bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

Reading certain emails with mu4e
(https://github.com/djcb/mu/tree/master/mu4e) causes emacs to segfault.

Steps to reproduce:
emacs -Q
(add-to-list 'load-path "/usr/share/emacs/site-lisp/mu4e/")
(load-file "~/.emacs.d/conf/mu4e-conf.el")
M-x mu4e
ji
RET
; ji to view inbox, select the right message, then RET to open it

Relevant lines from mu4e-conf.el:
;; enable inline images
(setq mu4e-view-show-images t)
;; use imagemagick, if available
(when (fboundp 'imagemagick-register-types)
(imagemagick-register-types))

Setting mu4e-view-show-images to nil causes the the segfault to not
occur.


Backtrace:
(gdb) run -Q
Starting program: /usr/bin/emacs -Q
warning: Could not load shared library symbols for linux-vdso.so.1.
Do you need "set solib-search-path" or "set sysroot"?
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.3400.3-gdb.py", line 9, in <module>
    from gobject import register
  File "/usr/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".
[New Thread 0x7fffe6dea700 (LWP 8465)]
[New Thread 0x7fffe63de700 (LWP 8466)]

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff3f45791 in AcquireQuantumInfo () from /usr/lib/libMagickCore-Q16.so.7
(gdb) bt full
#0  0x00007ffff3f45791 in AcquireQuantumInfo () from /usr/lib/libMagickCore-Q16.so.7
No symbol table info available.
#1  0x00007fffcfac980f in ?? () from /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so
No symbol table info available.
#2  0x00007fffcfaca630 in ?? () from /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so
No symbol table info available.
#3  0x00007ffff3e7b3c0 in ReadImage () from /usr/lib/libMagickCore-Q16.so.7
No symbol table info available.
#4  0x00007ffff43295bc in MagickReadImage () from /usr/lib/libMagickWand-Q16.so.7
No symbol table info available.
#5  0x00000000006875bc in ?? ()
No symbol table info available.
#6  0x0000000000688156 in ?? ()
No symbol table info available.
#7  0x000000000067e187 in ?? ()
No symbol table info available.
#8  0x000000000043bd6f in ?? ()
No symbol table info available.
#9  0x000000000043a5b9 in ?? ()
No symbol table info available.
#10 0x000000000043a3f2 in ?? ()
No symbol table info available.
#11 0x00000000004375b2 in ?? ()
No symbol table info available.
#12 0x0000000000443faa in ?? ()
No symbol table info available.
#13 0x00000000004402e1 in ?? ()
No symbol table info available.
#14 0x0000000000463e94 in ?? ()
No symbol table info available.
#15 0x000000000045aae0 in ?? ()
No symbol table info available.
#16 0x0000000000458bc1 in ?? ()
No symbol table info available.
#17 0x000000000045272f in ?? ()
No symbol table info available.
#18 0x00000000005e04b2 in ?? ()
No symbol table info available.
#19 0x000000000045269d in ?? ()
No symbol table info available.
#20 0x0000000000452657 in ?? ()
No symbol table info available.
#21 0x000000000045176f in ?? ()
No symbol table info available.
#22 0x0000000000451f58 in ?? ()
No symbol table info available.
#23 0x000000000063a525 in ?? ()
No symbol table info available.
#24 0x0000000000422d2b in ?? ()
No symbol table info available.
#25 0x0000000000546b17 in ?? ()
No symbol table info available.
#26 0x000000000055354a in ?? ()
No symbol table info available.
#27 0x00000000005441fb in ?? ()
No symbol table info available.
#28 0x00000000005e0331 in ?? ()
No symbol table info available.
#29 0x0000000000543b35 in ?? ()
No symbol table info available.
#30 0x00000000005dfcd8 in ?? ()
No symbol table info available.
#31 0x0000000000543ae5 in ?? ()
No symbol table info available.
#32 0x000000000054323e in ?? ()
No symbol table info available.
#33 0x00000000005433e1 in ?? ()
No symbol table info available.
#34 0x00000000005412b6 in ?? ()
No symbol table info available.
#35 0x00007ffff19d0a15 in __libc_start_main () from /usr/lib/libc.so.6
No symbol table info available.
#36 0x0000000000416339 in ?? ()
No symbol table info available.





In GNU Emacs 24.3.50.1 (x86_64-unknown-linux-gnu, GTK+ Version 3.6.4)
 of 2013-03-04 on gateway
Bzr revision: yamaoka@jpl.org-20130304102733-4qy111z41qwoh2as
Windowing system distributor `The X.Org Foundation', version 11.0.11204000
System Description:	Arch Linux

Configured using:
 `configure --prefix=/usr --sysconfdir=/etc --localstatedir=/var
 --libexecdir=/usr/lib --mandir=/usr/share/man
 --without-toolkit-scroll-bars --with-xft --with-x-toolkit=gtk3
 CFLAGS='-march=x86-64 -mtune=generic -O0 -g3 -pipe -fstack-protector
 --param=ssp-buffer-size=4 -D_FORTIFY_SOURCE=2'
 LDFLAGS='-Wl,-O1,--sort-common,--as-needed,-z,relro,--hash-style=gnu''

Important settings:
  value of $LC_ALL: en_US.utf8
  value of $LANG: en_US.utf8
  locale-coding-system: utf-8-unix
  default enable-multibyte-characters: t

Major mode: Lisp Interaction

Minor modes in effect:
  tooltip-mode: t
  mouse-wheel-mode: t
  tool-bar-mode: t
  menu-bar-mode: t
  file-name-shadow-mode: t
  global-font-lock-mode: t
  font-lock-mode: t
  blink-cursor-mode: t
  auto-composition-mode: t
  auto-encryption-mode: t
  auto-compression-mode: t
  line-number-mode: t
  transient-mark-mode: t

