Skip to content

Instantly share code, notes, and snippets.

@kmuto
Created April 29, 2021 07:30
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save kmuto/5263e8ff390e1032803372bdf264f7e9 to your computer and use it in GitHub Desktop.
Save kmuto/5263e8ff390e1032803372bdf264f7e9 to your computer and use it in GitHub Desktop.
dvipdfmx Git 48a7fd2442de366a8ab9042334396bd87b63ca17 +特定STIX利用dviで壊れる
(gdb) run foo.dvi
3][4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19][20][21][22][23][24][25][26][27][28][29][30][31][32][33][34][35][36][37][38][39][40][41][42][43][44][45][46][47][48][49][50][51][52][53][54][55][56][57][58][59][60][61][62][63][64][65][66][67][68][69][70][71][72][73][74][75][76][77][78][79][80][81][82][83][84][85][86][87][88][89][90][91][92][93][94][95][96][97][98][99][100][101][102][103][104][105][106][107][108][109][110][111][112][113][114][115][116][117][118][119][120][121][122][123][124][125][126][127][128][129][130][131][132][133][134][135][136][137][138][139][140][141][142][143][144][145][146][147][148][149][150][151][152][153][154][155][156][157][158][159][160][161][162][163][164][165][166][167][168][169][170][171][172][173][174][175][176][177][178][179][180][181][182][183][184][185][186][187][188][189][190][191][192][193][194][195][196][197][198][199][200][201][202][203][204][205][206][207][208][209][210][211][212][213][214][215][216][217][218][219][220][221][222][223][224][225][226][227][228][229][230][231][232][233][234][235][236][237][238][239][240][241][242][243][244][245][246][247][248][249][250][251][252][253][254][255][256][257][258][259][260][261][262][263][264][265][266][267][268][269][270][271][272][273][274][275][276][277][278][279][280][281][282][283][284][285][286][287][288][289][290][291][292][293][294][295][296][297][298][299][300][301][302][303][304][305][306][307][308][309][310][311][312][313][314][315][316][317][318][319][320][321][322][323][324][325][326][327][328][329][330][331][332][333][334][335][336][337][338][339][340][341][342][343][344][345][346][347][348][349][350][351][352][353][354][355][356][357][358][359][360][361][362][363][364][365][366][367][368][369][370][371][372][373][374][375][376][377][378][379][380][381][382][383][384][385][386][387][388][389][390][391][392][393][394][395][396][397][398][399][400][401][402][403][404][405][406][407][408][409][410][411][412][413][414][415][416][417][418][419][420][421][422][423][424][425][426][427][428][429][430][431][432][433][434][435][436][437][438][439][440][441][442][443][444][445][446][447][448][449][450][451][452][453][454][455][456][457][458][459][460][461][462][463][464][465][466][467][468]
Program received signal SIGSEGV, Segmentation fault.
__strcmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:101
101	../sysdeps/x86_64/multiarch/strcmp-avx2.S: そのようなファイルやディレクトリはありません.

(gdb) bt
#0  __strcmp_avx2 () at ../sysdeps/x86_64/multiarch/strcmp-avx2.S:101
#1  0x00005555555bbfd7 in make_encoding_differences (enc_vec=0x55556a290b38, 
    baseenc=0x5555596c8b98, is_used=0x55556a291338 "")
    at ../../../texk/dvipdfm-x/pdfencoding.c:248
#2  0x00005555555bbbba in create_encoding_resource (encoding=0x55556a290b20, 
    baseenc=0x5555596c8b80) at ../../../texk/dvipdfm-x/pdfencoding.c:121
#3  0x00005555555bc745 in pdf_encoding_complete ()
    at ../../../texk/dvipdfm-x/pdfencoding.c:468
#4  0x00005555555be155 in pdf_close_fonts ()
    at ../../../texk/dvipdfm-x/pdffont.c:567
#5  0x00005555555b463c in pdf_close_document ()
    at ../../../texk/dvipdfm-x/pdfdoc.c:2582
#6  0x000055555559999d in main (argc=2, argv=0x7fffffffe758)
    at ../../../texk/dvipdfm-x/dvipdfmx.c:1248

(gdb) f 1
#1  0x00005555555bbfd7 in make_encoding_differences (enc_vec=0x55556a290b38, 
    baseenc=0x5555596c8b98, is_used=0x55556a291338 "")
    at ../../../texk/dvipdfm-x/pdfencoding.c:248
248	             strcmp(baseenc[code], enc_vec[code]) != 0) {

(gdb) p baseenc
$33 = (char **) 0x5555596c8b98
(gdb) p baseenc[code]
$34 = 0x3220772036393930 <error: Cannot access memory at address 0x3220772036393930>

(gdb) f 2
#2  0x00005555555bbbba in create_encoding_resource (encoding=0x55556a290b20, 
    baseenc=0x5555596c8b80) at ../../../texk/dvipdfm-x/pdfencoding.c:121
121	  differences = make_encoding_differences(encoding->glyphs,

(gdb) p encoding->glyphs
$35 = {0x5555596c0d20 "grave", 0x5555596c0d40 "acute", 
  0x5555596c0d60 "circumflex", 0x5555596c0d80 "tilde", 
  0x5555596c0da0 "dieresis", 0x5555596c0dc0 "hungarumlaut", 
  0x5555596c0de0 "ring", 0x5555596c0e00 "caron", 0x5555596c0e20 "breve", 
  0x5555596c0e40 "macron", 0x5555596c0e60 "dotaccent", 
...
580 "Atilde", 0x5555596c25a0 "Adieresis", 0x5555596c25c0 "Aring", 0x5555596c25e0 "AE", 0x5555596c2600 "Ccedilla"...}

