bug#34296: ghostscript segfaults with “pdfwrite” device

bug#34296: ghostscript segfaults with “pdfwrite” device

[Ricardo Wurmus]

I’m trying to generate a single PDF from multiple separate PDF files
that were generated from SVGs with Inkscape.

Here are the SVG files:

  https://git.savannah.gnu.org/cgit/guix/maintenance.git/tree/talks/fosdem-2019/gwl

I’m using this Makefile to generate the final PDF.

--8<---------------cut here---------------start------------->8---
SLIDES=\
  00-title \
  01-process \
  02-process2 \
  03-process3 \
  04-process4 \
  05-process5 \
  06-pipeline \
  07-pipeline2 \
  08-pipeline3 \
  09-pipeline4 \
  10-lies \
  11-environment \
  12-environment2 \
  13-environment-graph \
  14-containers \
  15-container-smoothie \
  30-guix \
  31-guix2 \
  31-guix3 \
  31-guix4 \
  31-guix5 \
  31-guix6 \
  32-gwl \
  33-gwl1 \
  33-gwl2 \
  34-gwl3 \
  34-gwl4 \
  34-gwl5 \
  34-gwl6 \
  35-gwl-free-features \
  36-gwl-new-features \
  98-summary \
  99-end

slides.pdf: $(addsuffix .pdf, ${SLIDES})
	gs -dBATCH -dNOPAUSE -q -sDEVICE=pdfwrite -sOutputFile=$@ $^

%.pdf: %.svg
	inkscape -z --export-dpi=300 --export-pdf=$@ $<
--8<---------------cut here---------------end--------------->8---

Run “make slides.pdf” to reproduce the segfault.  This is with
Ghostscript 9.24, but it also happens with 9.25.

The segfault is in “gx_compute_char_matrix”; here’s a backtrace:

--8<---------------cut here---------------start------------->8---
(gdb) bt
#0  0x00007ffff6e31eb0 in gx_compute_char_matrix () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#1  0x00007ffff6e32ad8 in gx_attach_tt_interpreter () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#2  0x00007ffff6e33559 in gx_add_fm_pair () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#3  0x00007ffff6e3212d in gx_lookup_fm_pair () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#4  0x00007ffff6bc85f5 in gs_type42_glyph_outline () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#5  0x00007ffff6e105ba in gs_default_glyph_info () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#6  0x00007ffff6bc87d1 in gs_type42_glyph_info_by_gid () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#7  0x00007ffff6ea7076 in z1_glyph_info_generic () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#8  0x00007ffff6eaeb67 in z42_glyph_info () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#9  0x00007ffff6d3a539 in pdf_process_string () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#10 0x00007ffff6d3b7f7 in process_plain_text () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#11 0x00007ffff6d4759c in pdf_text_process () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#12 0x00007ffff6ee2c8b in op_show_continue_pop () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#13 0x00007ffff6ee309c in zshow () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#14 0x00007ffff6ec6371 in interp () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#15 0x00007ffff6ec6de0 in gs_interpret () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#16 0x00007ffff6ebb539 in gs_main_run_string_end () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#17 0x00007ffff6ebce09 in run_string () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#18 0x00007ffff6ebcf7a in runarg () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#19 0x00007ffff6ebe748 in gs_main_init_with_args () from /gnu/store/z8lkz16mzvprg6k7vpcwcjmvhp10myzp-ghostscript-9.25/lib/libgs.so.9
#20 0x000000000040114b in ?? ()
#21 0x0000000000401350 in ?? ()
#22 0x0000000000405420 in ?? ()
#23 0x0000000000000000 in ?? ()
--8<---------------cut here---------------end--------------->8---

I noticed that it *doesn’t* segfault when only concatenating
00-title.pdf, but it fails with 01-process.pdf.  The relevant difference
seems to be that 00-title.svg refers to the League Gothic OTF font,
while 01-process.svg also uses the “MorrisRoman-Black.ttf” font.

When I remove the three instances where style attributes set
“font-family:'Morris Roman'” the segfault disappears.  It’s also fine if
I replace the font with “TeX Gyre Bonum”, an otf font.  It segfaults
with “DejaVu Sans”, which is mapped to a TTF font.

So my guess is that Ghostscript segfaults when a TTF font is used.

A work-around is to use the pdfimage32 device, which rasterizes the
input PDF file.  For some reason rasterization does NOT lead to a
segfault, even though that would also require Ghostscript to understand
the TTF fonts.

--
Ricardo

bug#34296: ghostscript segfaults with “pdfwrite” device

[Ricardo Wurmus]

Ricardo Wurmus <rekado@elephly.net> writes:

> I’m trying to generate a single PDF from multiple separate PDF files
> that were generated from SVGs with Inkscape.
[…]
> Run “make slides.pdf” to reproduce the segfault.  This is with
> Ghostscript 9.24, but it also happens with 9.25.

The problem has been fixed!  I think the fix was provided in commit
466ff55c72959ba1499ce3ec69f534b3038eb30b, which addressed another
Ghostscript problem.

See https://issues.guix.gnu.org/issue/34877 for details.

--
Ricardo