Recent input:
M-x r e p o r t C-g <S-insert> C-/ M-: <S-insert> <return> 
M-: <S-insert> <return> M-x r e p o r t <tab> <ret
urn>

Recent messages:
For information about GNU Emacs and the GNU system, type C-h C-a.
Quit
Mark set
Undo!
("/usr/share/emacs/site-lisp/mu4e/" "/usr/share/emacs/24.3.50/lisp" "/usr/share/emacs/24.3.50/lisp/vc" "/usr/share/emacs/24.3.50/lisp/url" "/usr/share/emacs/24.3.50/lisp/textmodes" "/usr/share/emacs/24.3.50/lisp/progmodes" "/usr/share/emacs/24.3.50/lisp/play" "/usr/share/emacs/24.3.50/lisp/org" "/usr/share/emacs/24.3.50/lisp/nxml" "/usr/share/emacs/24.3.50/lisp/net" "/usr/share/emacs/24.3.50/lisp/mh-e" "/usr/share/emacs/24.3.50/lisp/mail" ...)
Loading /home/avru/.emacs.d/conf/mu4e-conf.el (source)...done
t

Load-path shadows:
None found.

Features:
(shadow sort mail-extr emacsbug edmacro kmacro mu4e mu4e-speedbar
speedbar sb-image ezimage dframe mu4e-main mu4e-view epa derived epg
epg-config browse-url comint ansi-color ring mu4e-headers mu4e-compose
mu4e-draft mu4e-actions rfc2368 smtpmail auth-source eieio byte-opt
bytecomp byte-compile cconv gnus-util password-cache sendmail mu4e-mark
mu4e-message html2text mu4e-proc mu4e-utils doc-view jka-compr
image-mode dired mu4e-lists mu4e-about mu4e-vars message cl-macs gv
format-spec rfc822 mml easymenu mml-sec mm-decode mm-bodies mm-encode
mail-parse rfc2231 rfc2047 rfc2045 ietf-drums mm-util mail-prsvr
mailabbrev mail-utils gmm-utils mailheader hl-line cl nadvice cl-lib
mu4e-meta time-date tooltip ediff-hook vc-hooks lisp-float-type mwheel
x-win x-dnd tool-bar dnd fontset image regexp-opt fringe tabulated-list
newcomment lisp-mode register page menu-bar rfn-eshadow timer select
scroll-bar mouse jit-lock font-lock syntax facemenu font-core frame cham
georgian utf-8-lang misc-lang vietnamese tibetan thai tai-viet lao
korean japanese hebrew greek romanian slovak czech european ethiopic
indian cyrillic chinese case-table epa-hook jka-cmpr-hook help simple
abbrev minibuffer loaddefs button faces cus-face macroexp files
text-properties overlay sha1 md5 base64 format env code-pages mule
custom widget hashtable-print-readable backquote make-network-process
dbusbind inotify dynamic-setting system-font-setting font-render-setting
move-toolbar gtk x-toolkit x multi-tty emacs)

-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

To make this easier to reproduce, can you pull the image
in question out of the email, and visit it separately?
If that makes emacs -Q dump core, then we can try to
visit the image ourselves.

You might try a "bzr up", as there was a recent fix for an
ImageMagick core dump in trunk bzr 111937 (see Bug#13846 in
<http://bugs.gnu.org/13846>) and this is later than the
version you built.

Also, can you please try building Emacs without optimization
and with debugging symbols, and generating a backtrace for that?

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

[-- Attachment #1: Type: text/plain, Size: 210 bytes --]

Nothing obvious from the backtrace, alas.

Can you reproduce the problem under valgrind?
Copy the attached to your emacs/src directory
and run the command listed under "Example use:"
at the start of that file.

[-- Attachment #2: valgrind.supp --]
[-- Type: text/plain, Size: 2845 bytes --]

# valgrind suppression file
# Example use:
#    valgrind --db-attach=yes --suppressions=valgrind.supp ./temacs -l loadup

# This works with 'temacs', but not with 'bootstrap-emacs' or with 'emacs'
# due to incompabilities between valgrind and the way Emacs dumps itself.

# This is intended to work on both 32- and 64-bit hosts, so many rules
# are duplicated, e.g., there are rules for both Value4 and Value8.

# Conservative garbage collection inherently looks at uninitialized values,
# and Fgarbage_collect and its callees all depend on this.
# It's hard to separate out exactly which callees need to be listed here,
# since the C compiler can inline them.  Also, valgrind doesn't care
# about the use of uninitialized variables directly, only when their values
# are eventually used.  So just list Fgarbage_collect and its callees.
{
   Fgarbage_collect Cond - conservative garbage collection
   Memcheck:Cond
   ...
   fun:Fgarbage_collect
}
{
   Fgarbage_collect Value4 - conservative garbage collection
   Memcheck:Value4
   ...
   fun:Fgarbage_collect
}
{
   Fgarbage_collect Value8 - conservative garbage collection
   Memcheck:Value8
   ...
   fun:Fgarbage_collect
}
# valgrind only looks at the last few callees on the stack, but
# mark_object can call itself recursively and deeply.  So list
# it too, in case Fgarbage_collect is a long way from the stack top.
{
   Fgarbage_collect Cond - conservative garbage collection
   Memcheck:Cond
   ...
   fun:mark_object
}
{
   Fgarbage_collect Value4 - conservative garbage collection
   Memcheck:Value4
   ...
   fun:mark_object
}
{
   Fgarbage_collect Value8 - conservative garbage collection
   Memcheck:Value8
   ...
   fun:mark_object
}
# On Ubuntu 12.04 x86, valgrind gets confused about the call stack.
# GDB reports this:
#	mark_vectorlike
#	mark_maybe_pointer
#	mark_memory
#	mark_stack
#	Fgarbage_collect
#	Ffuncall
# but valgrind sees only the first and last functions in the chain.
{
   mark_vectorlike Value4 - conservative garbage collection
   Memcheck:Value4
   fun:mark_vectorlike
}