(gdb) p baseenc->glyphs
$36 = {0x21 <error: Cannot access memory at address 0x21>, 0x0, 0x0, 0x0, 
  0x21 <error: Cannot access memory at address 0x21>, 0x5555596c8be0 "\004", 
  0x5555596c8c50 "\005", 0x5555596c9500 "", 
  0x31 <error: Cannot access memory at address 0x31>, 
  0x4 <error: Cannot access memory at address 0x4>, 
  0x1f7e30000 <error: Cannot access memory at address 0x1f7e30000>, 0x0, 
  0x5555596c8c10 "0\214lYUU", 
  0x512053206c203735 <error: Cannot access memory at address 0x512053206c203735>, 0x21 <error: Cannot access memory at address 0x21>, 0x5555596c8c30 "OCGs", 
  0x7ffff7e3eca0 <main_arena+96> "pg\235lUU", 0x0, 
  0x21 <error: Cannot access memory at address 0x21>, 
  0x7f007347434f <error: Cannot access memory at address 0x7f007347434f>, 
  0x7ffff7e3eca0 <main_arena+96> "pg\235lUU", 0x0, 
  0x31 <error: Cannot access memory at address 0x31>, 
  0x5 <error: Cannot access memory at address 0x5>, 
 ...
 memory at address 0x7120672030204720>, 0x3120302030203120 <error: Cannot access memory at address 0x3120302030203120>...}

(gdb) f 3
#3  0x00005555555bc745 in pdf_encoding_complete ()
    at ../../../texk/dvipdfm-x/pdfencoding.c:468
468	      encoding->resource = create_encoding_resource(encoding,

(gdb) p with_base
$37 = 1

(gdb) p encoding->baseenc
$38 = (struct pdf_encoding *) 0x5555596c8b80

(gdb) p enc_id
$39 = 3

(gdb) p enc_cache.count
$40 = 20

(gdb) p enc_cache
$41 = {count = 20, capacity = 35, encodings = 0x55556a28ef90}

(gdb) p encoding.ident
$43 = 0x5555596c0ce0 "stix2-t1.enc"

(gdb) p encoding.enc_name
$45 = 0x5555596c0d00 "stix2t1"

(gdb) p encoding.is_used

  $47 = '\000' <repeats 16 times>, "\001\001\000\000\000\000\000\000\000\000\000\001\001\001\001\000\000\001\000\000\000", '\001' <repeats 22 times>, "\000\001\001\001\000\000", '\001' <repeats 27 times>, "\000\001\001\001\000", '\001' <repeats 28 times>, '\000' <repeats 108 times>...

(gdb) p encoding.baseenc.ident
$49 = 0x0

(gdb) p encoding.baseenc.glyphs
53 = {0x21 <error: Cannot access memory at address 0x21>, 0x0, 0x0, 0x0, 
  0x21 <error: Cannot access memory at address 0x21>, 0x5555596c8be0 "\004", 
  0x5555596c8c50 "\005", 0x5555596c9500 "", 
  0x31 <error: Cannot access memory at address 0x31>, 
  0x4 <error: Cannot access memory at address 0x4>, 
  0x1f7e30000 <error: Cannot access memory at address 0x1f7e30000>, 0x0, 
  0x5555596c8c10 "0\214lYUU", 
  0x512053206c203735 <error: Cannot access memory at address 0x512053206c203735>, 0x21 <error: Cannot access memory at address 0x21>, 0x5555596c8c30 "OCGs", 
  0x7ffff7e3eca0 <main_arena+96> "pg\235lUU", 0x0, 
  0x21 <error: Cannot access memory at address 0x21>, 
  0x7f007347434f <error: Cannot access memory at address 0x7f007347434f>, 
  0x7ffff7e3eca0 <main_arena+96> "pg\235lUU", 0x0, 
  0x31 <error: Cannot access memory at address 0x31>, 
 ...
 memory at address 0x3120302030203120>...}

(gdb) p encoding.baseenc.is_used

  $54 = "161.218 47.359 cm 0 G  0 g  Q 0 G 0 g 1 G 1 g 0 G 0 g q 1 0 0 1 61.946 -187.834 cm Q Q Q Q  Q  Q  q  0.4 g  /pgf@ca1.0 gs  0.0 0.70865 m  0.0 94.00887 l  322.43608 94.00887 l  322.43608 0.70865 l  322"...

@kmuto
Copy link
Author

kmuto commented Apr 29, 2021

ページを減らした状態でstix2-t1.encのencoding.baseenc->identはWinAnsiEncodingになる。何かバッファ/ヒープのオーバーフローを起こしているようなかんじがする。

@kmuto
Copy link
Author

kmuto commented Apr 29, 2021

mem.hにmemwatchを噛ませてみたけど、WILD Free、null Free、あとリソース名のところでunfreeedなのがある模様。
ただ、ここからトレースするのは困難。
Linux側共有メモリは十分にある。

@kmuto
Copy link
Author

kmuto commented May 14, 2021

pdfencoding.cpdf_encoding_new_encoding に問題があります。
RENEW による再確保が実行されると encoding->baseenc が dangling pointer になります。
(16 毎に再確保するので異なるエンコーディングのフォントを 17 以上使うと再現しそう)

とのこと。lmr追加でおかしくなったのでそれが原因かと思ったけど、ptmでもダメだったので、確かに数上限の問題の模様。
コンテンツではなくページ数で結果に違いが出るのは不明…

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment