stack-overflow in `Gfx` results in Segmentation Fault
- Version: 20.12.1
- Commit: e1f56258
- How to reproduce: ./pdftops ./poc.pdf /dev/null
The backtrace is:
==87508==ERROR: AddressSanitizer: stack-overflow on address 0x7ffdad19dd50 (pc 0x7fa5dfaba70a bp 0x7ffdad1a0320 sp 0x7ffdad19dc40 T0)
#0 0x7fa5dfaba709 in buffered_vfprintf /build/glibc-S9d2JN/glibc-2.27/stdio-common/vfprintf.c:2329
#1 0x7fa5dfab7825 in _IO_vfprintf /build/glibc-S9d2JN/glibc-2.27/stdio-common/vfprintf.c:1301
#2 0x44cbc6 in __interceptor_vfprintf (/src/executable/pdftops+0x44cbc6)
#3 0x44ccd6 in fprintf (/src/executable/pdftops+0x44ccd6)
#4 0x525b15 in error(ErrorCategory, long long, char const*, ...) /src/poppler/poppler/Error.cc:76:13
#5 0x991c50 in GfxTilingPattern::parse(Object*, int) /src/poppler/poppler/GfxState.cc:3186:9
#6 0x9911c7 in GfxPattern::parse(GfxResources*, Object*, OutputDev*, GfxState*, int) /src/poppler/poppler/GfxState.cc:3155:19
#7 0x8e7d27 in GfxResources::lookupPattern(char const*, OutputDev*, GfxState*) /src/poppler/poppler/Gfx.cc:389:24
#8 0x8e2fb3 in Gfx::opSetFillColorN(Object*, int) /src/poppler/poppler/Gfx.cc:1542:63
#9 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#10 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#11 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#12 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#13 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#14 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#15 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#16 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#17 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#18 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#19 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#20 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#21 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#22 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#23 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#24 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#25 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#26 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#27 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#28 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#29 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#30 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#31 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#32 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#33 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#34 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#35 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#36 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#37 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#38 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#39 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#40 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#41 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#42 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#43 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#44 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#45 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#46 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#47 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#48 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#49 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#50 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#51 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#52 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#53 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#54 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#55 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#56 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#57 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#58 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#59 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#60 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#61 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#62 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#63 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#64 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#65 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#66 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#67 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#68 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#69 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#70 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#71 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#72 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#73 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#74 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#75 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#76 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#77 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#78 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#79 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#80 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#81 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#82 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#83 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#84 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#85 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#86 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#87 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#88 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#89 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#90 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#91 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#92 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#93 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#94 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#95 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#96 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#97 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#98 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#99 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#100 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#101 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#102 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#103 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#104 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#105 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#106 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#107 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#108 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#109 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
#110 0x8f7e91 in Gfx::doTilingPatternFill(GfxTilingPattern*, bool, bool, bool) /src/poppler/poppler/Gfx.cc:2180:25
#111 0x8f541e in Gfx::doPatternFill(bool) /src/poppler/poppler/Gfx.cc:1898:9
#112 0x8c308b in Gfx::opFillStroke(Object*, int) /src/poppler/poppler/Gfx.cc:1797:17
#113 0x8f0006 in Gfx::execOp(Object*, Object*, int) /src/poppler/poppler/Gfx.cc:802:5
#114 0x8ee669 in Gfx::go(bool) /src/poppler/poppler/Gfx.cc:679:13
#115 0x8edc20 in Gfx::display(Object*, bool) /src/poppler/poppler/Gfx.cc:640:5
#116 0x8f3b89 in Gfx::drawForm(Object*, Dict*, double const*, double const*, bool, bool, GfxColorSpace*, bool, bool, bool, Function*, GfxColor*) /src/poppler/poppler/Gfx.cc:4767:5
#117 0xa89643 in PreScanOutputDev::tilingPatternFill(GfxState*, Gfx*, Catalog*, Object*, double const*, int, int, Dict*, double const*, double const*, int, int, int, int, double, double) /src/poppler/poppler/PreScanOutputDev.cc:84:14
...