# Fedora 17 x86-64 warns about this, for no good reason.
{
   timer_create evp arg is only partly initialized
   Memcheck:Param
   timer_create(evp)
   ...
   fun:init_atimer
}

# On Ubuntu 12.04 x86, strlen is inlined to something that loads 4 bytes
# at a time.
{
   libfontconfig optimized strlen
   Memcheck:Addr4
   obj:/usr/lib*/libfontconfig.so*
}

# On Ubuntu 12.04 x86, several libraries have issues due to unknown reasons.
{
   libgdk and libglib unknown issue
   Memcheck:Param
   writev(vector[...])
   fun:writev
}
{
   libgtk unknown issue
   Memcheck:Cond
   ...
   obj:/usr/lib*/libgtk-x11-*.so*
}
{
   libpixman unknown issue
   Memcheck:Cond
   ...
   obj:/usr/lib*/libpixman-*.so*
}
{
   librsvg unknown issue
   Memcheck:Cond
   ...
   obj:/usr/lib*/librsvg-*.so*
}

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

On 03/07/13 08:31, Nicolas Avrutin wrote:
> Took some finicking with the mu4e elisp to get it to run under temacs

Thanks, can you please send a copy of your email to
<13867@debbugs.gnu.org>, for the public records?

Also, can you please interpret its backtrace, using
the instructions in the Emacs manual section
"When Emacs Crashes"?  Something like this:

     sed -n 's/.*\[\(.*\)]$/\1/p' backtrace.txt |
       addr2line -C -f -i -e ./temacs

The valgrind output suggests that the stack may have been corrupted
in handle_stop or its caller, which may be a pain to debug....

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

Took some finicking with the mu4e elisp to get it to run under temacs
(temacs doesn't like sendmail), but I got it. Valgrind info below. I can
leave that valgrind session open for a few days in case you want me
check anything else from within valgrind (if so, give me specific
commands to run, I haven't used valgrind beyond memcheck).

Also, I found this bug on the mu4e issue tracker, though it doesn't look
like there is any useful information there:
https://github.com/djcb/mu/issues/143[1]

Here's what valgrind gives me:

==5565== Invalid write of size 4
==5565==    at 0x8AD3791: AcquireQuantumInfo (in /usr/lib/libMagickCore-Q16.so.7.0.0)
==5565==    by 0x2373680E: ??? (in /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so)
==5565==    by 0x2373762F: ??? (in /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so)
==5565==    by 0x8A093BF: ReadImage (in /usr/lib/libMagickCore-Q16.so.7.0.0)
==5565==    by 0x870C5BB: MagickReadImage (in /usr/lib/libMagickWand-Q16.so.7.0.0)
==5565==    by 0x6748D7: imagemagick_load_image (image.c:7685)
==5565==    by 0x67537D: imagemagick_load (image.c:7978)
==5565==    by 0x66BF56: lookup_image (image.c:1697)
==5565==    by 0x43B844: handle_single_display_spec (xdisp.c:5017)
==5565==    by 0x43A0AF: handle_display_spec (xdisp.c:4515)
==5565==    by 0x439EE8: handle_display_prop (xdisp.c:4467)
==5565==    by 0x437194: handle_stop (xdisp.c:3219)
==5565==  Address 0x60 is not stack'd, malloc'd or (recently) free'd

Backtrace:
./temacs[0x55a542]
./temacs[0x536722]
./temacs[0x55a064]
./temacs[0x55a039]
./temacs[0x55a09a]
/usr/lib/libpthread.so.0(+0xf1e0)[0xaca31e0]
/usr/lib/libMagickCore-Q16.so.7(AcquireQuantumInfo+0x61)[0x8ad3791]
/usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so(+0x1780f)[0x2373680f]
/usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so(+0x18630)[0x23737630]
/usr/lib/libMagickCore-Q16.so.7(ReadImage+0x190)[0x8a093c0]
/usr/lib/libMagickWand-Q16.so.7(MagickReadImage+0x6c)[0x870c5bc]
./temacs[0x6748d8]
./temacs[0x67537e]
./temacs[0x66bf57]
./temacs[0x43b845]
./temacs[0x43a0b0]
./temacs[0x439ee9]
./temacs[0x437195]
./temacs[0x44373f]
./temacs[0x43fbf6]
./temacs[0x461ae1]
./temacs[0x458e73]
./temacs[0x4568e0]
./temacs[0x451517]
./temacs[0x5d2f10]
./temacs[0x4508c0]
./temacs[0x44e650]
./temacs[0x53cf34]
./temacs[0x549c0d]
./temacs[0x53af8d]
./temacs[0x5d2d95]
./temacs[0x53a8d6]
./temacs[0x5d2769]
./temacs[0x53a837]
./temacs[0x53a002]
./temacs[0x53a1a5]
./temacs[0x5d5f73]
./temacs[0x61d1ca]
./temacs[0x5d66d0]
./temacs[0x5d6184]
./temacs[0x5d536a]

