Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Bug#998888: X-device: BadDrawable (invalid Pixmap or Window parameter)
8 views
Skip to first unread message
Florian Lindemann
Nov 9, 2021, 9:30:03 AM11/9/21
to
Package: ghostscript-x
Version: 9.54.0~dfsg-5
Severity: normal
Tags: patch
Dear Maintainer,
upstream commit 033ed8bf196b1cddd681a9b32d9398bf6bc02d24 (included in
debian/9.54.0~dfsg-1) introduced a call to XFreePixmap in gdev_x_close.
This might free a pixmap that was created by ghostview as a backing
pixmap and might still be used by ghostview for further drawing.
I'm not entirely sure which files causes the gs process to close the device
early, but with some files it does and gv actions like reloading/zooming
attempt to draw on the already freed pixmap and cause gv to crash with
X Error of failed request: BadPixmap (invalid Pixmap parameter).
Especially the -watch option of gv is broken if it is used to watch a
postscript file that's in development. Any postscript error will cause the
device to free the backing pixmap and ghostview will crash even if the
error in the file gets fixed. It was possible to do that in the past (the
backing pixmap was reused with a new gs process).
It's possible to reproduce the issue with a small example file like this:
newpath
100 200 moveto
200 250 lineto
100 300 lineto
2 setlinewidth
stroke
Please note that there is no "showpage", which seems to cause the invocation
of gdev_x_close (with showpage, the gs process keeps running). With such a
file gv will crash when trying to zoom / reload etc. (ghostview needs to run
with backing pixmap enabled (-pixmap), the -nopixmap option will of course
work around the bug).
I attached a simple patch that checks if the pixmap is created by ghostview
(xdev->ghostview is set) and only frees it if that's not the case.
Cheers,
Florian
-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (550, 'testing'), (210, 'unstable'), (1, 'experimental')
Architecture: i386 (x86_64)
Kernel: Linux 4.14.151-64+ (SMP w/96 CPU threads; PREEMPT)
Kernel taint flags: TAINT_DIE
Locale: LANG=C, LC_CTYPE=de_DE (charmap=ISO-8859-1), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages ghostscript-x depends on:
ii ghostscript 9.54.0~dfsg-5bfw3
ii libc6 2.32-4bfw1
ii libx11-6 2:1.7.2-2+b1
ii libxt6 1:1.2.0-1
ghostscript-x recommends no packages.
ghostscript-x suggests no packages.
-- no debconf information
Version: 9.54.0~dfsg-5
Severity: normal
Tags: patch
Dear Maintainer,
upstream commit 033ed8bf196b1cddd681a9b32d9398bf6bc02d24 (included in
debian/9.54.0~dfsg-1) introduced a call to XFreePixmap in gdev_x_close.
This might free a pixmap that was created by ghostview as a backing
pixmap and might still be used by ghostview for further drawing.
I'm not entirely sure which files causes the gs process to close the device
early, but with some files it does and gv actions like reloading/zooming
attempt to draw on the already freed pixmap and cause gv to crash with
X Error of failed request: BadPixmap (invalid Pixmap parameter).
Especially the -watch option of gv is broken if it is used to watch a
postscript file that's in development. Any postscript error will cause the
device to free the backing pixmap and ghostview will crash even if the
error in the file gets fixed. It was possible to do that in the past (the
backing pixmap was reused with a new gs process).
It's possible to reproduce the issue with a small example file like this:
newpath
100 200 moveto
200 250 lineto
100 300 lineto
2 setlinewidth
stroke
Please note that there is no "showpage", which seems to cause the invocation
of gdev_x_close (with showpage, the gs process keeps running). With such a
file gv will crash when trying to zoom / reload etc. (ghostview needs to run
with backing pixmap enabled (-pixmap), the -nopixmap option will of course
work around the bug).
I attached a simple patch that checks if the pixmap is created by ghostview
(xdev->ghostview is set) and only frees it if that's not the case.
