007f5e6b32c627 in gtk_css_gadget_draw (gadget=0x5637f6309400, cr=cr@entry=0x5637f6066c00) at ../../../gtk/gtkcssgadget.c:885
#19 0x00007f5e6b2cdb5c in gtk_box_draw (widget=0x5637f629fe30, cr=0x5637f6066c00) at ../../../gtk/gtkbox.c:462
#20 0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x5637f629fe30, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#21 0x00007f5e6b32119a in gtk_container_propagate_draw (container=<optimized out>, child=0x5637f629fe30, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3854
#22 0x00007f5e6b442ae1 in gtk_paned_render (gadget=<optimized out>, cr=0x5637f6066c00, x=<optimized out>, y=<optimized out>, width=<optimized out>, height=<optimized out>, data=0x0) at ../../../gtk/gtkpaned.c:1832
#23 0x00007f5e6b326c8f in gtk_css_custom_gadget_draw (gadget=0x5637f62a4190, cr=0x5637f6066c00, x=0, y=0, width=600, height=521) at ../../../gtk/gtkcsscustomgadget.c:159
#24 0x00007f5e6b32c627 in gtk_css_gadget_draw (gadget=0x5637f62a4190, cr=cr@entry=0x5637f6066c00) at ../../../gtk/gtkcssgadget.c:885
#25 0x00007f5e6b44494c in gtk_paned_draw (widget=0x5637f62b2270, cr=0x5637f6066c00) at ../../../gtk/gtkpaned.c:1782
#26 0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x5637f62b2270, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#27 0x00007f5e6b32119a in gtk_container_propagate_draw (container=<optimized out>, child=0x5637f62b2270, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3854
#28 0x00007f5e6b3212fd in gtk_container_draw (widget=<optimized out>, cr=cr@entry=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3674
#29 0x00007f5e6b2cae96 in gtk_box_draw_contents (gadget=0x5637f60dfca0, cr=0x5637f6066c00, x=<optimized out>, y=<optimized out>, width=<optimized out>, height=<optimized out>, unused=0x0) at ../../../gtk/gtkbox.c:453
#30 0x00007f5e6b326c8f in gtk_css_custom_gadget_draw (gadget=0x5637f60dfca0, cr=0x5637f6066c00, x=0, y=0, width=600, height=600) at ../../../gtk/gtkcsscustomgadget.c:159
#31 0x00007f5e6b32c627 in gtk_css_gadget_draw (gadget=0x5637f60dfca0, cr=cr@entry=0x5637f6066c00) at ../../../gtk/gtkcssgadget.c:885
#32 0x00007f5e6b2cdb5c in gtk_box_draw (widget=0x7f5e240149b0, cr=0x5637f6066c00) at ../../../gtk/gtkbox.c:462
#33 0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x7f5e240149b0, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#34 0x00007f5e6b32119a in gtk_container_propagate_draw (container=<optimized out>, child=0x7f5e240149b0, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3854
#35 0x00007f5e6b3212fd in gtk_container_draw (widget=<optimized out>, cr=0x5637f6066c00) at ../../../gtk/gtkcontainer.c:3674
#36 0x00007f5e6b56efdc in gtk_widget_draw_internal (widget=widget@entry=0x5637f6196d10, cr=cr@entry=0x5637f6066c00, clip_to_size=clip_to_size@entry=1) at ../../../gtk/gtkwidget.c:7084
#37 0x00007f5e6b57de40 in gtk_widget_render (widget=0x5637f6196d10, window=0x5637f6329520, region=<optimized out>) at ../../../gtk/gtkwidget.c:17610
#38 0x00007f5e6b408a78 in gtk_main_do_event (event=0x7ffcfe2801d0) at ../../../gtk/gtkmain.c:1844
#39 gtk_main_do_event (event=<optimized out>) at ../../../gtk/gtkmain.c:1691