-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

On Thu, Mar 07 2013, Paul Eggert wrote:
>      sed -n 's/.*\[\(.*\)]$/\1/p' backtrace.txt |
>        addr2line -C -f -i -e ./temacs

emacs_backtrace
src/sysdep.c:2134
terminate_due_to_signal
src/emacs.c:337
deliver_fatal_signal
src/sysdep.c:1656
deliver_thread_signal
src/sysdep.c:1628
deliver_fatal_thread_signal
src/sysdep.c:1664
??
??:0
??
??:0
??
??:0
??
??:0
??
??:0
??
??:0
imagemagick_load_image
src/image.c:7687
imagemagick_load
src/image.c:7978
lookup_image
src/image.c:1697
handle_single_display_spec
src/xdisp.c:5017
handle_display_spec
src/xdisp.c:4515
handle_display_prop
src/xdisp.c:4467
handle_stop
src/xdisp.c:3219
next_element_from_buffer
src/xdisp.c:7921
get_next_display_element
src/xdisp.c:6588
display_line
src/xdisp.c:19251
try_window
src/xdisp.c:16115
redisplay_window
src/xdisp.c:15450
redisplay_window_1
src/xdisp.c:13695
internal_condition_case_1
src/eval.c:1231
redisplay_internal
src/xdisp.c:13345
redisplay
src/xdisp.c:12554
read_char
src/keyboard.c:2427
read_key_sequence
src/keyboard.c:9063 (discriminator 4)
command_loop_1
src/keyboard.c:1458
internal_condition_case
src/eval.c:1193
command_loop_2
src/keyboard.c:1173 (discriminator 1)
internal_catch
src/eval.c:964
command_loop
src/keyboard.c:1144
recursive_edit_1
src/keyboard.c:785
Frecursive_edit
src/keyboard.c:850
Ffuncall
src/eval.c:2672
exec_byte_code
src/bytecode.c:898
funcall_lambda
src/eval.c:2841
Ffuncall
src/eval.c:2724
Fapply
src/eval.c:2209



-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

I could also try to compile imagemagick with debugging symbols if you
think that would be helpful.

-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

On 03/07/2013 09:57 AM, Nicolas Avrutin wrote:
> ==5565==    at 0x8AD3791: AcquireQuantumInfo (in /usr/lib/libMagickCore-Q16.so.7.0.0)
> ==5565==    by 0x2373680E: ??? (in /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so)
> ==5565==    by 0x2373762F: ??? (in /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so)
> ==5565==    by 0x8A093BF: ReadImage (in /usr/lib/libMagickCore-Q16.so.7.0.0)
> ==5565==    by 0x870C5BB: MagickReadImage (in /usr/lib/libMagickWand-Q16.so.7.0.0)

I just built ImageMagick 6.8.2-10 from source on Fedora 17 x86-64
to try to diagnose this, and it built lib/libMagickCore6-Q16.so.1.0.0 (not 7.0.0).
Is it possible that there is a version mismatch problem here?
What is the output of:

ldd /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so
ldd /usr/lib/libMagickCore-Q16.so.7.0.0
ldd temacs

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

On 03/07/2013 03:20 PM, Nicolas Avrutin wrote:
> I could also try to compile imagemagick with debugging symbols if you
> think that would be helpful.

If we can't figure it out otherwise, then yes that might be helpful.
Thanks.

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

On Thu, Mar 07 2013, Paul Eggert <eggert@cs.ucla.edu> wrote:

> I just built ImageMagick 6.8.2-10 from source on Fedora 17 x86-64
> to try to diagnose this, and it built lib/libMagickCore6-Q16.so.1.0.0 (not 7.0.0).
> Is it possible that there is a version mismatch problem here?

The files come from the imagemagick package [1]. The link displays the
file list for the package and usr/lib/libMagickCore-Q16.so.7.0.0 (on
Arch, /lib/ is a symlink to /usr/lib) is present there.

Footnotes: 
[1]  https://www.archlinux.org/packages/extra/x86_64/imagemagick/


> ldd /usr/lib/ImageMagick-6.8.2/modules-Q16/coders/png.so
linux-vdso.so.1 (0x00007ffff6563000)
libMagickCore-Q16.so.7 => /usr/lib/libMagickCore-Q16.so.7 (0x00007fb7e594d000)
liblcms2.so.2 => /usr/lib/liblcms2.so.2 (0x00007fb7e56f9000)
libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x00007fb7e545a000)
liblqr-1.so.0 => /usr/lib/liblqr-1.so.0 (0x00007fb7e5245000)
libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0x00007fb7e4f4f000)
libfontconfig.so.1 => /usr/lib/libfontconfig.so.1 (0x00007fb7e4d14000)
libXext.so.6 => /usr/lib/libXext.so.6 (0x00007fb7e4b00000)
libX11.so.6 => /usr/lib/libX11.so.6 (0x00007fb7e47c7000)
libXt.so.6 => /usr/lib/libXt.so.6 (0x00007fb7e4561000)
libbz2.so.1.0 => /usr/lib/libbz2.so.1.0 (0x00007fb7e4350000)
libltdl.so.7 => /usr/lib/libltdl.so.7 (0x00007fb7e4146000)
libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007fb7e3f2a000)
libpng15.so.15 => /usr/lib/libpng15.so.15 (0x00007fb7e3cfc000)
libjpeg.so.8 => /usr/lib/libjpeg.so.8 (0x00007fb7e3aab000)
liblzma.so.5 => /usr/lib/liblzma.so.5 (0x00007fb7e3888000)
libz.so.1 => /usr/lib/libz.so.1 (0x00007fb7e3671000)
libm.so.6 => /usr/lib/libm.so.6 (0x00007fb7e3373000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007fb7e2fc6000)
libpcre.so.1 => /usr/lib/libpcre.so.1 (0x00007fb7e2d62000)
librt.so.1 => /usr/lib/librt.so.1 (0x00007fb7e2b5a000)
libexpat.so.1 => /usr/lib/libexpat.so.1 (0x00007fb7e2930000)
libxcb.so.1 => /usr/lib/libxcb.so.1 (0x00007fb7e2710000)
libdl.so.2 => /usr/lib/libdl.so.2 (0x00007fb7e250c000)
libSM.so.6 => /usr/lib/libSM.so.6 (0x00007fb7e2304000)
libICE.so.6 => /usr/lib/libICE.so.6 (0x00007fb7e20e7000)
/usr/lib64/ld-linux-x86-64.so.2 (0x00007fb7e6040000)
libXau.so.6 => /usr/lib/libXau.so.6 (0x00007fb7e1ee3000)
libXdmcp.so.6 => /usr/lib/libXdmcp.so.6 (0x00007fb7e1cdc000)
libuuid.so.1 => /usr/lib/libuuid.so.1 (0x00007fb7e1ad7000)