Cheers,
Florian
-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (550, 'testing'), (210, 'unstable'), (1, 'experimental')
Architecture: i386 (x86_64)
Kernel: Linux 4.14.151-64+ (SMP w/96 CPU threads; PREEMPT)
Kernel taint flags: TAINT_DIE
Locale: LANG=C, LC_CTYPE=de_DE (charmap=ISO-8859-1), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)
Versions of packages ghostscript-x depends on:
ii ghostscript 9.54.0~dfsg-5bfw3
ii libc6 2.32-4bfw1
ii libx11-6 2:1.7.2-2+b1
ii libxt6 1:1.2.0-1
ghostscript-x recommends no packages.
ghostscript-x suggests no packages.
-- no debconf information
Jonas Smedegaard
Nov 9, 2021, 9:40:06 AM11/9/21
to
Hi Florian,
Quoting Florian Lindemann (2021-11-09 15:02:43)
Since this is an issue in Ghostscript itself (not its packaging) and you
are more knowledgeable than me, could you please report this upstream at
the Ghostsript issue tracker yourself?
https://bugs.ghostscript.com/
Kind regards,
- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
[x] quote me freely [ ] ask before reusing [ ] keep private
Quoting Florian Lindemann (2021-11-09 15:02:43)
> I attached a simple patch that checks if the pixmap is created by
> ghostview (xdev->ghostview is set) and only frees it if that's not the
> case.
Thanks - also for the detailed explanation.
> ghostview (xdev->ghostview is set) and only frees it if that's not the
> case.
Since this is an issue in Ghostscript itself (not its packaging) and you
are more knowledgeable than me, could you please report this upstream at
the Ghostsript issue tracker yourself?
https://bugs.ghostscript.com/
Kind regards,
- Jonas
--
* Jonas Smedegaard - idealist & Internet-arkitekt
* Tlf.: +45 40843136 Website: http://dr.jones.dk/
[x] quote me freely [ ] ask before reusing [ ] keep private
Florian Lindemann
Nov 30, 2021, 5:00:03 AM11/30/21
to
Dear Jonas,
thank you for applying the patch that quickly, unfortunately it's not
fixing the issue, since my original patch was different, please have a
look at https://bugs.ghostscript.com/show_bug.cgi?id=704709
Thank you very much for your effort.
Regards
Florian
On Fri, Nov 19, 2021 at 07:06:20PM +0100, Jonas Smedegaard wrote:
> Version: 9.55.0~dfsg-1
>
> Quoting Jonas Smedegaard (2021-11-09 15:36:03)
>
> Thanks,
thank you for applying the patch that quickly, unfortunately it's not
fixing the issue, since my original patch was different, please have a
look at https://bugs.ghostscript.com/show_bug.cgi?id=704709
Thank you very much for your effort.
Regards
Florian
On Fri, Nov 19, 2021 at 07:06:20PM +0100, Jonas Smedegaard wrote:
> Version: 9.55.0~dfsg-1
>
> Quoting Jonas Smedegaard (2021-11-09 15:36:03)
> > Quoting Florian Lindemann (2021-11-09 15:02:43)
> > > I attached a simple patch that checks if the pixmap is created by
> > > ghostview (xdev->ghostview is set) and only frees it if that's not
> > > the case.
> >
> > > ghostview (xdev->ghostview is set) and only frees it if that's not
> > > the case.
> >
> > Thanks - also for the detailed explanation.
> >
> > Since this is an issue in Ghostscript itself (not its packaging) and
> > you are more knowledgeable than me, could you please report this
> > upstream at the Ghostsript issue tracker yourself?
> >
> > https://bugs.ghostscript.com/
>
> This issue is fixed in ghostscript 9.55.0~dfsg-1
> >
> > Since this is an issue in Ghostscript itself (not its packaging) and
> > you are more knowledgeable than me, could you please report this
> > upstream at the Ghostsript issue tracker yourself?
> >
> > https://bugs.ghostscript.com/
>
>
> Thanks,
Jonas Smedegaard
Nov 30, 2021, 6:30:03 AM11/30/21
to
Quoting Florian Lindemann (2021-11-30 10:36:53)
> thank you for applying the patch that quickly, unfortunately it's not
> fixing the issue, since my original patch was different, please have a
> look at https://bugs.ghostscript.com/show_bug.cgi?id=704709
Ah, right. I'll fix this right away - thanks for reporting!
> fixing the issue, since my original patch was different, please have a
> look at https://bugs.ghostscript.com/show_bug.cgi?id=704709
0 new messages