SIGSEGV in png.c 6.3.7-8

[hoeth]

Of course there is nothing you can do until you can reproduce the problem. But if you need any further information from me, I'm more than happy to experiment.

[rmagick]

I'm about ready to call this a bug in the version of libpng I have installed on Ubuntu Gutsy, which is an out-of-date 1.2.15. The current version of libpng is 1.12.25 and the libpng home page has a "crash warning" for previous versions. Also the version available from the ImageMagick ftp servers is 1.12.25.

I'm going to install an up-to-date version of libpng and see if that fixes things up.

[rmagick]

Well, hmmm...That changes things but it still doesn't work. I got hoeth's ps file and tried his command:

Code: Select all

convert -verbose d01-x01-y01.ps d01-x01-y01.png

Here's the output:

Code: Select all

tim@linux:~$ convert -verbose d01-x01-y01.ps d01-x01-y01.png
"gs" -q -dQUIET -dPARANOIDSAFER -dBATCH -dNOPAUSE -dNOPROMPT -dMaxBitmap=500000000 -dAlignToPixels=0 -dGridFitTT=0 "-sDEVICE=pngalpha" -dTextAlphaBits=4 -dGraphicsAlphaBits=4 "-r72x72" -g332x304  "-sOutputFile=/home/tim/tmp/magick-XXPS95k1" "-f/home/tim/tmp/magick-XXNvIJKn" "-f/home/tim/tmp/magick-XXCeIzaK"
convert: image size exceeds user limits in IHDR `/home/tim/tmp/magick-XXPS95k1'.
convert: Corrupt image `/home/tim/tmp/magick-XXPS95k1'.
convert: Postscript delegate failed `d01-x01-y01.ps': No such file or directory.
convert: missing an image filename `d01-x01-y01.png'.

[hoeth]

Hmm, that looks indeed different. I get the segfault with 1.2.25, as I wrote (updating libpng was my first try).

Interestingly enough in my case a png file is produced as /tmp/magick-..., so ghostscript works and writes the png file, and I can convert this png file to anything else using imagemagick. It's just that "convert foo.ps foo.png" crashes instead of using ghostscript's output.

[rmagick]

Just installed 6.4.1-0. Even though this segv has occurred for me in every release through 6.4.0-11, this problem does not occur in the new release.

[macias]

When installing IM with GS I still get this crash, for example trace from gdb (at the end of the post). However I would like to know which part this bug is so to post a proper report about it and hopefully to have this thing fixed. The workaround is to install IM --with-gslib=no.

So -- is it IM<->GS fault, GS only fault, libpng fault?

Opensuse 11.1, ghostscript (installed from source) 8.64-1, IM (installed from source) 6.4.9-7, 64bit system.

Code: Select all

(gdb) run
Starting program: /usr/local/bin/convert black.pdf b7.png
[Thread debugging using libthread_db enabled]
[New Thread 0x7fffefec8950 (LWP 922)]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff47a8c25 in free () from /lib64/libc.so.6
(gdb) bt
#0  0x00007ffff47a8c25 in free () from /lib64/libc.so.6
#1  0x00007ffff7aa133f in RelinquishMagickMemory (memory=0xf4240) at magick/memory.c:655
#2  0x00007fffef2bba9c in png_IM_free (png_ptr=<value optimized out>, ptr=0xf4240) at coders/png.c:1449
#3  0x00007ffff31855b6 in png_free_data () from /usr/local/lib64/libgs.so.8
#4  0x00007ffff31858c5 in png_free_data () from /usr/local/lib64/libgs.so.8
#5  0x00007ffff258dcfa in png_destroy_write_struct () from /usr/lib64/libpng12.so.0
#6  0x00007fffef2ca366 in WriteOnePNGImage (mng_info=0x685ff0, image_info=0x63b790, image=0x680530) at coders/png.c:7507
#7  0x00007fffef2cc8ae in WritePNGImage (image_info=0x63b790, image=0x680530) at coders/png.c:7566
#8  0x00007ffff7a1c5dc in WriteImage (image_info=0x610dc0, image=0x680530) at magick/constitute.c:1168
#9  0x00007ffff7a1cd7b in WriteImages (image_info=<value optimized out>, images=0x680530, filename=0x606440 "b7.png", exception=0x603050)
    at magick/constitute.c:1287
#10 0x00007ffff76e8118 in ConvertImageCommand (image_info=0x60cc20, argc=0, argv=0x6063d0, metadata=0x0, exception=0x603050) at wand/convert.c:2768
#11 0x0000000000400ecc in main (argc=3, argv=0x7fffffffdc18) at utilities/convert.c:122

[magick]

Unfortunately we cannot reproduce the problem. Is the problem specific to a particular PDF? Does this work?