> ldd /usr/lib/libMagickCore-Q16.so.7.0.0
linux-vdso.so.1 (0x00007fff8a9ff000)
liblcms2.so.2 => /usr/lib/liblcms2.so.2 (0x00007f59e7059000)
libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x00007f59e6dba000)
liblqr-1.so.0 => /usr/lib/liblqr-1.so.0 (0x00007f59e6ba6000)
libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0x00007f59e68af000)
libfontconfig.so.1 => /usr/lib/libfontconfig.so.1 (0x00007f59e6674000)
libXext.so.6 => /usr/lib/libXext.so.6 (0x00007f59e6461000)
libX11.so.6 => /usr/lib/libX11.so.6 (0x00007f59e6127000)
libXt.so.6 => /usr/lib/libXt.so.6 (0x00007f59e5ec1000)
liblzma.so.5 => /usr/lib/liblzma.so.5 (0x00007f59e5c9e000)
libbz2.so.1.0 => /usr/lib/libbz2.so.1.0 (0x00007f59e5a8d000)
libz.so.1 => /usr/lib/libz.so.1 (0x00007f59e5877000)
libltdl.so.7 => /usr/lib/libltdl.so.7 (0x00007f59e566d000)
libm.so.6 => /usr/lib/libm.so.6 (0x00007f59e536e000)
libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007f59e5152000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007f59e4da5000)
libpcre.so.1 => /usr/lib/libpcre.so.1 (0x00007f59e4b41000)
librt.so.1 => /usr/lib/librt.so.1 (0x00007f59e4939000)
libexpat.so.1 => /usr/lib/libexpat.so.1 (0x00007f59e470f000)
libxcb.so.1 => /usr/lib/libxcb.so.1 (0x00007f59e44ef000)
libdl.so.2 => /usr/lib/libdl.so.2 (0x00007f59e42eb000)
libSM.so.6 => /usr/lib/libSM.so.6 (0x00007f59e40e3000)
libICE.so.6 => /usr/lib/libICE.so.6 (0x00007f59e3ec6000)
/usr/lib64/ld-linux-x86-64.so.2 (0x00007f59e777c000)
libXau.so.6 => /usr/lib/libXau.so.6 (0x00007f59e3cc2000)
libXdmcp.so.6 => /usr/lib/libXdmcp.so.6 (0x00007f59e3abb000)
libuuid.so.1 => /usr/lib/libuuid.so.1 (0x00007f59e38b6000)


