xdvipdfmx segfault

[Max Chernoff]

Hi all,

On Mon, 2024-03-04 at 14:39 -0700, karl at freefriends.org wrote:
> Looking at your backtrace, this is almost surely related to the
> very-recently-added support for named destinations in the pdf:image
> special

What Karl is politely saying is that this is my fault :)

> but we need the test case.

This special narrows it down to graphicx:



On Mon, 2024-03-04 at 22:06 +0100, hartmut_henkel at gmx.de wrote:
> #3  0x00005555555f2875 in spc_exec_special (
>     buffer=0x5555574de9aa "pdf:image matrix 1.0 0.0 0.0 1.0 0.0 0.0 page 0 pagebox cropbox (/home/hahe/texmf/tex/generic/logos/vhs/vhslogo1-cmyk.pdf)\216\216\357\npdf:etrans\216\216\216\216\216\216\216\215\215\215\222", size=122, x_user=1.5201782378580325e-05, y_user=17.231676379592155, mag=1, is_drawable=0x7fffffffda3c,
>     rect=0x7fffffffda10) at ../../../texk/dvipdfm-x/specials.c:811

So the following document produces the exact same specials:

   \documentclass{article}
   \usepackage{graphicx}
   \begin{document}
       \includegraphics{example-image.pdf}
   \end{document}
   
> #0  __strcmp_sse42 () at ../sysdeps/x86_64/multiarch/strcmp-sse4_2.S:173
> #1  0x00005555555d19be in pdf_ximage_load_image (ident=0x0, filename=0x555557682800 "/home/hahe/texmf/tex/generic/logos/vhs/vhslogo1-cmyk.pdf", options=...)
>     at ../../../texk/dvipdfm-x/pdfximage.c:418
   
Doing some further testing, I figured out that it segfaults whenever you
include the same page twice:

   \special{pdf:image (example-image.pdf)}
   \special{pdf:image (example-image.pdf)}
   \bye

The code at pdfximage.c:418 uses "strcmp" to check the page name when a
page is included more than once. The issue is that if the page isn't
selected my name--the typical case--then the page name is NULL, and you
get the segfault. The following patch seems to fix the issue:

diff --git a/texk/dvipdfm-x/pdfximage.c b/texk/dvipdfm-x/pdfximage.c
index 016583fd..275f6777 100644
--- a/texk/dvipdfm-x/pdfximage.c
+++ b/texk/dvipdfm-x/pdfximage.c
@@ -415,7 +415,8 @@ pdf_ximage_load_image (const char *ident, const char *filename, load_options opt
   }
   if (id >= 0) {
     if (I->attr.page_no == options.page_no &&
-        strcmp(I->attr.page_name, options.page_name) == 0 &&
+        (I->attr.page_name && options.page_name &&
+         strcmp(I->attr.page_name, options.page_name) == 0) &&
         !pdf_compare_object(I->attr.dict, options.dict) && /* ????? */
         I->attr.bbox_type == options.bbox_type) {
       return id;
---


Sorry for the bug, but thanks for the report.

Thanks,
-- Max