• convert logo: logo.pdf
  convert logo.pdf logo.png

Can you upgrade your version of Ghostscript or libpng?

The problem is most likely memory corruption but from where as you mentioned? ImageMagick? libpng? libgs?

[macias]

> Does this work?

Nope, also crashes.

> Can you upgrade your version of Ghostscript or libpng?

GS is already the newest, but just for being sure I upgraded libpng to the latest version. After this crash exactly as above.

> The problem is most likely memory corruption but from where as you mentioned? ImageMagick? libpng?
> libgs?

You mean that by looking at the trace you cannot tell? I am asking because if you could, I would post a report.

Btw. what distro are you using so it works for you? With manually compiled GS or from distro packages? And IM _with_ gslib?

[magick]

You mean that by looking at the trace you cannot tell? I am asking because if you could, I would post a report.

We fix ImageMagick from stack traces all the time but this particular trace shows the fault is in libpng which implies the bug is in libpng or that there is memory corruption which can be introduced by each of ImageMagick, libpng, or libgs.

Btw. what distro are you using so it works for you? With manually compiled GS or from distro packages? And IM _with_ gslib?

We're using Fedora Core 10 64-bit, Ghostscript 8.64, and libpng 1.2.34-1:

• identify -list configure
  
  Path: /usr/local/lib/ImageMagick-6.4.9/config/configure.xml
  
  Name Value
  -------------------------------------------------------------------------------
  CC gcc -std=gnu99
  CFLAGS -fopenmp -g -O2 -Wall -W -pthread
  CONFIGURE ./configure '--enable-delegate-build' '--enable-shared' '--disable-static' '--with-modules' '--with-quantum-depth=16' '--without-wmf' '--with-lqr' '--enable-cipher' '--enable-libtool-verbose' '--with-gslib=yes'
  COPYRIGHT Copyright (C) 1999-2009 ImageMagick Studio LLC
  CPPFLAGS -I/usr/local/include/ImageMagick
  CXX g++
  CXXFLAGS -g -O2 -Wall -W -pthread
  DEFS -DHAVE_CONFIG_H
  DELEGATES bzlib fontconfig freetype gs gvc jpeg jp2 lcms openexr png rsvg tiff x11 xml zlib
  DISTCHECK_CONFIG_FLAGS --disable-deprecated --with-quantum-depth=16 --with-umem=no --with-autotrace=no --with-fontpath= --with-wmf=no
  EXEC-PREFIX /usr/local
  HOST x86_64-unknown-linux-gnu
  LDFLAGS -L/usr/local/lib -L/home/cristy/ImageMagick-6.4.9-8/magick/.libs -L/home/cristy/ImageMagick-6.4.9-8/magick -L/home/cristy/ImageMagick-6.4.9-8/wand/.libs -L/home/cristy/ImageMagick-6.4.9-8/wand -lfreetype
  LIB_VERSION 0x649
  LIB_VERSION_NUMBER 6,4,9,8
  LIBS -lMagickCore -llcms -ltiff -lfreetype -ljpeg -lfontconfig -lXext -lSM -lICE -lX11 -lXt -lbz2 -lz -lm -lgomp -lpthread -lltdl
  NAME ImageMagick
  PCFLAGS -fopenmp
  PREFIX /usr/local
  QuantumDepth 16
  RELEASE_DATE 2009-02-27
  VERSION 6.4.9
  WEBSITE http://www.imagemagick.org

Other than the PDF tests possibly failing, do the other validation tests pass? Type

• cd ImageMagick-6.4.9-7
  make check

They of course passes on our system. Its implied with a release of ImageMagick. The validation suite (some 2000+ regression tests) must pass before a release is possible.

[macias]

Thank you very much for your answer. However looks like I am stuck because I use even newer version of libpng -- 1.2.35

When I use --with-gslib=yes, one test fails (I am sorry I didn't include it before):

Code: Select all

validate image formats on disk:
/home/macias/rpm/BUILD/ImageMagick-6.4.9-7/magick.sh: line 40: 25373 Segmentation fault      env LD_LIBRARY_PATH="${top_builddir}/magick/.libs:${top_builddir}/wand/.libs:${LD_LIBRARY_PATH}" MAGICK_CODER_MODULE_PATH="${MAGICK_CODER_MODULE_PATH}" MAGICK_CONFIGURE_PATH="${MAGICK_CONFIGURE_BUILD_PATH}${DIRSEP}${MAGICK_CONFIGURE_SRC_PATH}" MAGICK_FILTER_MODULE_PATH="${MAGICK_FILTER_MODULE_PATH}" PATH="${PATH}" "$@"
FAIL: tests/validate.sh