> ldd temacs
linux-vdso.so.1 (0x00007fff80174000)
libtiff.so.5 => /usr/lib/libtiff.so.5 (0x00007fbb59c33000)
libjpeg.so.8 => /usr/lib/libjpeg.so.8 (0x00007fbb599e2000)
libpng15.so.15 => /usr/lib/libpng15.so.15 (0x00007fbb597b5000)
libm.so.6 => /usr/lib/libm.so.6 (0x00007fbb594b7000)
libgif.so.4 => /usr/lib/libgif.so.4 (0x00007fbb592ad000)
libXpm.so.4 => /usr/lib/libXpm.so.4 (0x00007fbb5909b000)
libgtk-3.so.0 => /usr/lib/libgtk-3.so.0 (0x00007fbb589e8000)
libgdk-3.so.0 => /usr/lib/libgdk-3.so.0 (0x00007fbb58731000)
libpango-1.0.so.0 => /usr/lib/libpango-1.0.so.0 (0x00007fbb584e6000)
libcairo.so.2 => /usr/lib/libcairo.so.2 (0x00007fbb581c8000)
libgdk_pixbuf-2.0.so.0 => /usr/lib/libgdk_pixbuf-2.0.so.0 (0x00007fbb57fa6000)
libgio-2.0.so.0 => /usr/lib/libgio-2.0.so.0 (0x00007fbb57c53000)
libgobject-2.0.so.0 => /usr/lib/libgobject-2.0.so.0 (0x00007fbb57a05000)
libglib-2.0.so.0 => /usr/lib/libglib-2.0.so.0 (0x00007fbb5770f000)
libSM.so.6 => /usr/lib/libSM.so.6 (0x00007fbb57507000)
libICE.so.6 => /usr/lib/libICE.so.6 (0x00007fbb572eb000)
libX11.so.6 => /usr/lib/libX11.so.6 (0x00007fbb56fb2000)
libXrender.so.1 => /usr/lib/libXrender.so.1 (0x00007fbb56da7000)
libXft.so.2 => /usr/lib/libXft.so.2 (0x00007fbb56b92000)
libasound.so.2 => /usr/lib/libasound.so.2 (0x00007fbb568a1000)
librsvg-2.so.2 => /usr/lib/librsvg-2.so.2 (0x00007fbb5666c000)
libMagickWand-Q16.so.7 => /usr/lib/libMagickWand-Q16.so.7 (0x00007fbb56354000)
libMagickCore-Q16.so.7 => /usr/lib/libMagickCore-Q16.so.7 (0x00007fbb55ec1000)
librt.so.1 => /usr/lib/librt.so.1 (0x00007fbb55cb9000)
libdbus-1.so.3 => /usr/lib/libdbus-1.so.3 (0x00007fbb55a72000)
libxml2.so.2 => /usr/lib/libxml2.so.2 (0x00007fbb55716000)
libgpm.so.2 => /usr/lib/libgpm.so.2 (0x00007fbb5550f000)
libncursesw.so.5 => /usr/lib/libncursesw.so.5 (0x00007fbb552b0000)
libgconf-2.so.4 => /usr/lib/libgconf-2.so.4 (0x00007fbb55080000)
libfreetype.so.6 => /usr/lib/libfreetype.so.6 (0x00007fbb54de1000)
libfontconfig.so.1 => /usr/lib/libfontconfig.so.1 (0x00007fbb54ba6000)
libotf.so.0 => /usr/lib/libotf.so.0 (0x00007fbb54991000)
libm17n-core.so.0 => /usr/lib/libm17n-core.so.0 (0x00007fbb54764000)
libm17n-flt.so.0 => /usr/lib/libm17n-flt.so.0 (0x00007fbb54559000)
libacl.so.1 => /usr/lib/libacl.so.1 (0x00007fbb54350000)
libgnutls.so.28 => /usr/lib/libgnutls.so.28 (0x00007fbb54043000)
libpthread.so.0 => /usr/lib/libpthread.so.0 (0x00007fbb53e27000)
libc.so.6 => /usr/lib/libc.so.6 (0x00007fbb53a7a000)
liblzma.so.5 => /usr/lib/liblzma.so.5 (0x00007fbb53857000)
libz.so.1 => /usr/lib/libz.so.1 (0x00007fbb53641000)
libgmodule-2.0.so.0 => /usr/lib/libgmodule-2.0.so.0 (0x00007fbb5343d000)
libpangocairo-1.0.so.0 => /usr/lib/libpangocairo-1.0.so.0 (0x00007fbb53230000)
libXi.so.6 => /usr/lib/libXi.so.6 (0x00007fbb53021000)
libXfixes.so.3 => /usr/lib/libXfixes.so.3 (0x00007fbb52e1a000)
libcairo-gobject.so.2 => /usr/lib/libcairo-gobject.so.2 (0x00007fbb52e10000)
libatk-1.0.so.0 => /usr/lib/libatk-1.0.so.0 (0x00007fbb52bed000)
libatk-bridge-2.0.so.0 => /usr/lib/libatk-bridge-2.0.so.0 (0x00007fbb529c3000)
libpangoft2-1.0.so.0 => /usr/lib/libpangoft2-1.0.so.0 (0x00007fbb527ae000)
libXinerama.so.1 => /usr/lib/libXinerama.so.1 (0x00007fbb525ab000)
libXrandr.so.2 => /usr/lib/libXrandr.so.2 (0x00007fbb523a1000)
libXcursor.so.1 => /usr/lib/libXcursor.so.1 (0x00007fbb52197000)
libXcomposite.so.1 => /usr/lib/libXcomposite.so.1 (0x00007fbb51f94000)
libXdamage.so.1 => /usr/lib/libXdamage.so.1 (0x00007fbb51d91000)
libwayland-client.so.0 => /usr/lib/libwayland-client.so.0 (0x00007fbb51b85000)
libxkbcommon.so.0 => /usr/lib/libxkbcommon.so.0 (0x00007fbb51923000)
libwayland-cursor.so.0 => /usr/lib/libwayland-cursor.so.0 (0x00007fbb5171b000)
libXext.so.6 => /usr/lib/libXext.so.6 (0x00007fbb51508000)
libpixman-1.so.0 => /usr/lib/libpixman-1.so.0 (0x00007fbb51270000)
libEGL.so.1 => /usr/lib/libEGL.so.1 (0x00007fbb5104e000)
libdl.so.2 => /usr/lib/libdl.so.2 (0x00007fbb50e4a000)
libxcb-shm.so.0 => /usr/lib/libxcb-shm.so.0 (0x00007fbb50c47000)
libxcb-render.so.0 => /usr/lib/libxcb-render.so.0 (0x00007fbb50a3d000)
libxcb.so.1 => /usr/lib/libxcb.so.1 (0x00007fbb5081e000)
libGL.so.1 => /usr/lib/libGL.so.1 (0x00007fbb50616000)
libgthread-2.0.so.0 => /usr/lib/libgthread-2.0.so.0 (0x00007fbb50414000)
libffi.so.6 => /usr/lib/libffi.so.6 (0x00007fbb5020b000)
libpcre.so.1 => /usr/lib/libpcre.so.1 (0x00007fbb4ffa8000)
libresolv.so.2 => /usr/lib/libresolv.so.2 (0x00007fbb4fd91000)
libuuid.so.1 => /usr/lib/libuuid.so.1 (0x00007fbb4fb8c000)
libcroco-0.6.so.3 => /usr/lib/libcroco-0.6.so.3 (0x00007fbb4f951000)
liblcms2.so.2 => /usr/lib/liblcms2.so.2 (0x00007fbb4f6fd000)
liblqr-1.so.0 => /usr/lib/liblqr-1.so.0 (0x00007fbb4f4e9000)
libXt.so.6 => /usr/lib/libXt.so.6 (0x00007fbb4f283000)
libbz2.so.1.0 => /usr/lib/libbz2.so.1.0 (0x00007fbb4f073000)
libltdl.so.7 => /usr/lib/libltdl.so.7 (0x00007fbb4ee69000)
libdbus-glib-1.so.2 => /usr/lib/libdbus-glib-1.so.2 (0x00007fbb4ec41000)
libexpat.so.1 => /usr/lib/libexpat.so.1 (0x00007fbb4ea17000)
libattr.so.1 => /usr/lib/libattr.so.1 (0x00007fbb4e812000)
libp11-kit.so.0 => /usr/lib/libp11-kit.so.0 (0x00007fbb4e5fe000)
libtasn1.so.6 => /usr/lib/libtasn1.so.6 (0x00007fbb4e3eb000)
libnettle.so.4 => /usr/lib/libnettle.so.4 (0x00007fbb4e1c0000)
libhogweed.so.2 => /usr/lib/libhogweed.so.2 (0x00007fbb4dfad000)
libgmp.so.10 => /usr/lib/libgmp.so.10 (0x00007fbb4dd37000)
/lib64/ld-linux-x86-64.so.2 (0x00007fbb59ea6000)
libharfbuzz.so.0 => /usr/lib/libharfbuzz.so.0 (0x00007fbb4daa3000)
libatspi.so.0 => /usr/lib/libatspi.so.0 (0x00007fbb4d87e000)
libX11-xcb.so.1 => /usr/lib/libX11-xcb.so.1 (0x00007fbb4d67c000)
libxcb-dri2.so.0 => /usr/lib/libxcb-dri2.so.0 (0x00007fbb4d477000)
libxcb-xfixes.so.0 => /usr/lib/libxcb-xfixes.so.0 (0x00007fbb4d270000)
libxcb-shape.so.0 => /usr/lib/libxcb-shape.so.0 (0x00007fbb4d06c000)
libwayland-server.so.0 => /usr/lib/libwayland-server.so.0 (0x00007fbb4ce5a000)
libgbm.so.1 => /usr/lib/libgbm.so.1 (0x00007fbb4cc54000)
libglapi.so.0 => /usr/lib/libglapi.so.0 (0x00007fbb4ca2e000)
libudev.so.1 => /usr/lib/libudev.so.1 (0x00007fbb4c81d000)
libdrm.so.2 => /usr/lib/libdrm.so.2 (0x00007fbb4c611000)
libXau.so.6 => /usr/lib/libXau.so.6 (0x00007fbb4c40d000)
libXdmcp.so.6 => /usr/lib/libXdmcp.so.6 (0x00007fbb4c206000)
libatiuki.so.1 => /usr/lib/libatiuki.so.1 (0x00007fbb4c0ec000)
libgraphite2.so.3 => /usr/lib/libgraphite2.so.3 (0x00007fbb4becd000)
libicule.so.50 => /usr/lib/libicule.so.50 (0x00007fbb4bc8b000)
libicuuc.so.50 => /usr/lib/libicuuc.so.50 (0x00007fbb4b915000)
libicudata.so.50 => /usr/lib/libicudata.so.50 (0x00007fbb4a342000)
libsystemd-daemon.so.0 => /usr/lib/libsystemd-daemon.so.0 (0x00007fbb4a13e000)
libstdc++.so.6 => /usr/lib/libstdc++.so.6 (0x00007fbb49e3b000)
libgcc_s.so.1 => /usr/lib/libgcc_s.so.1 (0x00007fbb49c26000)


