=================================================================
==31131==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x7fdf3a598400 at pc 0x7fdf454415e0 bp 0x7ffe233c2770 sp 0x7ffe233c2768
READ of size 1 at 0x7fdf3a598400 thread T0
#0 0x7fdf454415df in PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*) /src/poppler-0.74/poppler/PSOutputDev.cc:3468:23
#1 0x7fdf4527de72 in Page::displaySlice(OutputDev*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /src/poppler-0.74/poppler/Page.cc:527:13
#2 0x7fdf4527dd00 in Page::display(OutputDev*, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /src/poppler-0.74/poppler/Page.cc:469:3
#3 0x7fdf4529a925 in PDFDoc::displayPage(OutputDev*, int, double, double, int, bool, bool, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*, bool) /src/poppler-0.74/poppler/PDFDoc.cc:633:20
#4 0x5204ac in main /src/poppler-0.74/utils/pdftops.cc:424:12
#5 0x7fdf4390182f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
#6 0x41b5b8 in _start (/src/aflbuild/installed/bin/pdftops+0x41b5b8)
0x7fdf3a598400 is located 0 bytes to the right of 519168-byte region [0x7fdf3a519800,0x7fdf3a598400)
allocated by thread T0 here:
#0 0x4df7e8 in __interceptor_malloc /work/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cc:88
#1 0x7fdf455e1963 in gmalloc(unsigned long, bool) /src/poppler-0.74/goo/gmem.h:41:17
#2 0x7fdf455e1963 in gmallocn(int, int, bool) /src/poppler-0.74/goo/gmem.h:115
#3 0x7fdf455e1963 in gmallocn_checkoverflow(int, int) /src/poppler-0.74/goo/gmem.h:119
#4 0x7fdf455e1963 in SplashBitmap::SplashBitmap(int, int, int, SplashColorMode, bool, bool, GooList*) /src/poppler-0.74/splash/SplashBitmap.cc:113
SUMMARY: AddressSanitizer: heap-buffer-overflow /src/poppler-0.74/poppler/PSOutputDev.cc:3468:23 in PSOutputDev::checkPageSlice(Page*, double, double, int, bool, bool, int, int, int, int, bool, bool (*)(void*), void*, bool (*)(Annot*, void*), void*)
Shadow bytes around the buggy address:
0x0ffc674ab030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffc674ab040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffc674ab050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffc674ab060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0ffc674ab070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0ffc674ab080:[fa]fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffc674ab090: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffc674ab0a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffc674ab0b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffc674ab0c0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0ffc674ab0d0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==31131==ABORTING