#40 0x00007f5e6bb44b75 in _gdk_event_emit (event=event@entry=0x7ffcfe2801d0) at ../../../gdk/gdkevents.c:73
#41 0x00007f5e6bb534c9 in _gdk_window_process_updates_recurse_helper (window=0x5637f6329520, expose_region=<optimized out>) at ../../../gdk/gdkwindow.c:3874
#42 0x00007f5e6bb54fe2 in gdk_window_process_updates_internal (window=0x5637f6329520) at ../../../gdk/gdkwindow.c:4020
#43 0x00007f5e6bb551d8 in gdk_window_process_updates_with_mode (window=<optimized out>, recurse_mode=<optimized out>) at ../../../gdk/gdkwindow.c:4215
#44 0x00007f5e6afd95a9 in _g_closure_invoke_va (closure=closure@entry=0x5637f6371d00, return_value=return_value@entry=0x0, instance=instance@entry=0x5637f5c2ee70, args=args@entry=0x7ffcfe2804d0, n_params=0, param_types=0x0) at ../../../gobject/gclosure.c:895
#45 0x00007f5e6aff2bbf in g_signal_emit_valist (instance=0x5637f5c2ee70, signal_id=36, detail=<optimized out>, var_args=var_args@entry=0x7ffcfe2804d0) at ../../../gobject/gsignal.c:3456
#46 0x00007f5e6aff2dbf in g_signal_emit (instance=instance@entry=0x5637f5c2ee70, signal_id=<optimized out>, detail=detail@entry=0) at ../../../gobject/gsignal.c:3606
#47 0x00007f5e6bb4cd7f in _gdk_frame_clock_emit_paint (frame_clock=frame_clock@entry=0x5637f5c2ee70) at ../../../gdk/gdkframeclock.c:657
#48 0x00007f5e6bb4d64e in gdk_frame_clock_paint_idle (data=<optimized out>) at ../../../gdk/gdkframeclockidle.c:597
#49 0x00007f5e6bb39b47 in gdk_threads_dispatch (data=0x5637f5d840a0) at ../../../gdk/gdk.c:769
#50 0x00007f5e6aee119a in g_timeout_dispatch (source=0x5637f635fd80, callback=<optimized out>, user_data=<optimized out>) at ../../../glib/gmain.c:5007
#51 0x00007f5e6aee067f in g_main_dispatch (context=0x5637f5c2c980) at ../../../glib/gmain.c:3444
#52 g_main_context_dispatch (context=context@entry=0x5637f5c2c980) at ../../../glib/gmain.c:4162
#53 0x00007f5e6aee0a38 in g_main_context_iterate (context=context@entry=0x5637f5c2c980, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at ../../../glib/gmain.c:4238
#54 0x00007f5e6aee0acc in g_main_context_iteration (context=context@entry=0x5637f5c2c980, may_block=may_block@entry=1) at ../../../glib/gmain.c:4303
#55 0x00007f5e6b0ff53d in g_application_run (application=0x5637f5c89240, argc=argc@entry=0, argv=argv@entry=0x0) at ../../../gio/gapplication.c:2571
#56 0x00005637f45327c5 in main (argc=<optimized out>, argv=<optimized out>) at ./shell/main.c:284
(gdb) display/i $pc
1: x/i $pc
=> 0x7f5e6bdd9b5c <ev_view_window_child_move_with_parent-94484>:        mov    0x14,%eax
(gdb) disassemble 0x00007f5e6bdd9b51,0x7f5e6bdd9b5c+16
Dump of assembler code from 0x7f5e6bdd9b51 to 0x7f5e6bdd9b6c:
    0x00007f5e6bdd9b51 <ev_view_window_child_move_with_parent-94495>:    mov    %rsp,%rsi
    0x00007f5e6bdd9b54 <ev_view_window_child_move_with_parent-94492>:    mov    %rax,%rdi
    0x00007f5e6bdd9b57 <ev_view_window_child_move_with_parent-94489>:    call   0x7f5e6bdd99a0 <gdk_window_get_origin@plt>
=> 0x00007f5e6bdd9b5c <ev_view_window_child_move_with_parent-94484>:    mov    0x14,%eax
    0x00007f5e6bdd9b63 <ev_view_window_child_move_with_parent-94477>:    ud2
    0x00007f5e6bdd9b65 <annotation_window_moved.cold+0>: mov    0xc,%eax
End of assembler dump.