-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

On 03/07/2013 04:16 PM, Nicolas Avrutin wrote:
> The files come from the imagemagick package [1]. The link displays the
> file list for the package and usr/lib/libMagickCore-Q16.so.7.0.0 (on
> Arch, /lib/ is a symlink to /usr/lib) is present there.

In that case it's probably not a version mismatch, then.
It may be a pain for me to come up with the exact source
used, though, since I don't know archlinux.  At any rate
I'm afraid it's something you'll have to debug.

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

I found a good way to reproduce it!

emacs -Q
(imagemagick-register-types)
(insert-image (create-image "/tmp/PNG_transparency_demonstration_2.png" 'imagemagick))

The segfault appears to happen on all PNGs with transparency. In
particular, the image I used was [1]. PNGs without transparency are inserted fine.

The ImageMagick source used in the Arch package (and the one I compiled
with debug symbols) is [2].

Footnotes: 
[1]  http://en.wikipedia.org/wiki/File:PNG_transparency_demonstration_2.png

[2]  ftp://ftp.sunet.se/pub/multimedia/graphics/ImageMagick/ImageMagick-6.8.2-3.tar.xz 

-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

Thanks for reproducing the problem.  Unfortunately I can't reproduce
it, with your recipe.  The image displays fine for me, both on
Fedora 17 x86-64 (which has ImageMagick 6.7.5) and on Ubuntu 12.10
x86-64 (which has ImageMagick 6.7.7).

Perhaps it's an incompatibility between Emacs and the later version
of ImageMagick that you're using, or perhaps it's something else,
but I'm afraid it'll need more debugging on your end.  The fact
that you have a reproducible test case should help.

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

Looks like something changed in imagemagick-6.8.2.0 that broke
this. imagemagick-6.8.1.9 works fine, but 6.8.2.0 and later versions
(including the latest version, 6.8.3.7) do not. The ImageMagick
changelog mentions some changes with regard to handling PNG transparency
in 6.8.2-0. As near as I can tell, the problem was introduced between
ImageMagick trunk revisions 10523 and 10826 (inclusive) and is probably
in trunk/coders/png.c, which narrows it down to revisions { 10523,
10524, 10577, 10578, 10602, 10640, 10709, 10711, 10762, 10809, 10810,
10820, 10826 }.

Unfortunately I haven't been able to get emacs to compile against the
trunk revisions of imagemagick (emacs just doesn't detect them and
builds without imagemagick support).

I suppose at this point, I think I'll file a bug at ImageMagick's bug forum.

I can send you full backtrace with the imagemagick calls if you think
it would be useful to you. Otherwise I'll just post it on the
imagemagick forum.

-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

On 03/09/2013 10:54 AM, Nicolas Avrutin wrote:
> I can send you full backtrace with the imagemagick calls if you think
> it would be useful to you. Otherwise I'll just post it on the
> imagemagick forum.

It might be helpful to send the backtrace, yes.

Also, it might be helpful for you to mention the ImageMagick bug info
in an email to 13867@debbugs.gnu.org so that later readers of this
thread can easily jump to the ImageMagick bug report.

Thanks for looking into this.

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

Reported the bug a couple days ago and actually just fixed it
myself. The bug was actually introduced in 6.8.2.3. See [1] for details.

Footnotes: 
[1]  http://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=22973#p96192

-- 
Nicolas Avrutin

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

Thanks, as this appears to be an ImageMagick bug
not an Emacs bug, I'm marking it as done in the
Emacs bug database.

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Stefan Monnier]

> Thanks, as this appears to be an ImageMagick bug
> not an Emacs bug, I'm marking it as done in the
> Emacs bug database.

Maybe we should add a note about it in PROBLEMS and/or add corresponding
checks in `configure'?


        Stefan

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Paul Eggert]

On 03/17/2013 06:06 AM, Stefan Monnier wrote:

> Maybe we should add a note about it in PROBLEMS and/or add corresponding
> checks in `configure'?

Sure, I took a crack at that as follows, installed as trunk bzr 112073.

=== modified file 'ChangeLog'
--- ChangeLog	2013-03-18 04:30:20 +0000
+++ ChangeLog	2013-03-18 05:26:56 +0000
@@ -1,5 +1,11 @@
 2013-03-18  Paul Eggert  <eggert@cs.ucla.edu>
 
+	Emacs crashes with ImageMagick 6.8.2-3 through 6.8.3-9 (Bug#13867).
+	* configure.ac (IMAGEMAGICK_MODULE): Reject 6.8.2.
+	We want to reject 6.8.2-3 through 6.8.3-9, but there seems to be
+	no way to do this in pkg-config, so make do with a reasonable
+	approximation.
+
 	Automate the build of ja-dic.el (Bug#13984).
 	* .bzrignore: Add leim/ja-dic/.
 

=== modified file 'configure.ac'
--- configure.ac	2013-03-13 18:42:22 +0000
+++ configure.ac	2013-03-18 05:26:56 +0000
@@ -1880,7 +1880,8 @@
     ## 6.2.8 is the earliest version known to work, but earlier versions
     ## might work - let us know if you find one.
     ## 6.0.7 does not work.  See bug#7955.
-    IMAGEMAGICK_MODULE="Wand >= 6.2.8"
+    ## 6.8.2 makes Emacs crash; see Bug#13867.
+    IMAGEMAGICK_MODULE="Wand >= 6.2.8 Wand != 6.8.2"
     PKG_CHECK_MODULES(IMAGEMAGICK, $IMAGEMAGICK_MODULE, HAVE_IMAGEMAGICK=yes, :)
     AC_SUBST(IMAGEMAGICK_CFLAGS)
     AC_SUBST(IMAGEMAGICK_LIBS)

=== modified file 'etc/ChangeLog'
--- etc/ChangeLog	2013-03-12 16:53:31 +0000
+++ etc/ChangeLog	2013-03-18 05:26:56 +0000
@@ -1,3 +1,8 @@
+2013-03-18  Paul Eggert  <eggert@cs.ucla.edu>
+
+	Emacs crashes with ImageMagick 6.8.2-3 through 6.8.3-9 (Bug#13867).
+	* PROBLEMS: Mention problem with ImageMagick 6.8.2-3 through 6.8.3-9.
+
 2013-03-12  Paul Eggert  <eggert@cs.ucla.edu>
 
 	Add coding tags for iso-2022-7bit files that are not already tagged.

=== modified file 'etc/PROBLEMS'
--- etc/PROBLEMS	2013-02-25 05:55:37 +0000
+++ etc/PROBLEMS	2013-03-18 05:26:56 +0000
@@ -206,6 +206,10 @@
 If your tar has this problem, install GNU tar--if you can manage to
 untar it :-).
 
+** Emacs crashes when displaying PNG images with simple (tRNS) transparency.
+This is due to a bug introduced in ImageMagick 6.8.2-3.  The bug
+should be fixed in ImageMagick 6.8.3-10.  Please see Bug#13867.
+
 ** Crashes when displaying GIF images in Emacs built with version
 libungif-4.1.0 are resolved by using version libungif-4.1.0b1.
 Configure checks for the correct version, but this problem could occur

bug#13867: 24.3.50; reading certain emails containing images in mu4e causes segfault

[Nicolas Avrutin]

On Mon, Mar 18 2013, Paul Eggert wrote:

> +** Emacs crashes when displaying PNG images with simple (tRNS) transparency.
> +This is due to a bug introduced in ImageMagick 6.8.2-3.  The bug
> +should be fixed in ImageMagick 6.8.3-10.  Please see Bug#13867.

Slight correction, the crash occurs with PNGs with any transparency
(rTNS or alpha). I just happened to use the tRNS image in my bug report,
but I originally noticed the bug on PNGs with an alpha channel.

It may also be worth mentioning that the crash occurs only when
ImageMagick is used to the display the PNG. Just visiting an image file
does not use ImageMagick and thus works fine, while insert-image (and
probably other stuff) does use ImageMagick and crashes.


-- 
Nicolas Avrutin